Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22/12/2024, 18:43
Behavioral task
behavioral1
Sample
JaffaCakes118_6a2253ac9c22fa4e3c1408f86814e49eaf05115398c7d3ca8a5e5f0a96a0bb6b.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_6a2253ac9c22fa4e3c1408f86814e49eaf05115398c7d3ca8a5e5f0a96a0bb6b.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_6a2253ac9c22fa4e3c1408f86814e49eaf05115398c7d3ca8a5e5f0a96a0bb6b.exe
-
Size
1.3MB
-
MD5
1dd05197d833b7a1ed48f6346c08312d
-
SHA1
deca10ce5d8849d9b5f37aef5d6a36571497605b
-
SHA256
6a2253ac9c22fa4e3c1408f86814e49eaf05115398c7d3ca8a5e5f0a96a0bb6b
-
SHA512
cc20be7ab836dc9868282a7e0f40e73d304e6b20e0025d27fae5ea49044f5f1eb58cebecccc7e68d85d849cd696ae04ede89cde51f188d159cf14f5e7ad89134
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Process spawned unexpected child process 54 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2700 2236 schtasks.exe 32 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2736 2236 schtasks.exe 32 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2644 2236 schtasks.exe 32 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2832 2236 schtasks.exe 32 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2652 2236 schtasks.exe 32 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2580 2236 schtasks.exe 32 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2456 2236 schtasks.exe 32 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2432 2236 schtasks.exe 32 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2496 2236 schtasks.exe 32 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2564 2236 schtasks.exe 32 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2912 2236 schtasks.exe 32 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2920 2236 schtasks.exe 32 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1824 2236 schtasks.exe 32 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1036 2236 schtasks.exe 32 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1800 2236 schtasks.exe 32 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2272 2236 schtasks.exe 32 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2292 2236 schtasks.exe 32 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2296 2236 schtasks.exe 32 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1792 2236 schtasks.exe 32 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 796 2236 schtasks.exe 32 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 808 2236 schtasks.exe 32 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2284 2236 schtasks.exe 32 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 624 2236 schtasks.exe 32 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1416 2236 schtasks.exe 32 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1536 2236 schtasks.exe 32 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1636 2236 schtasks.exe 32 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2732 2236 schtasks.exe 32 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2940 2236 schtasks.exe 32 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2336 2236 schtasks.exe 32 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2156 2236 schtasks.exe 32 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1640 2236 schtasks.exe 32 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1868 2236 schtasks.exe 32 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2372 2236 schtasks.exe 32 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 804 2236 schtasks.exe 32 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 764 2236 schtasks.exe 32 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 304 2236 schtasks.exe 32 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3064 2236 schtasks.exe 32 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1788 2236 schtasks.exe 32 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 532 2236 schtasks.exe 32 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1076 2236 schtasks.exe 32 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3060 2236 schtasks.exe 32 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 836 2236 schtasks.exe 32 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 564 2236 schtasks.exe 32 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2404 2236 schtasks.exe 32 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3032 2236 schtasks.exe 32 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1752 2236 schtasks.exe 32 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2344 2236 schtasks.exe 32 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 684 2236 schtasks.exe 32 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1504 2236 schtasks.exe 32 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2204 2236 schtasks.exe 32 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1940 2236 schtasks.exe 32 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1032 2236 schtasks.exe 32 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1720 2236 schtasks.exe 32 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1288 2236 schtasks.exe 32 -
resource yara_rule behavioral1/files/0x0008000000015d2e-12.dat dcrat behavioral1/memory/2944-13-0x0000000000160000-0x0000000000270000-memory.dmp dcrat behavioral1/memory/2464-151-0x0000000000900000-0x0000000000A10000-memory.dmp dcrat behavioral1/memory/2176-211-0x0000000000E60000-0x0000000000F70000-memory.dmp dcrat behavioral1/memory/2284-330-0x0000000001020000-0x0000000001130000-memory.dmp dcrat behavioral1/memory/300-567-0x00000000012E0000-0x00000000013F0000-memory.dmp dcrat -
Command and Scripting Interpreter: PowerShell 1 TTPs 19 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 1832 powershell.exe 2828 powershell.exe 2916 powershell.exe 2500 powershell.exe 2932 powershell.exe 2740 powershell.exe 2424 powershell.exe 2140 powershell.exe 2928 powershell.exe 1228 powershell.exe 2900 powershell.exe 2704 powershell.exe 2616 powershell.exe 2124 powershell.exe 2872 powershell.exe 1324 powershell.exe 2584 powershell.exe 2784 powershell.exe 1700 powershell.exe -
Executes dropped EXE 11 IoCs
pid Process 2944 DllCommonsvc.exe 2464 Idle.exe 2176 Idle.exe 2704 Idle.exe 2284 Idle.exe 2648 Idle.exe 1128 Idle.exe 3008 Idle.exe 300 Idle.exe 2792 Idle.exe 2424 Idle.exe -
Loads dropped DLL 2 IoCs
pid Process 2936 cmd.exe 2936 cmd.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 11 IoCs
flow ioc 4 raw.githubusercontent.com 12 raw.githubusercontent.com 23 raw.githubusercontent.com 26 raw.githubusercontent.com 33 raw.githubusercontent.com 5 raw.githubusercontent.com 9 raw.githubusercontent.com 16 raw.githubusercontent.com 19 raw.githubusercontent.com 30 raw.githubusercontent.com 36 raw.githubusercontent.com -
Drops file in Program Files directory 11 IoCs
description ioc Process File created C:\Program Files (x86)\Google\CrashReports\088424020bedd6 DllCommonsvc.exe File created C:\Program Files\Windows Photo Viewer\it-IT\explorer.exe DllCommonsvc.exe File opened for modification C:\Program Files\Windows Photo Viewer\it-IT\explorer.exe DllCommonsvc.exe File created C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\resources\Idle.exe DllCommonsvc.exe File created C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\resources\6ccacd8608530f DllCommonsvc.exe File created C:\Program Files\Windows NT\TableTextService\fr-FR\lsass.exe DllCommonsvc.exe File created C:\Program Files\Windows NT\TableTextService\fr-FR\6203df4a6bafc7 DllCommonsvc.exe File created C:\Program Files (x86)\Google\CrashReports\conhost.exe DllCommonsvc.exe File created C:\Program Files (x86)\Internet Explorer\es-ES\csrss.exe DllCommonsvc.exe File created C:\Program Files (x86)\Internet Explorer\es-ES\886983d96e3d3e DllCommonsvc.exe File created C:\Program Files\Windows Photo Viewer\it-IT\7a0fd90576e088 DllCommonsvc.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\Panther\UnattendGC\6cb0b6c459d5d3 DllCommonsvc.exe File created C:\Windows\Help\mui\0407\spoolsv.exe DllCommonsvc.exe File created C:\Windows\Help\mui\0407\f3b6ecef712a24 DllCommonsvc.exe File created C:\Windows\Panther\UnattendGC\dwm.exe DllCommonsvc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_6a2253ac9c22fa4e3c1408f86814e49eaf05115398c7d3ca8a5e5f0a96a0bb6b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 54 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3064 schtasks.exe 532 schtasks.exe 2644 schtasks.exe 1800 schtasks.exe 1636 schtasks.exe 1752 schtasks.exe 2204 schtasks.exe 2832 schtasks.exe 2580 schtasks.exe 796 schtasks.exe 1416 schtasks.exe 684 schtasks.exe 1720 schtasks.exe 836 schtasks.exe 564 schtasks.exe 2564 schtasks.exe 2920 schtasks.exe 808 schtasks.exe 2404 schtasks.exe 2496 schtasks.exe 2336 schtasks.exe 1076 schtasks.exe 3032 schtasks.exe 2736 schtasks.exe 1824 schtasks.exe 2296 schtasks.exe 2284 schtasks.exe 624 schtasks.exe 2432 schtasks.exe 1036 schtasks.exe 764 schtasks.exe 2940 schtasks.exe 2344 schtasks.exe 1792 schtasks.exe 2272 schtasks.exe 2292 schtasks.exe 2732 schtasks.exe 1640 schtasks.exe 304 schtasks.exe 1788 schtasks.exe 1288 schtasks.exe 3060 schtasks.exe 2652 schtasks.exe 2912 schtasks.exe 804 schtasks.exe 1504 schtasks.exe 1536 schtasks.exe 2156 schtasks.exe 2372 schtasks.exe 1868 schtasks.exe 2700 schtasks.exe 2456 schtasks.exe 1940 schtasks.exe 1032 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 30 IoCs
pid Process 2944 DllCommonsvc.exe 2124 powershell.exe 1832 powershell.exe 2584 powershell.exe 2784 powershell.exe 2932 powershell.exe 2828 powershell.exe 2872 powershell.exe 1228 powershell.exe 2740 powershell.exe 2704 powershell.exe 1324 powershell.exe 2140 powershell.exe 2916 powershell.exe 2500 powershell.exe 2900 powershell.exe 2928 powershell.exe 2424 powershell.exe 1700 powershell.exe 2616 powershell.exe 2464 Idle.exe 2176 Idle.exe 2704 Idle.exe 2284 Idle.exe 2648 Idle.exe 1128 Idle.exe 3008 Idle.exe 300 Idle.exe 2792 Idle.exe 2424 Idle.exe -
Suspicious use of AdjustPrivilegeToken 30 IoCs
description pid Process Token: SeDebugPrivilege 2944 DllCommonsvc.exe Token: SeDebugPrivilege 2124 powershell.exe Token: SeDebugPrivilege 1832 powershell.exe Token: SeDebugPrivilege 2584 powershell.exe Token: SeDebugPrivilege 2784 powershell.exe Token: SeDebugPrivilege 2932 powershell.exe Token: SeDebugPrivilege 2828 powershell.exe Token: SeDebugPrivilege 2872 powershell.exe Token: SeDebugPrivilege 1228 powershell.exe Token: SeDebugPrivilege 2740 powershell.exe Token: SeDebugPrivilege 2704 powershell.exe Token: SeDebugPrivilege 1324 powershell.exe Token: SeDebugPrivilege 2140 powershell.exe Token: SeDebugPrivilege 2916 powershell.exe Token: SeDebugPrivilege 2500 powershell.exe Token: SeDebugPrivilege 2900 powershell.exe Token: SeDebugPrivilege 2928 powershell.exe Token: SeDebugPrivilege 2424 powershell.exe Token: SeDebugPrivilege 1700 powershell.exe Token: SeDebugPrivilege 2616 powershell.exe Token: SeDebugPrivilege 2464 Idle.exe Token: SeDebugPrivilege 2176 Idle.exe Token: SeDebugPrivilege 2704 Idle.exe Token: SeDebugPrivilege 2284 Idle.exe Token: SeDebugPrivilege 2648 Idle.exe Token: SeDebugPrivilege 1128 Idle.exe Token: SeDebugPrivilege 3008 Idle.exe Token: SeDebugPrivilege 300 Idle.exe Token: SeDebugPrivilege 2792 Idle.exe Token: SeDebugPrivilege 2424 Idle.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2872 wrote to memory of 1228 2872 JaffaCakes118_6a2253ac9c22fa4e3c1408f86814e49eaf05115398c7d3ca8a5e5f0a96a0bb6b.exe 28 PID 2872 wrote to memory of 1228 2872 JaffaCakes118_6a2253ac9c22fa4e3c1408f86814e49eaf05115398c7d3ca8a5e5f0a96a0bb6b.exe 28 PID 2872 wrote to memory of 1228 2872 JaffaCakes118_6a2253ac9c22fa4e3c1408f86814e49eaf05115398c7d3ca8a5e5f0a96a0bb6b.exe 28 PID 2872 wrote to memory of 1228 2872 JaffaCakes118_6a2253ac9c22fa4e3c1408f86814e49eaf05115398c7d3ca8a5e5f0a96a0bb6b.exe 28 PID 1228 wrote to memory of 2936 1228 WScript.exe 29 PID 1228 wrote to memory of 2936 1228 WScript.exe 29 PID 1228 wrote to memory of 2936 1228 WScript.exe 29 PID 1228 wrote to memory of 2936 1228 WScript.exe 29 PID 2936 wrote to memory of 2944 2936 cmd.exe 31 PID 2936 wrote to memory of 2944 2936 cmd.exe 31 PID 2936 wrote to memory of 2944 2936 cmd.exe 31 PID 2936 wrote to memory of 2944 2936 cmd.exe 31 PID 2944 wrote to memory of 1324 2944 DllCommonsvc.exe 87 PID 2944 wrote to memory of 1324 2944 DllCommonsvc.exe 87 PID 2944 wrote to memory of 1324 2944 DllCommonsvc.exe 87 PID 2944 wrote to memory of 2872 2944 DllCommonsvc.exe 88 PID 2944 wrote to memory of 2872 2944 DllCommonsvc.exe 88 PID 2944 wrote to memory of 2872 2944 DllCommonsvc.exe 88 PID 2944 wrote to memory of 2828 2944 DllCommonsvc.exe 89 PID 2944 wrote to memory of 2828 2944 DllCommonsvc.exe 89 PID 2944 wrote to memory of 2828 2944 DllCommonsvc.exe 89 PID 2944 wrote to memory of 1832 2944 DllCommonsvc.exe 90 PID 2944 wrote to memory of 1832 2944 DllCommonsvc.exe 90 PID 2944 wrote to memory of 1832 2944 DllCommonsvc.exe 90 PID 2944 wrote to memory of 2932 2944 DllCommonsvc.exe 91 PID 2944 wrote to memory of 2932 2944 DllCommonsvc.exe 91 PID 2944 wrote to memory of 2932 2944 DllCommonsvc.exe 91 PID 2944 wrote to memory of 1700 2944 DllCommonsvc.exe 92 PID 2944 wrote to memory of 1700 2944 DllCommonsvc.exe 92 PID 2944 wrote to memory of 1700 2944 DllCommonsvc.exe 92 PID 2944 wrote to memory of 2900 2944 DllCommonsvc.exe 93 PID 2944 wrote to memory of 2900 2944 DllCommonsvc.exe 93 PID 2944 wrote to memory of 2900 2944 DllCommonsvc.exe 93 PID 2944 wrote to memory of 1228 2944 DllCommonsvc.exe 94 PID 2944 wrote to memory of 1228 2944 DllCommonsvc.exe 94 PID 2944 wrote to memory of 1228 2944 DllCommonsvc.exe 94 PID 2944 wrote to memory of 2928 2944 DllCommonsvc.exe 95 PID 2944 wrote to memory of 2928 2944 DllCommonsvc.exe 95 PID 2944 wrote to memory of 2928 2944 DllCommonsvc.exe 95 PID 2944 wrote to memory of 2140 2944 DllCommonsvc.exe 96 PID 2944 wrote to memory of 2140 2944 DllCommonsvc.exe 96 PID 2944 wrote to memory of 2140 2944 DllCommonsvc.exe 96 PID 2944 wrote to memory of 2124 2944 DllCommonsvc.exe 97 PID 2944 wrote to memory of 2124 2944 DllCommonsvc.exe 97 PID 2944 wrote to memory of 2124 2944 DllCommonsvc.exe 97 PID 2944 wrote to memory of 2424 2944 DllCommonsvc.exe 98 PID 2944 wrote to memory of 2424 2944 DllCommonsvc.exe 98 PID 2944 wrote to memory of 2424 2944 DllCommonsvc.exe 98 PID 2944 wrote to memory of 2916 2944 DllCommonsvc.exe 99 PID 2944 wrote to memory of 2916 2944 DllCommonsvc.exe 99 PID 2944 wrote to memory of 2916 2944 DllCommonsvc.exe 99 PID 2944 wrote to memory of 2784 2944 DllCommonsvc.exe 100 PID 2944 wrote to memory of 2784 2944 DllCommonsvc.exe 100 PID 2944 wrote to memory of 2784 2944 DllCommonsvc.exe 100 PID 2944 wrote to memory of 2584 2944 DllCommonsvc.exe 101 PID 2944 wrote to memory of 2584 2944 DllCommonsvc.exe 101 PID 2944 wrote to memory of 2584 2944 DllCommonsvc.exe 101 PID 2944 wrote to memory of 2704 2944 DllCommonsvc.exe 102 PID 2944 wrote to memory of 2704 2944 DllCommonsvc.exe 102 PID 2944 wrote to memory of 2704 2944 DllCommonsvc.exe 102 PID 2944 wrote to memory of 2740 2944 DllCommonsvc.exe 103 PID 2944 wrote to memory of 2740 2944 DllCommonsvc.exe 103 PID 2944 wrote to memory of 2740 2944 DllCommonsvc.exe 103 PID 2944 wrote to memory of 2616 2944 DllCommonsvc.exe 104 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6a2253ac9c22fa4e3c1408f86814e49eaf05115398c7d3ca8a5e5f0a96a0bb6b.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6a2253ac9c22fa4e3c1408f86814e49eaf05115398c7d3ca8a5e5f0a96a0bb6b.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\providercommon\1zu9dW.bat" "3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\providercommon\DllCommonsvc.exe"C:\providercommon\DllCommonsvc.exe"4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1324
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Photo Viewer\it-IT\explorer.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2872
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Help\mui\0407\spoolsv.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2828
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\resources\Idle.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1832
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows NT\TableTextService\fr-FR\lsass.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2932
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Recorded TV\Sample Media\wininit.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1700
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Panther\UnattendGC\dwm.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2900
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\lsass.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1228
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Google\CrashReports\conhost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2928
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\sppsvc.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2140
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\dwm.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2124
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\lsass.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2424
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Adobe\Acrobat\9.0\Replicate\Security\wininit.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2916
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Application Data\services.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2784
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Internet Explorer\es-ES\csrss.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2584
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\explorer.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2704
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\explorer.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2740
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\services.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2616
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\taskhost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2500
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\xaOsFiDaJy.bat"5⤵PID:2488
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:26⤵PID:680
-
-
C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\resources\Idle.exe"C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\resources\Idle.exe"6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2464 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\0LMDaVm4bI.bat"7⤵PID:1896
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:28⤵PID:1540
-
-
C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\resources\Idle.exe"C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\resources\Idle.exe"8⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2176 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Rhkc0SdEF2.bat"9⤵PID:2724
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:210⤵PID:2288
-
-
C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\resources\Idle.exe"C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\resources\Idle.exe"10⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2704 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\KwQfKFARzT.bat"11⤵PID:2204
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:212⤵PID:2128
-
-
C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\resources\Idle.exe"C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\resources\Idle.exe"12⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2284 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\tpXWVAFTZv.bat"13⤵PID:2756
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:214⤵PID:2604
-
-
C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\resources\Idle.exe"C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\resources\Idle.exe"14⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2648 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\4WSxKcEorb.bat"15⤵PID:3048
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:216⤵PID:2384
-
-
C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\resources\Idle.exe"C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\resources\Idle.exe"16⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1128 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\wKGJ2NUoAL.bat"17⤵PID:372
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:218⤵PID:2816
-
-
C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\resources\Idle.exe"C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\resources\Idle.exe"18⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3008 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\rgoiaSdxpd.bat"19⤵PID:1892
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:220⤵PID:680
-
-
C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\resources\Idle.exe"C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\resources\Idle.exe"20⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:300 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Bp0TjAk7l7.bat"21⤵PID:2836
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:222⤵PID:1952
-
-
C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\resources\Idle.exe"C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\resources\Idle.exe"22⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2792 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\jkzlbVqk90.bat"23⤵PID:748
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:224⤵PID:1092
-
-
C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\resources\Idle.exe"C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\resources\Idle.exe"24⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2424 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\axBdnWD1Gl.bat"25⤵PID:1584
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:226⤵PID:2628
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Photo Viewer\it-IT\explorer.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2700
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\it-IT\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2736
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Photo Viewer\it-IT\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2644
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 14 /tr "'C:\Windows\Help\mui\0407\spoolsv.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2832
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\Help\mui\0407\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2652
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 12 /tr "'C:\Windows\Help\mui\0407\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2580
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\resources\Idle.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2456
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\resources\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2432
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\resources\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2496
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows NT\TableTextService\fr-FR\lsass.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2564
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files\Windows NT\TableTextService\fr-FR\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2912
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows NT\TableTextService\fr-FR\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2920
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 6 /tr "'C:\Users\Public\Recorded TV\Sample Media\wininit.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1824
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Users\Public\Recorded TV\Sample Media\wininit.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1036
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\Users\Public\Recorded TV\Sample Media\wininit.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1800
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 7 /tr "'C:\Windows\Panther\UnattendGC\dwm.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2272
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\Panther\UnattendGC\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2292
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\Windows\Panther\UnattendGC\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2296
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\lsass.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1792
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:796
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:808
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Google\CrashReports\conhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2284
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\CrashReports\conhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:624
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Google\CrashReports\conhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1416
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 13 /tr "'C:\providercommon\sppsvc.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1536
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\providercommon\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1636
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 7 /tr "'C:\providercommon\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2732
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 10 /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\dwm.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2940
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2336
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2156
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\lsass.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1640
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1868
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2372
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\Adobe\Acrobat\9.0\Replicate\Security\wininit.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:804
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Users\All Users\Adobe\Acrobat\9.0\Replicate\Security\wininit.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:764
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\Adobe\Acrobat\9.0\Replicate\Security\wininit.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:304
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\Application Data\services.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3064
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Users\All Users\Application Data\services.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1788
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\Application Data\services.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:532
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Internet Explorer\es-ES\csrss.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1076
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\es-ES\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3060
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Internet Explorer\es-ES\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:836
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\explorer.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:564
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2404
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3032
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 9 /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\explorer.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1752
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2344
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:684
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 13 /tr "'C:\providercommon\services.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1504
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\providercommon\services.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2204
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 6 /tr "'C:\providercommon\services.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1940
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 12 /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\taskhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1032
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\taskhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1720
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 14 /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\taskhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1288
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53a0bb6897ea856d0c79e179126cf34d9
SHA1957d87f77b3fa682dee842440398b215a8881893
SHA2566989ccd3679628e66968bdc48e51e3ccb5ef319026863452664aeb39ea9f0573
SHA5120ba2a6d52e2b11dd1d7fb57b196cee05deb068c1ed1a84f6b4a538d7c8b5b4e1fb60dee5a1bdcfde3746783cb20854e915ee982c0183d213b258fe08f3dc3342
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c1b51c2964bd0185a7ab700b7b844e9b
SHA1f35fbb9541aa18351ffac85996c565958cdc2142
SHA25668c46fb0f9ee276b7eb71ddee32db77f8c93b59a597e09b8d21b8dbca16aa1a8
SHA512a8a9c4b69e9195f5044e9cc11bb4cdb42bd004a7e0c94353f8043dc59890f97b4f030c0d3bcd6d9dae1707544acbaabe621005e5f16d00b8b48ff0966e675d94
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d1d70e6ac892f247b0ef55a77908af44
SHA1b570cab441dfd308aedd86126677b2a88bec70c3
SHA256019159220b67cf3c1fa366e048b97b7fc7568232a1b66747911bb8a499887d1d
SHA5121a22a59b89a3adb91a2ce2c29d88e84600493a5d12cd153e0076506c432d407208ee6bc01a0e31672268b3003fac5edef14cc1b222953eebb737584ad2cf3218
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e517c0633e332b9379f846b1646a285a
SHA1261fb24b8548739d917497aaf5a6afc00bd36894
SHA256d449a11795ba1ec5c2bb132b67d9eac6ae35a04abd3b9e30b3c421962f94e190
SHA51232c1b90e031588d6332a05c4e6018b07c658dad7c3113896ead5cdca9d5bd630c5866f91ce91a9fb9005720050867bdcb9cb64501924674d45d3853427dada7f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD584638630d2c265f1d70227523f6be358
SHA194e61fe3723dc3f2d03790434851986ef3278a48
SHA25685155b398703e023d6bf93c694f2ee0029352bacf8a1181d6bcfb54e5f51e6e9
SHA512f4ecf182974a8178511da5c1e50d97c31e4ec43e1443092c44209041e7f04aab89c64825ed094d9cfeda8106b4658fc7d0fec2c5e084a22c4cc78608ee791613
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54fb8c2e5b3d935ca90e44ed97cf85a59
SHA1f1470893412d80219fcb4164f87f04243e971b8c
SHA256eb18d9a234f80c9ceba834130975f31cc649ebc651e35730084fbdf805f86933
SHA512e06aa356da7cf384d9fe1a6754bad7768cb2e54ee470c4a2c21f1bdfdde29e3f8c1dee639d86347326090b14e1741e2063d952bd0d554091e59847b55d6579dd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD527d1059a1c9251ccb3860bb8ac884ae7
SHA193903acb57edc7731472e6687c5c2e51b10c2162
SHA2564b051a4d592f214ef15606eb79d25f4be5e67595c183ddf4599acabc79e6fcff
SHA512cf9193e5fbf9789f9808ef788a56e86f0dd5714e1ced38fa5dd027b0f7dd83a7644f7964a216e86ca09334f9ebf190dd5268433bbbd46a68a695d11d2b4181ac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56e3113b7c34a03ac273a9dcc8680948b
SHA1f9b4f403ac0d99d07392747cf839272a9f7c222b
SHA2564342d1759f55b44f431f872f214a7f1b15367caff8b077b408272114530385ba
SHA512d370799681bd2e9503079f828d44eb340ae9898ec2307c9422b968509b8feda9a14ba3ff663ee138b849e30d20b0216e3d02af9cc370b4d8b56853ae7f115f04
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD530b2f13bdcb61273ba05acf75dda281f
SHA1c5343f9ab9285cabbc73dba49fbe443c3bb7198d
SHA256d0da8726412f4cacc39f9df8b455a26346cbd48425acbefd68a83b3a9ba34aae
SHA512ebe860e4ed957ab040e59b864bc54705a1dbc1948a7994c33a6a42fa12e88b154bad8c3d051c347dc81306f929668ed0a54695598c88d938ebdaabce9a9ac0d6
-
Filesize
248B
MD57009f77322a8b2e25169c521a96de318
SHA16c637ce401c56fc44c03e8f9f896204bed592d1d
SHA2565e219420eb24a5fa40137a0cb3b876ef205d2460cfc3996b3e8719023828f37e
SHA512733ff4f3d0ae891659cee93e4c0d72f6a0a613d19baa0171fbd667f755797d08f15063e851d82fe35a641bf9326abdc292394942f0daa41ab5d955e9632326f4
-
Filesize
248B
MD51348404f6cd6dcdb4590501697c6a51e
SHA1c805279ecc26f8292c897e99b66357f70a203997
SHA25651a675e7be9e303914f5015299d8a7cd5d02f98a3be8f6631aa99c88705b73e6
SHA512b412899c7fc4e65f5882d6f13ee6ffe5df92e00773a7bc22b4f247a82a358375e25e810583df05189fa7123941dcd6235d8c18d470f98e33d75a6e2c651f625f
-
Filesize
248B
MD5d849cf584b89e957ac0c8568d841c9f3
SHA1f408cbfc2d4abef8c44310ff98ee8b4ca9b053a8
SHA256c2247c58680d3d970d411a1ae3f74b6b5a99bf6b62c24f2c4f90252e2598eb3e
SHA5124f9a8b542bf811e0e4b27144b36b45410b7dfcb65851a3b9632189758262572955fea934b4e7912fc9b3fb9d11af5c956544a6e51ee2d1ef7789cd4351fadd74
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
248B
MD56db874d9166e0d515ba0df5fe418bd96
SHA1eec03e744412c5db46c038e9cb6c54c91eb16dea
SHA256195f6504ac3acef4a9a7108e69231f91c4a4d60b5933cadfcefa51ce1ba66744
SHA512a955025718a0c66fdebf079e04982fadf53db26b1dc5ff316180f44af810a63878e6f7983e0d62241a21d32a886bfa4e12716eec44363686565be0a2ce82a42e
-
Filesize
248B
MD5b5f38ab836d148d304f31d294590127c
SHA10e98cd0f860bf1c6d98dae03c65eca1dc9059a47
SHA256d603a8e640761c0f215e253a57273f133f1737a7255f5b88f9dbe1bc82acbfca
SHA512802a8dbd72e7dd5394e176a33a71a6c07857ce4a02aa9d87476045dd45257147f108abc8727ca1f5d01f2c352ce3fe1cc8e9db57fbfbba1140d3deb1adb386d8
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
248B
MD50d79dc29ff84f31d8d0cb4e5b64437f7
SHA19f1536301e6047214e0668d32e71ea013603cc7c
SHA25641cc05434f52e1c9fcac6ce18f19b11177fbe6330f2433450d9695cc9439b64e
SHA512b28da6c5081fcff51360de0182ca90f5ae8900e44ffd303babf27a7587902ce7baf7ce732031658a2fa0d4220f727687366e1d268e9af375ab6257aaa629fb76
-
Filesize
248B
MD5655fd45cf831594327f8a28a46a4fda1
SHA113a41c92d9f77a60ac9801d78067b8a474a34802
SHA256629df46ff10b873a756ae8689aee48e1a3d320309ee267dd68a0216177613732
SHA5129be0765e12d4d99066e53aec8b1dbdac8a65e65d92022c5903b352d1314a04218ec85b122089df67dc93f25a5276cc8b127c1e024eeb8c615580257fc0d9cf40
-
Filesize
248B
MD512fc76e685f4e8ea00b1ca8211413fc1
SHA1fb0e082796fd681fdeb1348b5d07165c3fe8adbf
SHA2567ab1e86aeae01dbc4036ad45cd321c67ba13087771df14471adc9a7d1a91111a
SHA512701c50a2676fca988dc893998684c999467b50ff1bd4a9cc40faabb69adb0b164d76376cfadb8d390b318024c9455b48d35dd045e92c3c25f736767df5f8e4aa
-
Filesize
248B
MD53e1a05238438f63294140deb59e91c90
SHA1d3b95c82528d52e9ea68689dc0b65f3f9b5c5d33
SHA256b6645c70e90e836bc09d9da88e5dac315ecfd76d65470ea6a25e7f4e3270e3cb
SHA512bb1e003c111be962c3b9af631efd64a63f082e9deb1918f5ecec680ce2c1ce4eb5189d1c84713e7a4e373d6c48d5b7f23065e724d7c09a31e3ba55580a6aaf09
-
Filesize
248B
MD50ce3c069dd96419d3cbf48ee80060e3a
SHA16b01e6a18955bab5d6de1217424698808f2dfd6f
SHA25656493aea1b0b29f5e8a186cf6ede30472c6fd4329ae2abe495c7077b7cb5422d
SHA512aba99e2b38183e1a56758f062742db78eda8be4ed1843c8fc96ca76b81bb3685a52c3f7182972b09f6bd83c88e71d890c971ee364e72255dc8ba6e59b0a3b3c5
-
Filesize
248B
MD545f8aa5b2dfbcce24e3f47defdac529e
SHA1c784ed02f045409aa4e172210be75a43171d9981
SHA256ffb3fb6add4c88625624c780115ab56db1c0ebf5c70926aaf31fa82c6156d729
SHA512aee021da42ffd930615e03b33ac2124493db9f0a3d1f18e91a6c8b935e831592f9dace7e4e0ec47acc32c1c70823f032cd0a583b85de7212a4a023d9e6a5856c
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\XW8TM1HNGJ7BDEJ2GELT.temp
Filesize7KB
MD5bd10607f4a014b1f591273f8fc8a4392
SHA13ff60012d06c443769eab585a99527ee800f1006
SHA256281a2c75383ff9894540311430c57c4e0b60b4ebf770c8d844eefc8889f0e7e0
SHA5126f908e03ff6b70bc131bbc3aa13d4748bee8d02f17688302a34b46c1cdc18eeefbf885191c48200ae0af3fe01ae94ef3cc42f3f27eae9c1bca8cf8e41b0bca33
-
Filesize
36B
MD56783c3ee07c7d151ceac57f1f9c8bed7
SHA117468f98f95bf504cc1f83c49e49a78526b3ea03
SHA2568ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322
SHA512c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8
-
Filesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
Filesize
197B
MD58088241160261560a02c84025d107592
SHA1083121f7027557570994c9fc211df61730455bb5
SHA2562072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1
SHA51220d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478