Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22/12/2024, 20:21
Behavioral task
behavioral1
Sample
JaffaCakes118_7f5f448f1a1a2958042f1843925068b868543db861a40caa8908e3028bdc1309.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_7f5f448f1a1a2958042f1843925068b868543db861a40caa8908e3028bdc1309.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_7f5f448f1a1a2958042f1843925068b868543db861a40caa8908e3028bdc1309.exe
-
Size
1.3MB
-
MD5
00552dc7bfd0e11cf60c578d6a076ae7
-
SHA1
73a0bc188e37300b16b2e3f538ae81b7410c46da
-
SHA256
7f5f448f1a1a2958042f1843925068b868543db861a40caa8908e3028bdc1309
-
SHA512
550cd06a28e38f9d993866435b4fa38338933f6989c05ef4f6846cf0d94f89374f37a4d935c26bfe203d8837bcf8722c6be5ff7fb91a4761408cd3665f0db654
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Process spawned unexpected child process 48 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3036 2688 schtasks.exe 32 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2636 2688 schtasks.exe 32 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2728 2688 schtasks.exe 32 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2716 2688 schtasks.exe 32 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2764 2688 schtasks.exe 32 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3044 2688 schtasks.exe 32 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1656 2688 schtasks.exe 32 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2828 2688 schtasks.exe 32 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2660 2688 schtasks.exe 32 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2492 2688 schtasks.exe 32 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2540 2688 schtasks.exe 32 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2976 2688 schtasks.exe 32 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1332 2688 schtasks.exe 32 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1144 2688 schtasks.exe 32 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 648 2688 schtasks.exe 32 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2316 2688 schtasks.exe 32 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 772 2688 schtasks.exe 32 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1436 2688 schtasks.exe 32 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 876 2688 schtasks.exe 32 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1364 2688 schtasks.exe 32 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1816 2688 schtasks.exe 32 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1704 2688 schtasks.exe 32 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1736 2688 schtasks.exe 32 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1968 2688 schtasks.exe 32 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1960 2688 schtasks.exe 32 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1772 2688 schtasks.exe 32 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2484 2688 schtasks.exe 32 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1292 2688 schtasks.exe 32 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1764 2688 schtasks.exe 32 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2592 2688 schtasks.exe 32 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1740 2688 schtasks.exe 32 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2816 2688 schtasks.exe 32 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2368 2688 schtasks.exe 32 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 408 2688 schtasks.exe 32 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1692 2688 schtasks.exe 32 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 788 2688 schtasks.exe 32 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2264 2688 schtasks.exe 32 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1620 2688 schtasks.exe 32 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2744 2688 schtasks.exe 32 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1544 2688 schtasks.exe 32 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1676 2688 schtasks.exe 32 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1052 2688 schtasks.exe 32 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1156 2688 schtasks.exe 32 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 792 2688 schtasks.exe 32 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1256 2688 schtasks.exe 32 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2328 2688 schtasks.exe 32 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2384 2688 schtasks.exe 32 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1648 2688 schtasks.exe 32 -
resource yara_rule behavioral1/files/0x0008000000016c73-9.dat dcrat behavioral1/memory/2952-13-0x0000000000090000-0x00000000001A0000-memory.dmp dcrat behavioral1/memory/2904-56-0x00000000009D0000-0x0000000000AE0000-memory.dmp dcrat behavioral1/memory/2668-250-0x0000000000CD0000-0x0000000000DE0000-memory.dmp dcrat behavioral1/memory/1780-310-0x0000000000200000-0x0000000000310000-memory.dmp dcrat behavioral1/memory/2592-370-0x00000000012A0000-0x00000000013B0000-memory.dmp dcrat behavioral1/memory/2232-430-0x0000000000170000-0x0000000000280000-memory.dmp dcrat behavioral1/memory/1332-490-0x0000000000B00000-0x0000000000C10000-memory.dmp dcrat behavioral1/memory/1688-550-0x0000000000F00000-0x0000000001010000-memory.dmp dcrat behavioral1/memory/1808-728-0x0000000000380000-0x0000000000490000-memory.dmp dcrat -
Command and Scripting Interpreter: PowerShell 1 TTPs 17 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 568 powershell.exe 2128 powershell.exe 2416 powershell.exe 2124 powershell.exe 3068 powershell.exe 388 powershell.exe 2164 powershell.exe 900 powershell.exe 3024 powershell.exe 2088 powershell.exe 2116 powershell.exe 2120 powershell.exe 2908 powershell.exe 1608 powershell.exe 2204 powershell.exe 1512 powershell.exe 1640 powershell.exe -
Executes dropped EXE 12 IoCs
pid Process 2952 DllCommonsvc.exe 2904 wininit.exe 2504 wininit.exe 2668 wininit.exe 1780 wininit.exe 2592 wininit.exe 2232 wininit.exe 1332 wininit.exe 1688 wininit.exe 2612 wininit.exe 2552 wininit.exe 1808 wininit.exe -
Loads dropped DLL 2 IoCs
pid Process 2932 cmd.exe 2932 cmd.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 13 IoCs
flow ioc 5 raw.githubusercontent.com 16 raw.githubusercontent.com 19 raw.githubusercontent.com 23 raw.githubusercontent.com 27 raw.githubusercontent.com 31 raw.githubusercontent.com 40 raw.githubusercontent.com 4 raw.githubusercontent.com 9 raw.githubusercontent.com 12 raw.githubusercontent.com 24 raw.githubusercontent.com 33 raw.githubusercontent.com 37 raw.githubusercontent.com -
Drops file in Program Files directory 4 IoCs
description ioc Process File created C:\Program Files\Common Files\SpeechEngines\Microsoft\services.exe DllCommonsvc.exe File created C:\Program Files\Common Files\SpeechEngines\Microsoft\c5b4cb5e9653cc DllCommonsvc.exe File created C:\Program Files\Windows Portable Devices\audiodg.exe DllCommonsvc.exe File created C:\Program Files\Windows Portable Devices\42af1c969fbb7b DllCommonsvc.exe -
Drops file in Windows directory 7 IoCs
description ioc Process File created C:\Windows\diagnostics\scheduled\lsass.exe DllCommonsvc.exe File created C:\Windows\IME\imekr8\help\taskhost.exe DllCommonsvc.exe File created C:\Windows\IME\imekr8\help\b75386f1303e64 DllCommonsvc.exe File created C:\Windows\SoftwareDistribution\ScanFile\services.exe DllCommonsvc.exe File opened for modification C:\Windows\SoftwareDistribution\ScanFile\services.exe DllCommonsvc.exe File created C:\Windows\SoftwareDistribution\ScanFile\c5b4cb5e9653cc DllCommonsvc.exe File created C:\Windows\Speech\Common\ja-JP\taskhost.exe DllCommonsvc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_7f5f448f1a1a2958042f1843925068b868543db861a40caa8908e3028bdc1309.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 48 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3044 schtasks.exe 2828 schtasks.exe 2540 schtasks.exe 1292 schtasks.exe 1156 schtasks.exe 2384 schtasks.exe 2764 schtasks.exe 772 schtasks.exe 876 schtasks.exe 1704 schtasks.exe 2592 schtasks.exe 2816 schtasks.exe 1692 schtasks.exe 788 schtasks.exe 1656 schtasks.exe 1816 schtasks.exe 1620 schtasks.exe 1648 schtasks.exe 1144 schtasks.exe 2328 schtasks.exe 2744 schtasks.exe 1736 schtasks.exe 1764 schtasks.exe 1676 schtasks.exe 1436 schtasks.exe 2728 schtasks.exe 2716 schtasks.exe 2660 schtasks.exe 1332 schtasks.exe 1364 schtasks.exe 1968 schtasks.exe 1740 schtasks.exe 2636 schtasks.exe 2264 schtasks.exe 1052 schtasks.exe 792 schtasks.exe 2368 schtasks.exe 2976 schtasks.exe 1960 schtasks.exe 2484 schtasks.exe 1544 schtasks.exe 3036 schtasks.exe 648 schtasks.exe 2316 schtasks.exe 1772 schtasks.exe 408 schtasks.exe 1256 schtasks.exe 2492 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 32 IoCs
pid Process 2952 DllCommonsvc.exe 2952 DllCommonsvc.exe 2952 DllCommonsvc.exe 2952 DllCommonsvc.exe 2952 DllCommonsvc.exe 1512 powershell.exe 1640 powershell.exe 568 powershell.exe 2904 wininit.exe 3024 powershell.exe 1608 powershell.exe 2088 powershell.exe 3068 powershell.exe 2128 powershell.exe 2164 powershell.exe 900 powershell.exe 2908 powershell.exe 388 powershell.exe 2116 powershell.exe 2120 powershell.exe 2124 powershell.exe 2416 powershell.exe 2504 wininit.exe 2668 wininit.exe 1780 wininit.exe 2592 wininit.exe 2232 wininit.exe 1332 wininit.exe 1688 wininit.exe 2612 wininit.exe 2552 wininit.exe 1808 wininit.exe -
Suspicious use of AdjustPrivilegeToken 28 IoCs
description pid Process Token: SeDebugPrivilege 2952 DllCommonsvc.exe Token: SeDebugPrivilege 1512 powershell.exe Token: SeDebugPrivilege 1640 powershell.exe Token: SeDebugPrivilege 568 powershell.exe Token: SeDebugPrivilege 2904 wininit.exe Token: SeDebugPrivilege 3024 powershell.exe Token: SeDebugPrivilege 1608 powershell.exe Token: SeDebugPrivilege 2088 powershell.exe Token: SeDebugPrivilege 3068 powershell.exe Token: SeDebugPrivilege 2128 powershell.exe Token: SeDebugPrivilege 2164 powershell.exe Token: SeDebugPrivilege 900 powershell.exe Token: SeDebugPrivilege 2908 powershell.exe Token: SeDebugPrivilege 388 powershell.exe Token: SeDebugPrivilege 2116 powershell.exe Token: SeDebugPrivilege 2120 powershell.exe Token: SeDebugPrivilege 2124 powershell.exe Token: SeDebugPrivilege 2416 powershell.exe Token: SeDebugPrivilege 2504 wininit.exe Token: SeDebugPrivilege 2668 wininit.exe Token: SeDebugPrivilege 1780 wininit.exe Token: SeDebugPrivilege 2592 wininit.exe Token: SeDebugPrivilege 2232 wininit.exe Token: SeDebugPrivilege 1332 wininit.exe Token: SeDebugPrivilege 1688 wininit.exe Token: SeDebugPrivilege 2612 wininit.exe Token: SeDebugPrivilege 2552 wininit.exe Token: SeDebugPrivilege 1808 wininit.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2408 wrote to memory of 1708 2408 JaffaCakes118_7f5f448f1a1a2958042f1843925068b868543db861a40caa8908e3028bdc1309.exe 28 PID 2408 wrote to memory of 1708 2408 JaffaCakes118_7f5f448f1a1a2958042f1843925068b868543db861a40caa8908e3028bdc1309.exe 28 PID 2408 wrote to memory of 1708 2408 JaffaCakes118_7f5f448f1a1a2958042f1843925068b868543db861a40caa8908e3028bdc1309.exe 28 PID 2408 wrote to memory of 1708 2408 JaffaCakes118_7f5f448f1a1a2958042f1843925068b868543db861a40caa8908e3028bdc1309.exe 28 PID 1708 wrote to memory of 2932 1708 WScript.exe 29 PID 1708 wrote to memory of 2932 1708 WScript.exe 29 PID 1708 wrote to memory of 2932 1708 WScript.exe 29 PID 1708 wrote to memory of 2932 1708 WScript.exe 29 PID 2932 wrote to memory of 2952 2932 cmd.exe 31 PID 2932 wrote to memory of 2952 2932 cmd.exe 31 PID 2932 wrote to memory of 2952 2932 cmd.exe 31 PID 2932 wrote to memory of 2952 2932 cmd.exe 31 PID 2952 wrote to memory of 2908 2952 DllCommonsvc.exe 81 PID 2952 wrote to memory of 2908 2952 DllCommonsvc.exe 81 PID 2952 wrote to memory of 2908 2952 DllCommonsvc.exe 81 PID 2952 wrote to memory of 2120 2952 DllCommonsvc.exe 82 PID 2952 wrote to memory of 2120 2952 DllCommonsvc.exe 82 PID 2952 wrote to memory of 2120 2952 DllCommonsvc.exe 82 PID 2952 wrote to memory of 3068 2952 DllCommonsvc.exe 83 PID 2952 wrote to memory of 3068 2952 DllCommonsvc.exe 83 PID 2952 wrote to memory of 3068 2952 DllCommonsvc.exe 83 PID 2952 wrote to memory of 568 2952 DllCommonsvc.exe 84 PID 2952 wrote to memory of 568 2952 DllCommonsvc.exe 84 PID 2952 wrote to memory of 568 2952 DllCommonsvc.exe 84 PID 2952 wrote to memory of 1640 2952 DllCommonsvc.exe 85 PID 2952 wrote to memory of 1640 2952 DllCommonsvc.exe 85 PID 2952 wrote to memory of 1640 2952 DllCommonsvc.exe 85 PID 2952 wrote to memory of 3024 2952 DllCommonsvc.exe 86 PID 2952 wrote to memory of 3024 2952 DllCommonsvc.exe 86 PID 2952 wrote to memory of 3024 2952 DllCommonsvc.exe 86 PID 2952 wrote to memory of 900 2952 DllCommonsvc.exe 87 PID 2952 wrote to memory of 900 2952 DllCommonsvc.exe 87 PID 2952 wrote to memory of 900 2952 DllCommonsvc.exe 87 PID 2952 wrote to memory of 2124 2952 DllCommonsvc.exe 88 PID 2952 wrote to memory of 2124 2952 DllCommonsvc.exe 88 PID 2952 wrote to memory of 2124 2952 DllCommonsvc.exe 88 PID 2952 wrote to memory of 1512 2952 DllCommonsvc.exe 89 PID 2952 wrote to memory of 1512 2952 DllCommonsvc.exe 89 PID 2952 wrote to memory of 1512 2952 DllCommonsvc.exe 89 PID 2952 wrote to memory of 2416 2952 DllCommonsvc.exe 90 PID 2952 wrote to memory of 2416 2952 DllCommonsvc.exe 90 PID 2952 wrote to memory of 2416 2952 DllCommonsvc.exe 90 PID 2952 wrote to memory of 2164 2952 DllCommonsvc.exe 91 PID 2952 wrote to memory of 2164 2952 DllCommonsvc.exe 91 PID 2952 wrote to memory of 2164 2952 DllCommonsvc.exe 91 PID 2952 wrote to memory of 2116 2952 DllCommonsvc.exe 92 PID 2952 wrote to memory of 2116 2952 DllCommonsvc.exe 92 PID 2952 wrote to memory of 2116 2952 DllCommonsvc.exe 92 PID 2952 wrote to memory of 2204 2952 DllCommonsvc.exe 93 PID 2952 wrote to memory of 2204 2952 DllCommonsvc.exe 93 PID 2952 wrote to memory of 2204 2952 DllCommonsvc.exe 93 PID 2952 wrote to memory of 2088 2952 DllCommonsvc.exe 94 PID 2952 wrote to memory of 2088 2952 DllCommonsvc.exe 94 PID 2952 wrote to memory of 2088 2952 DllCommonsvc.exe 94 PID 2952 wrote to memory of 2128 2952 DllCommonsvc.exe 95 PID 2952 wrote to memory of 2128 2952 DllCommonsvc.exe 95 PID 2952 wrote to memory of 2128 2952 DllCommonsvc.exe 95 PID 2952 wrote to memory of 388 2952 DllCommonsvc.exe 96 PID 2952 wrote to memory of 388 2952 DllCommonsvc.exe 96 PID 2952 wrote to memory of 388 2952 DllCommonsvc.exe 96 PID 2952 wrote to memory of 1608 2952 DllCommonsvc.exe 98 PID 2952 wrote to memory of 1608 2952 DllCommonsvc.exe 98 PID 2952 wrote to memory of 1608 2952 DllCommonsvc.exe 98 PID 2952 wrote to memory of 2904 2952 DllCommonsvc.exe 108 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7f5f448f1a1a2958042f1843925068b868543db861a40caa8908e3028bdc1309.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7f5f448f1a1a2958042f1843925068b868543db861a40caa8908e3028bdc1309.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\providercommon\1zu9dW.bat" "3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\providercommon\DllCommonsvc.exe"C:\providercommon\DllCommonsvc.exe"4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2908
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\SoftwareDistribution\ScanFile\services.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2120
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\taskhost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3068
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\lsass.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:568
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\wininit.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1640
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\explorer.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3024
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\smss.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:900
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\audiodg.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2124
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Common Files\SpeechEngines\Microsoft\services.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1512
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\wininit.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2416
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\conhost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2164
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\spoolsv.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2116
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Portable Devices\audiodg.exe'5⤵
- Command and Scripting Interpreter: PowerShell
PID:2204
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\lsass.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2088
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\cmd.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2128
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\smss.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:388
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\IME\imekr8\help\taskhost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1608
-
-
C:\providercommon\wininit.exe"C:\providercommon\wininit.exe"5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2904 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\RkPY472Oq9.bat"6⤵PID:920
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:27⤵PID:1620
-
-
C:\providercommon\wininit.exe"C:\providercommon\wininit.exe"7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2504 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\z9xTb8lNHs.bat"8⤵PID:2204
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:29⤵PID:2008
-
-
C:\providercommon\wininit.exe"C:\providercommon\wininit.exe"9⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2668 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\6M87tNVNy8.bat"10⤵PID:2764
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:211⤵PID:2908
-
-
C:\providercommon\wininit.exe"C:\providercommon\wininit.exe"11⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1780 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\bf2k7CZMYL.bat"12⤵PID:2264
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:213⤵PID:2800
-
-
C:\providercommon\wininit.exe"C:\providercommon\wininit.exe"13⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2592 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ph6jqiBtuj.bat"14⤵PID:1812
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:215⤵PID:2608
-
-
C:\providercommon\wininit.exe"C:\providercommon\wininit.exe"15⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2232 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\s5uDoSCHZY.bat"16⤵PID:2120
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:217⤵PID:816
-
-
C:\providercommon\wininit.exe"C:\providercommon\wininit.exe"17⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1332 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\1CE969IshF.bat"18⤵PID:1288
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:219⤵PID:1544
-
-
C:\providercommon\wininit.exe"C:\providercommon\wininit.exe"19⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1688 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\W3ML2JPNvQ.bat"20⤵PID:2136
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:221⤵PID:1636
-
-
C:\providercommon\wininit.exe"C:\providercommon\wininit.exe"21⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2612 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\BAWHCtE00Z.bat"22⤵PID:1860
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:223⤵PID:2188
-
-
C:\providercommon\wininit.exe"C:\providercommon\wininit.exe"23⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2552 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\J6LEBq1ChC.bat"24⤵PID:1292
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:225⤵PID:2000
-
-
C:\providercommon\wininit.exe"C:\providercommon\wininit.exe"25⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1808 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\JCnMdX7E06.bat"26⤵PID:848
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:227⤵PID:2332
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 9 /tr "'C:\Windows\SoftwareDistribution\ScanFile\services.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3036
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Windows\SoftwareDistribution\ScanFile\services.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2636
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 11 /tr "'C:\Windows\SoftwareDistribution\ScanFile\services.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2728
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\taskhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2716
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\taskhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2764
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\taskhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3044
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\Users\Public\lsass.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1656
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Users\Public\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2828
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\Users\Public\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2660
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 12 /tr "'C:\providercommon\wininit.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2492
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\providercommon\wininit.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2540
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 11 /tr "'C:\providercommon\wininit.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2976
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 5 /tr "'C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\explorer.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1332
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1144
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:648
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\smss.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2316
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:772
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1436
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "audiodga" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\audiodg.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:876
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\audiodg.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1364
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "audiodga" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\audiodg.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1816
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 11 /tr "'C:\Program Files\Common Files\SpeechEngines\Microsoft\services.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1704
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files\Common Files\SpeechEngines\Microsoft\services.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1736
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 9 /tr "'C:\Program Files\Common Files\SpeechEngines\Microsoft\services.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1968
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'C:\providercommon\wininit.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1960
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\providercommon\wininit.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1772
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\providercommon\wininit.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2484
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 8 /tr "'C:\providercommon\conhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1292
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\providercommon\conhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1764
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\providercommon\conhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2592
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\spoolsv.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1740
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2816
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2368
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "audiodga" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Portable Devices\audiodg.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:408
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\audiodg.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1692
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "audiodga" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Portable Devices\audiodg.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:788
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'C:\providercommon\lsass.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2264
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\providercommon\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1620
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\providercommon\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2744
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "cmdc" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\cmd.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1544
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\cmd.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1676
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "cmdc" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\cmd.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1052
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\smss.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1156
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\MSOCache\All Users\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:792
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1256
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 7 /tr "'C:\Windows\IME\imekr8\help\taskhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2328
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Windows\IME\imekr8\help\taskhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2384
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 13 /tr "'C:\Windows\IME\imekr8\help\taskhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1648
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c34919a22cc096ad97507609f319d989
SHA1a14c248bb92361eab68c2c7f5cc6ee98952cea5e
SHA2562811e44f7558efc882d55d6dae9adfb4d97efcdd9d5a4ee0d4c227152c1000ad
SHA512a09c4308d22f7361b2eeb38ceffec26de94b624142ba6c894de1e7feb9b4a83103c90f7fa31871f02abb7d9374b7956f9e26e48eba9417049c151c0ccef0d3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5eba18608684f1502318a2756fd95d1d0
SHA17202f83d4c5af50c69e2c64d603d2f195517d704
SHA2562d4c31e056b8df501151e20222a2058bcbc8934411aa8609de896c61fd46924c
SHA5127b908f14ade2ffaf8e0ba5fa1a47e920eb70759d8fe0ccac548243687dbc8fb8a15eb54c3e5e3b1976a67b1dffd7c72469b582777e2a1e3b213084a91570e89f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54e46fae03085c0699ca4d69fb02e59cd
SHA1ec3350ea02f962ba3d11f36d97447bce82c6b487
SHA256f746b4dce170c884ae6e430b003bda1c210a37c935b5910055cea4ac7942dd19
SHA5126bd3c7c907fe8436c7cd6181b8ede3ac6f7fcfac86b707342c72869862a4970e5a770dff927eb637fcda3e02ad92c88597a262b08fc8b64c4dfc95268204bd77
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD597c623338875eb548f5d949e9cf05137
SHA1c5ad175308688c15c099e4d6768616a1464c1647
SHA256f1b740a4d4d72cab20856582ce2da7c75155a4db63603fd33a189f84e7c9afd8
SHA512aa9ef2e4536abf34651e4c263730e2f80edceb872c06019e802ddca1293acdc28a294b85b9cb5aded85f7af379d712d69ca8e31968bbb76eee423f6b6e931463
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57d2813350c21b3c5239e90346e174127
SHA1483cf16dd0f7c7b2a9a31282c004596a26ad6e8b
SHA25642b7b86d961e713623bd888b8309e6814658c013950a34204b09a46c9e7ab186
SHA512882684671c45ac13a3308915916eb831590d1d875dae6b90a7310edee7dab3f7cd0fd18f1fd4c9d5e5ba069749e84141b7899618b7c664f478774e65e3bf1ecd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51f4bae5664e797a2233f49857df4084e
SHA1e52654295a49aa55c1169539f6277c935a2c950e
SHA25696116338f42aadfa9cff1992e03bca7c4eff65c2d6f5662fc0ce8fab8174c3ea
SHA5120c2747df4ffc841bf801c17b82b1017fd24f57d50ef1e3bfd3e360df4905642b1bc5bdaca17f6cbcbed6aaef405468ec6af5a32875517c4ee18cb3148c23e468
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c058127e4653b6dc290d65b26da2f1b9
SHA1cf97ebe545e478579741f1539b29027ad6763536
SHA2564898a1daa2586d4746d56d394cfc197aa07d7f0ea30b9614a7e403a5a4e1a67d
SHA5126482f8604e9dc50ae0c654783d7061e25a69920b531dfce3cd4c5076a1cb53cd5d81b3e244e4598123370a53bf6aee3fb9c5079d37dbe66e61f4b9f51ed25244
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e89c6547331083e158aa2200521b9b6d
SHA11f7f226d7566d42bace52c69c86c459f7fcdfe19
SHA2565f1cfee3e300eb4ff787c5252812142ff28f2eb7745ff874e9ffd5fe153d32bc
SHA512e09abacca67b5ded696b7fce96fbed69a85d123d41d02c7480248af28d3a4f65b6968563633fdb29fdd8683b90d12af8f9b521b1e1590ad66e85ed2fb1a0e496
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD557a459834c6e6ba58a54059f0b6922e0
SHA19603709f22d6d3601ca108dca7757af40c46b59e
SHA256f2b75631c35d83d2abef4234a609f87bd2e7b318d7b74b6910252ec10c15881a
SHA512e283fbb202a2fadf13e3ee0ebdc0f228440c54e99da6a00260b466293a422b47a7cae41223784c1e303d52b59e1b4f8d56478b7910f484317c8f4761f5e4bb2f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57e50b6f1e50e070ca967c71e61d1f903
SHA11bc772da413bc72ef55541c29acef4d14027bd5e
SHA2563dd8c5ba0fa1cec99fe1b40baf89c174a5aa5e1ffa55e354355afea353444866
SHA51271e877ea408a3d4ab48024a9a54aba8caf0e85da18c8fb40d2fbdac98b5c247a9295994cf95b87d0c60a6bd5863bf91f4db42d4127d9d452e8d8c9fe543dccfb
-
Filesize
194B
MD598d6af77677a33430782fcc3d1ffa6bc
SHA15f46a1602030d5ce8b7d676a8ce66694f15d4a85
SHA2561527a5439d574d781786ce2cdac6ce5331320a1369a2ce25442d173bf8ec7002
SHA5120c9d820c2ab29a5dee8c9ad1612c739dfb89f871b516dd76e743becfdf51f030abeb0d5b4ed391b56d014b0f3f6bfa7a1b59713de983690986547109b0d311f5
-
Filesize
194B
MD5901d77eb8fc0007bde19feeb2cb60d1e
SHA1fe38475b151c687f58a9a2162af85323751edce4
SHA25685d9e4359a190d9eb215d9e1f42c7a2f4073e66ab72e7e6d002ed83405c5c0df
SHA51246563ac183d45fe64704581e9d6d44d19d375b7e7b6f4005a863658dcbc5f9e9f8a05a37fd778b7737cd93eddb2f02d399e6aa612b69180128923b14bc9d71c1
-
Filesize
194B
MD5548ce4649e1f41453fd768eedf19ae0d
SHA18e2503b24e3603b3449868acbe31a7ecd026f637
SHA25614bc4d458c1512a4633a16cf8c48498d46bcbda99ed0062add64411ab28e27fc
SHA512dc598a1a016a5e547c52e85c5b6eed83f44229e51d3bc18e8d578249fcff879a9dd53459089fb95eb256a2c1fa542945b66bb4a31df68b544704a93cfe7fa202
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
194B
MD5ecca632e034f5c140c2704f46c5b04d0
SHA18b6f6c0fb4a9cd0218e0182b04d7fe4ab0b26c13
SHA256915911704bf19302a91894c18505579cee90a52cf792c05a309cc40bee674fc3
SHA5124994114db14803e0c47f4998f518099c86f35e0eac6a447e57b2002d77ae87200757cfcd74be8204e6173180b31c01f5b2c4934b7c6dbacf95ecc0d9de8779b1
-
Filesize
194B
MD5f7703fc3017f0b636a104f0adb2e6a4c
SHA19fbd538cc501bf272420b766fb796a37ca075aac
SHA25633919504ccba8ebd99b641a5827b500bb88b847487323968b2d0d9a4e8ed1fbc
SHA51294723677d2c8a4231d69ffa1f5e9a7176e7d72d41bde820a24ceb66952e276a6b8223bddc48e4c0af1ec176ab72e728cfc7ddbef6aca76e09757ab4729e3c766
-
Filesize
194B
MD5dc1bd44ac46dc9b0db546ed9567a1eef
SHA1dda40af8283bc9951577f4260fcb45c9d37595dd
SHA2562991550957be8aaf6d92979998377917633e196d3db1c3cea7bdd129e8a0d124
SHA51298bc5e95a5aad3130d4d3525d2b3d9ca4066e2a2d943e9ab72d46dd18cdff664c820d44bb498baac2939246134453bdda0226518388a154f2d685d5aed15cb47
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
194B
MD5a1ced2cf8bbb160752baee41a99609d6
SHA109a512080e1d44e30037f3341ee51637e8ea2fcc
SHA2561eda67be5c3dfcbc212250097fce9dc7e354eda5b7ce57d58ad6dde2cd8817b5
SHA512912ee7d65749ccb3d98454cdc8bef7f616db6b3f7692dfbc7422914f6b89b4833a6823e7118e8b6973ad2f991440f21df4c4dbc9f716bf6d5042d74bb4c88263
-
Filesize
194B
MD5b4e87901d2ac08a68d84cdb24b9d6a00
SHA194570152efa24030721505d6ab4875c9b3acb554
SHA25661092a1514f2421b2a58b950b22a324b2e02aefbc1acdec09f3a169118c48bca
SHA512771220350a3d69f31150004c035fb16faf5a22070ddcead3dbf48ff195893cbce2fb5021c6d87736fe7fef4bc455d566645ccfd99e1c14e6fa2acf097552007e
-
Filesize
194B
MD5b2787e3be9920310ecf8d86123b991cb
SHA17c5255eb90d83b354d5c195c000104ba95d8efde
SHA256e502bb5fcf81440862d0e782f19eacb4d277a65d97278b40435c18ab3d49e74d
SHA512de584c465f9560f2adb1f388b296b2352198d42f37c3780d10d42652a9f13dd1b01e1c24a9f6053858a789dff93cec229a1cb10b266c518613072e3f98fdaae6
-
Filesize
194B
MD5fa393f54e65d06bcaad8ead8b18118bb
SHA1fd2216f9200f1210e188e14e2be1766a73c8bb6a
SHA2567fe1b9536d14ef3c13a7eda7c18c9279a8588170fe697e695d58a3b64fe433fe
SHA512c2125d93e06a712da7be55d4d4095f0529f206eaf9d09c0274a4eed4d5d6ba2184fc1e82d61f7aff1864416476921e75ab7ce42c86746eb9b7608a439c9d03ce
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\980X5J6HTSRDAHYD1RYF.temp
Filesize7KB
MD5f79fd5b1ae66ec50999be8a129c820cc
SHA1c4b99e5cc08ee62d703ec2a82bbe4f6c3fb0d393
SHA256b0aec2ef3f998c701d6190bc359fd910fb13ccabaa93cafadbe8b2d0509632b4
SHA512c0385b723b107a0152dc9dbcf1b116705ce44a8abefb9b06798a3600a807efd9b4bbe785ca8e4a9ba4d14f722cae2df96b0f90d3f5a0c228bfc1f3583eeb1faf
-
Filesize
36B
MD56783c3ee07c7d151ceac57f1f9c8bed7
SHA117468f98f95bf504cc1f83c49e49a78526b3ea03
SHA2568ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322
SHA512c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8
-
Filesize
197B
MD58088241160261560a02c84025d107592
SHA1083121f7027557570994c9fc211df61730455bb5
SHA2562072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1
SHA51220d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478
-
Filesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394