dcrat | d6a84df037f61f036bee2b9f10cc26e394aa58b536c3a982b76a37d7520dad10

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2024 12:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_d6a84df037f61f036bee2b9f10cc26e394aa58b536c3a982b76a37d7520dad10.exe
Size

1.3MB
MD5

0b5243ab27a8965bc8ae2890ec65aada
SHA1

9c901d86afde7fc01c477a5bcd6d3fd5f3d3b4bf
SHA256

d6a84df037f61f036bee2b9f10cc26e394aa58b536c3a982b76a37d7520dad10
SHA512

504834b6d28e5fad1ab88c27d1aa502dd1c9c1fbfeca01454d3a64a10d859031b44ee56f64b9ecbdcae498186955b56860e4289f86392cfea65608a63c5396ae
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 36 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1032	4124	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	792	4124	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2576	4124	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1348	4124	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4744	4124	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	376	4124	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3444	4124	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4144	4124	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3960	4124	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1424	4124	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2020	4124	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3848	4124	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2784	4124	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	184	4124	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2132	4124	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3052	4124	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4796	4124	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4936	4124	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3392	4124	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1500	4124	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3044	4124	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4528	4124	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2988	4124	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	504	4124	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	228	4124	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5016	4124	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2964	4124	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2596	4124	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2644	4124	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2976	4124	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1168	4124	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2924	4124	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2180	4124	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1692	4124	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2436	4124	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3152	4124	schtasks.exe	88

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x000a000000023b92-10.dat	dcrat
behavioral2/memory/1852-13-0x0000000000340000-0x0000000000450000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 13 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3552	powershell.exe
1704	powershell.exe
2776	powershell.exe
2580	powershell.exe
2608	powershell.exe
1264	powershell.exe
2328	powershell.exe
2796	powershell.exe
2204	powershell.exe
3676	powershell.exe
4952	powershell.exe
4468	powershell.exe
3956	powershell.exe

Checks computer location settings 2 TTPs 15 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	spoolsv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	spoolsv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	spoolsv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	spoolsv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	spoolsv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	spoolsv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	spoolsv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	spoolsv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	spoolsv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	spoolsv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	spoolsv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	spoolsv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	JaffaCakes118_d6a84df037f61f036bee2b9f10cc26e394aa58b536c3a982b76a37d7520dad10.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe

Executes dropped EXE 13 IoCs

pid	Process
1852	DllCommonsvc.exe
5016	spoolsv.exe
964	spoolsv.exe
1684	spoolsv.exe
872	spoolsv.exe
2776	spoolsv.exe
2156	spoolsv.exe
4312	spoolsv.exe
3572	spoolsv.exe
3920	spoolsv.exe
3216	spoolsv.exe
2632	spoolsv.exe
4840	spoolsv.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 13 IoCs

Web Service

T1102

flow	ioc
41	raw.githubusercontent.com
45	raw.githubusercontent.com
49	raw.githubusercontent.com
53	raw.githubusercontent.com
54	raw.githubusercontent.com
56	raw.githubusercontent.com
18	raw.githubusercontent.com
19	raw.githubusercontent.com
26	raw.githubusercontent.com
40	raw.githubusercontent.com
42	raw.githubusercontent.com
52	raw.githubusercontent.com
55	raw.githubusercontent.com

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Portable Devices\69ddcba757bf72	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Mail\Idle.exe	DllCommonsvc.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\Idle.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Mail\6ccacd8608530f	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Defender\spoolsv.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Defender\f3b6ecef712a24	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Portable Devices\smss.exe	DllCommonsvc.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\apppatch\es-ES\ea9f0e6c9e2dcd	DllCommonsvc.exe
File created	C:\Windows\es-ES\unsecapp.exe	DllCommonsvc.exe
File created	C:\Windows\es-ES\29c1c3cc0f7685	DllCommonsvc.exe
File created	C:\Windows\Media\OfficeClickToRun.exe	DllCommonsvc.exe
File created	C:\Windows\Media\e6c9b481da804f	DllCommonsvc.exe
File created	C:\Windows\apppatch\es-ES\taskhostw.exe	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_d6a84df037f61f036bee2b9f10cc26e394aa58b536c3a982b76a37d7520dad10.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 14 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	spoolsv.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	spoolsv.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	spoolsv.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	spoolsv.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	JaffaCakes118_d6a84df037f61f036bee2b9f10cc26e394aa58b536c3a982b76a37d7520dad10.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	spoolsv.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	spoolsv.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	spoolsv.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	spoolsv.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	spoolsv.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	spoolsv.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	spoolsv.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	spoolsv.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 36 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1500	schtasks.exe
2988	schtasks.exe
2596	schtasks.exe
1692	schtasks.exe
4936	schtasks.exe
4144	schtasks.exe
3960	schtasks.exe
1424	schtasks.exe
3044	schtasks.exe
4528	schtasks.exe
2924	schtasks.exe
4744	schtasks.exe
184	schtasks.exe
3052	schtasks.exe
2964	schtasks.exe
2644	schtasks.exe
1168	schtasks.exe
792	schtasks.exe
4796	schtasks.exe
504	schtasks.exe
2976	schtasks.exe
3444	schtasks.exe
376	schtasks.exe
228	schtasks.exe
1348	schtasks.exe
3848	schtasks.exe
2784	schtasks.exe
2132	schtasks.exe
3392	schtasks.exe
5016	schtasks.exe
2180	schtasks.exe
3152	schtasks.exe
1032	schtasks.exe
2020	schtasks.exe
2436	schtasks.exe
2576	schtasks.exe

Suspicious behavior: EnumeratesProcesses 58 IoCs

pid	Process
1852	DllCommonsvc.exe
1852	DllCommonsvc.exe
1852	DllCommonsvc.exe
1852	DllCommonsvc.exe
1852	DllCommonsvc.exe
1704	powershell.exe
1704	powershell.exe
3552	powershell.exe
3552	powershell.exe
4952	powershell.exe
4952	powershell.exe
2796	powershell.exe
2796	powershell.exe
4468	powershell.exe
4468	powershell.exe
1264	powershell.exe
1264	powershell.exe
2580	powershell.exe
2580	powershell.exe
2776	powershell.exe
2776	powershell.exe
3956	powershell.exe
3956	powershell.exe
3676	powershell.exe
3676	powershell.exe
2608	powershell.exe
2608	powershell.exe
2328	powershell.exe
2328	powershell.exe
2204	powershell.exe
2204	powershell.exe
2328	powershell.exe
1704	powershell.exe
1704	powershell.exe
4952	powershell.exe
3552	powershell.exe
3552	powershell.exe
1264	powershell.exe
4468	powershell.exe
2608	powershell.exe
2796	powershell.exe
3956	powershell.exe
2580	powershell.exe
2776	powershell.exe
3676	powershell.exe
2204	powershell.exe
5016	spoolsv.exe
964	spoolsv.exe
1684	spoolsv.exe
872	spoolsv.exe
2776	spoolsv.exe
2156	spoolsv.exe
4312	spoolsv.exe
3572	spoolsv.exe
3920	spoolsv.exe
3216	spoolsv.exe
2632	spoolsv.exe
4840	spoolsv.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: SeDebugPrivilege	1852	DllCommonsvc.exe
Token: SeDebugPrivilege	1704	powershell.exe
Token: SeDebugPrivilege	3552	powershell.exe
Token: SeDebugPrivilege	4952	powershell.exe
Token: SeDebugPrivilege	2796	powershell.exe
Token: SeDebugPrivilege	4468	powershell.exe
Token: SeDebugPrivilege	2608	powershell.exe
Token: SeDebugPrivilege	1264	powershell.exe
Token: SeDebugPrivilege	3956	powershell.exe
Token: SeDebugPrivilege	2328	powershell.exe
Token: SeDebugPrivilege	2580	powershell.exe
Token: SeDebugPrivilege	2776	powershell.exe
Token: SeDebugPrivilege	3676	powershell.exe
Token: SeDebugPrivilege	2204	powershell.exe
Token: SeDebugPrivilege	5016	spoolsv.exe
Token: SeDebugPrivilege	964	spoolsv.exe
Token: SeDebugPrivilege	1684	spoolsv.exe
Token: SeDebugPrivilege	872	spoolsv.exe
Token: SeDebugPrivilege	2776	spoolsv.exe
Token: SeDebugPrivilege	2156	spoolsv.exe
Token: SeDebugPrivilege	4312	spoolsv.exe
Token: SeDebugPrivilege	3572	spoolsv.exe
Token: SeDebugPrivilege	3920	spoolsv.exe
Token: SeDebugPrivilege	3216	spoolsv.exe
Token: SeDebugPrivilege	2632	spoolsv.exe
Token: SeDebugPrivilege	4840	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5044 wrote to memory of 3464	5044	JaffaCakes118_d6a84df037f61f036bee2b9f10cc26e394aa58b536c3a982b76a37d7520dad10.exe	84
PID 5044 wrote to memory of 3464	5044	JaffaCakes118_d6a84df037f61f036bee2b9f10cc26e394aa58b536c3a982b76a37d7520dad10.exe	84
PID 5044 wrote to memory of 3464	5044	JaffaCakes118_d6a84df037f61f036bee2b9f10cc26e394aa58b536c3a982b76a37d7520dad10.exe	84
PID 3464 wrote to memory of 1416	3464	WScript.exe	85
PID 3464 wrote to memory of 1416	3464	WScript.exe	85
PID 3464 wrote to memory of 1416	3464	WScript.exe	85
PID 1416 wrote to memory of 1852	1416	cmd.exe	87
PID 1416 wrote to memory of 1852	1416	cmd.exe	87
PID 1852 wrote to memory of 2204	1852	DllCommonsvc.exe	125
PID 1852 wrote to memory of 2204	1852	DllCommonsvc.exe	125
PID 1852 wrote to memory of 3552	1852	DllCommonsvc.exe	126
PID 1852 wrote to memory of 3552	1852	DllCommonsvc.exe	126
PID 1852 wrote to memory of 1704	1852	DllCommonsvc.exe	127
PID 1852 wrote to memory of 1704	1852	DllCommonsvc.exe	127
PID 1852 wrote to memory of 2796	1852	DllCommonsvc.exe	128
PID 1852 wrote to memory of 2796	1852	DllCommonsvc.exe	128
PID 1852 wrote to memory of 3956	1852	DllCommonsvc.exe	129
PID 1852 wrote to memory of 3956	1852	DllCommonsvc.exe	129
PID 1852 wrote to memory of 2328	1852	DllCommonsvc.exe	130
PID 1852 wrote to memory of 2328	1852	DllCommonsvc.exe	130
PID 1852 wrote to memory of 1264	1852	DllCommonsvc.exe	132
PID 1852 wrote to memory of 1264	1852	DllCommonsvc.exe	132
PID 1852 wrote to memory of 4468	1852	DllCommonsvc.exe	133
PID 1852 wrote to memory of 4468	1852	DllCommonsvc.exe	133
PID 1852 wrote to memory of 4952	1852	DllCommonsvc.exe	134
PID 1852 wrote to memory of 4952	1852	DllCommonsvc.exe	134
PID 1852 wrote to memory of 2608	1852	DllCommonsvc.exe	135
PID 1852 wrote to memory of 2608	1852	DllCommonsvc.exe	135
PID 1852 wrote to memory of 2580	1852	DllCommonsvc.exe	136
PID 1852 wrote to memory of 2580	1852	DllCommonsvc.exe	136
PID 1852 wrote to memory of 2776	1852	DllCommonsvc.exe	137
PID 1852 wrote to memory of 2776	1852	DllCommonsvc.exe	137
PID 1852 wrote to memory of 3676	1852	DllCommonsvc.exe	138
PID 1852 wrote to memory of 3676	1852	DllCommonsvc.exe	138
PID 1852 wrote to memory of 1444	1852	DllCommonsvc.exe	151
PID 1852 wrote to memory of 1444	1852	DllCommonsvc.exe	151
PID 1444 wrote to memory of 980	1444	cmd.exe	153
PID 1444 wrote to memory of 980	1444	cmd.exe	153
PID 1444 wrote to memory of 5016	1444	cmd.exe	156
PID 1444 wrote to memory of 5016	1444	cmd.exe	156
PID 5016 wrote to memory of 4544	5016	spoolsv.exe	159
PID 5016 wrote to memory of 4544	5016	spoolsv.exe	159
PID 4544 wrote to memory of 3976	4544	cmd.exe	161
PID 4544 wrote to memory of 3976	4544	cmd.exe	161
PID 4544 wrote to memory of 964	4544	cmd.exe	164
PID 4544 wrote to memory of 964	4544	cmd.exe	164
PID 964 wrote to memory of 4088	964	spoolsv.exe	165
PID 964 wrote to memory of 4088	964	spoolsv.exe	165
PID 4088 wrote to memory of 5084	4088	cmd.exe	167
PID 4088 wrote to memory of 5084	4088	cmd.exe	167
PID 4088 wrote to memory of 1684	4088	cmd.exe	169
PID 4088 wrote to memory of 1684	4088	cmd.exe	169
PID 1684 wrote to memory of 4132	1684	spoolsv.exe	171
PID 1684 wrote to memory of 4132	1684	spoolsv.exe	171
PID 4132 wrote to memory of 2224	4132	cmd.exe	173
PID 4132 wrote to memory of 2224	4132	cmd.exe	173
PID 4132 wrote to memory of 872	4132	cmd.exe	174
PID 4132 wrote to memory of 872	4132	cmd.exe	174
PID 872 wrote to memory of 656	872	spoolsv.exe	175
PID 872 wrote to memory of 656	872	spoolsv.exe	175
PID 656 wrote to memory of 644	656	cmd.exe	177
PID 656 wrote to memory of 644	656	cmd.exe	177
PID 656 wrote to memory of 2776	656	cmd.exe	178
PID 656 wrote to memory of 2776	656	cmd.exe	178

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d6a84df037f61f036bee2b9f10cc26e394aa58b536c3a982b76a37d7520dad10.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d6a84df037f61f036bee2b9f10cc26e394aa58b536c3a982b76a37d7520dad10.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5044
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3464
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1416
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1852
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2204
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Mail\Idle.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3552
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\winlogon.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1704
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\fontdrvhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2796
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\es-ES\unsecapp.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3956
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Defender\spoolsv.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2328
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Media\OfficeClickToRun.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1264
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\SppExtComObj.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4468
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\apppatch\es-ES\taskhostw.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4952
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Portable Devices\smss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2608
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\unsecapp.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2580
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\Idle.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2776
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\conhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3676
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\zujFmWWXSS.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1444
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:980
      - C:\Program Files (x86)\Windows Defender\spoolsv.exe
        
        "C:\Program Files (x86)\Windows Defender\spoolsv.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5016
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\wtOcRLEbie.bat"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:4544
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:3976
        
        C:\Program Files (x86)\Windows Defender\spoolsv.exe
        
        "C:\Program Files (x86)\Windows Defender\spoolsv.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:964
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\JJ2zQTaq6h.bat"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:4088
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:5084
        
        C:\Program Files (x86)\Windows Defender\spoolsv.exe
        
        "C:\Program Files (x86)\Windows Defender\spoolsv.exe"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1684
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\GW80Ek08hx.bat"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:4132
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:2224
        
        C:\Program Files (x86)\Windows Defender\spoolsv.exe
        
        "C:\Program Files (x86)\Windows Defender\spoolsv.exe"
        12⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:872
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\JJ2zQTaq6h.bat"
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:656
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        14⤵
        
        PID:644
        
        C:\Program Files (x86)\Windows Defender\spoolsv.exe
        
        "C:\Program Files (x86)\Windows Defender\spoolsv.exe"
        14⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2776
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ZHEG9SYztW.bat"
        15⤵
        
        PID:2024
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        16⤵
        
        PID:500
        
        C:\Program Files (x86)\Windows Defender\spoolsv.exe
        
        "C:\Program Files (x86)\Windows Defender\spoolsv.exe"
        16⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2156
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\JJ2zQTaq6h.bat"
        17⤵
        
        PID:3672
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        18⤵
        
        PID:3296
        
        C:\Program Files (x86)\Windows Defender\spoolsv.exe
        
        "C:\Program Files (x86)\Windows Defender\spoolsv.exe"
        18⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4312
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ISA3vp411k.bat"
        19⤵
        
        PID:3124
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        20⤵
        
        PID:3132
        
        C:\Program Files (x86)\Windows Defender\spoolsv.exe
        
        "C:\Program Files (x86)\Windows Defender\spoolsv.exe"
        20⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3572
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\jBrSCX6wbi.bat"
        21⤵
        
        PID:5084
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        22⤵
        
        PID:4696
        
        C:\Program Files (x86)\Windows Defender\spoolsv.exe
        
        "C:\Program Files (x86)\Windows Defender\spoolsv.exe"
        22⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3920
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\5cWoBfSAzl.bat"
        23⤵
        
        PID:3464
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        24⤵
        
        PID:2272
        
        C:\Program Files (x86)\Windows Defender\spoolsv.exe
        
        "C:\Program Files (x86)\Windows Defender\spoolsv.exe"
        24⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3216
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\6n1oUPmZQq.bat"
        25⤵
        
        PID:1644
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        26⤵
        
        PID:4984
        
        C:\Program Files (x86)\Windows Defender\spoolsv.exe
        
        "C:\Program Files (x86)\Windows Defender\spoolsv.exe"
        26⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2632
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\qqpXlQnQd1.bat"
        27⤵
        
        PID:2924
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        28⤵
        
        PID:3908
        
        C:\Program Files (x86)\Windows Defender\spoolsv.exe
        
        "C:\Program Files (x86)\Windows Defender\spoolsv.exe"
        28⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4840
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\GW80Ek08hx.bat"
        29⤵
        
        PID:1312
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        30⤵
        
        PID:3068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Mail\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Mail\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 10 /tr "'C:\providercommon\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\providercommon\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 6 /tr "'C:\providercommon\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\providercommon\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\providercommon\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\providercommon\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 5 /tr "'C:\Windows\es-ES\unsecapp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1424

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Windows\es-ES\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 5 /tr "'C:\Windows\es-ES\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Defender\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Defender\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2132

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 10 /tr "'C:\Windows\Media\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Windows\Media\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 5 /tr "'C:\Windows\Media\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 8 /tr "'C:\providercommon\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\providercommon\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1500

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 8 /tr "'C:\providercommon\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 8 /tr "'C:\Windows\apppatch\es-ES\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Windows\apppatch\es-ES\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 9 /tr "'C:\Windows\apppatch\es-ES\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Portable Devices\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Portable Devices\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 10 /tr "'C:\providercommon\unsecapp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\providercommon\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 8 /tr "'C:\providercommon\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1168

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2180

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 13 /tr "'C:\providercommon\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\providercommon\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 8 /tr "'C:\providercommon\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\spoolsv.exe.log

Filesize
1KB

MD5
baf55b95da4a601229647f25dad12878

SHA1
abc16954ebfd213733c4493fc1910164d825cac8

SHA256
ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

SHA512
24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6d42b6da621e8df5674e26b799c8e2aa

SHA1
ab3ce1327ea1eeedb987ec823d5e0cb146bafa48

SHA256
5ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c

SHA512
53faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
cadef9abd087803c630df65264a6c81c

SHA1
babbf3636c347c8727c35f3eef2ee643dbcc4bd2

SHA256
cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

SHA512
7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3a6bad9528f8e23fb5c77fbd81fa28e8

SHA1
f127317c3bc6407f536c0f0600dcbcf1aabfba36

SHA256
986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

SHA512
846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
104B

MD5
2f5cdf236d0c385147196beb516eb395

SHA1
4d4d6438705491079767cbdbec09b58b1d8d9c8b

SHA256
823735d1064079839ba7a3816d86ed592307d748f1ce95320f8b3389c11cf166

SHA512
dafe9400819b91f458627deb34a1a550cc7c9252911ce67d8a1ea687477f8eda42c1d92e0ac0c64ed47f11c4089342c9c50843e4e36e50b00ab37b5256a04302

Download Submit
C:\Users\Admin\AppData\Local\Temp\5cWoBfSAzl.bat

Filesize
216B

MD5
c960df997cbf1d0cbd3b5371013373a8

SHA1
73346be3bb38a8adaeb3656cfe9173e04220de05

SHA256
25127c75166cde84123b6a698c6b43998942e656e67c9dad684701aa682bae24

SHA512
0dc83bc9616fc9795031e3f1629cabcd8ef9c5ac973d9dd46bc9e47d9a2d283c72deda40bbda9c1b1f73b0b619d9ae04742b272a861ebc9a1323ad93d8a21214

Download Submit
C:\Users\Admin\AppData\Local\Temp\6n1oUPmZQq.bat

Filesize
216B

MD5
c59332c9093565324fc631f94a961dbc

SHA1
d590a769484a80ef89332fd7a0492db7e1ec5640

SHA256
5a0f16f2a9b1f593ff885b611cc2fb7e562a02067ea4dfae053a086a24cc1a4f

SHA512
ce72ca6ccbf65f49bc45cd5252d64c1b09e468b8e5845194ce769e9bdba39dd82e95a7926505702e8deeb40fb458e53fbfd98be2bbbbe46f5902c274ce0182b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\GW80Ek08hx.bat

Filesize
216B

MD5
d92a73d40761e90201650d9380522a94

SHA1
dfd0e14523736508a0da1913fb33822d8a1182c5

SHA256
c5b26ee0ec00550d0e2261829082e14c888c2cbac0a7e2673dc555758341f00b

SHA512
e9d5d2d544ae2be4fe5aa3c25689804a0027ae88ee0a51fec0fc7ab4f5cf44de281511dc9b700fac6685354f86070fb04144606ed2dc5b6c67ecedf36a1ae25e

Download Submit
C:\Users\Admin\AppData\Local\Temp\ISA3vp411k.bat

Filesize
216B

MD5
65d153b9aefd03d4cd29decba9dfb1a5

SHA1
c4fb5bf02cd2ba2ec9aa486cdd2bb59a8cdac1fb

SHA256
8e0652e84d53380f9576cb67bb783db84ef25df7bc2feb694021f518539416c7

SHA512
c27bada3de62471061c6453c4cab8d1e99f532130ff1d7dec16bf654f8e7aaf7ca067f82362b4dc7bf4f1951de1b824c59f6575b1fdf1833c49e13229087a519

Download Submit
C:\Users\Admin\AppData\Local\Temp\JJ2zQTaq6h.bat

Filesize
216B

MD5
0e93ee6274aec02ead7ca678040dbb22

SHA1
ca229f4ffdcedd567a251142927f9999cdca7aa9

SHA256
b8f25f9d68091ef5d8c07b0e8a557977162a4241b4089c8a19e69a6f50ee46e7

SHA512
72a6847dd2a02fc50f6c738576dd2b066dd8d437349137b5e72f1043a53df3b604428980d1e3ffbba02d4766a8ba925ff18aa741ded837e36152e273a00c2a1b

Download Submit
C:\Users\Admin\AppData\Local\Temp\ZHEG9SYztW.bat

Filesize
216B

MD5
d6b7167bbf9a4a0c93a85c9d2917d8ec

SHA1
a8c79b3c875a21a3f3717c2625b54196a7a28de7

SHA256
575cad66f00a86edc938a342d26295774ad127781cba6107323cbf0558922dc6

SHA512
1a6cdbf66bda07f86c3342e3f9dce3fec500a83a22bcb2a9aa65303cf556e71ca79a6a56f6cac4d5a4da83deb4136e32d39d3d8a32c42f45ac0f70121aca849e

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ngu3p0is.l1a.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\jBrSCX6wbi.bat

Filesize
216B

MD5
885e277bb623a2147d7f3c6c5006c775

SHA1
59dcb6753e2078dfe194681a56e9aedb3e1f675f

SHA256
cd3972ed6435743a977b99220ae2d2ba87c5963de0b2ec7588f3b837b1585528

SHA512
ff3083746c920c9917cb306153803de3a2028588dd27c1434085ecdfebeaf4a78e2c1a0df53252cc2069e50dec795f0f92a14f6cb80c14697892d497a0b1c748

Download Submit
C:\Users\Admin\AppData\Local\Temp\qqpXlQnQd1.bat

Filesize
216B

MD5
4e6278aba02097648a8f881d2e424ece

SHA1
df4f0967ba2918f9049a24cd2c815e0a8e3466e1

SHA256
7f1d467b865e64c48d3735268721bae7c79fb0e605feca6e7dcf71cbd784bf4e

SHA512
5e3cf7b13910728759d22a6c0d38082f94d6d1616edb8338dbab977d6ae8e03c4a79eb69b2559eb6905f306982e5a5d88207b52512931e61e880518701050849

Download Submit
C:\Users\Admin\AppData\Local\Temp\wtOcRLEbie.bat

Filesize
216B

MD5
9a2df43dc8c5b5a654e04b292fbe2dc0

SHA1
67896299d8ab2a77476c0deffb50561c1442399f

SHA256
d1d8d9f45b5d19789d171b30c9c5b6ea737c101d5e551ace810c07b712d21c1c

SHA512
41abfb4d2241b75451e411b4d91e984bad030724c7f148f1c71a32d0e72fe1a91c0d04d6e6adb5350eb825b4aac01ca9daf7efae29ac2e2f26745d35ff6afb65

Download Submit
C:\Users\Admin\AppData\Local\Temp\zujFmWWXSS.bat

Filesize
216B

MD5
0a8f58873da0a5a597f5838485da56e5

SHA1
72b4e36b03bf58d7892d12ce83352f8404dcef39

SHA256
7afd07f18b450cf50ae08f52b740b5154668682d1b5f3be2f4818c4e95b6f68b

SHA512
cfcf553b5a35c1f38a5debb7f392e5d4039de77baca335a318bb3e12acce993fea9fc4fde7db648f071173f5f930a5c4005068110966988971adc3f35f557c42

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/1684-211-0x0000000000F70000-0x0000000000F82000-memory.dmp

Filesize
72KB

Download
memory/1704-51-0x00000191A5040000-0x00000191A5062000-memory.dmp

Filesize
136KB

Download
memory/1852-17-0x0000000002680000-0x000000000268C000-memory.dmp

Filesize
48KB

Download
memory/1852-16-0x0000000002670000-0x000000000267C000-memory.dmp

Filesize
48KB

Download
memory/1852-15-0x0000000002660000-0x000000000266C000-memory.dmp

Filesize
48KB

Download
memory/1852-14-0x0000000002650000-0x0000000002662000-memory.dmp

Filesize
72KB

Download
memory/1852-13-0x0000000000340000-0x0000000000450000-memory.dmp

Filesize
1.1MB

Download
memory/1852-12-0x00007FFE0C5E3000-0x00007FFE0C5E5000-memory.dmp

Filesize
8KB

Download
memory/2776-224-0x0000000000EE0000-0x0000000000EF2000-memory.dmp

Filesize
72KB

Download
memory/3572-244-0x00000000027E0000-0x00000000027F2000-memory.dmp

Filesize
72KB

Download
memory/3920-251-0x0000000002360000-0x0000000002372000-memory.dmp

Filesize
72KB

Download
memory/4312-237-0x0000000002440000-0x0000000002452000-memory.dmp

Filesize
72KB

Download
memory/5016-196-0x0000000001A00000-0x0000000001A12000-memory.dmp

Filesize
72KB

Download