dcrat | 726f523af341fa9fb3a32810498ec7ce8db6012d5490b44d36b7cfc0439b3d75

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2024 20:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_726f523af341fa9fb3a32810498ec7ce8db6012d5490b44d36b7cfc0439b3d75.exe
Size

1.3MB
MD5

c42ddb389555cda77256e2fc7e0761c9
SHA1

31fd98d5aa9749ec3bb15ee475c8526ef8026b70
SHA256

726f523af341fa9fb3a32810498ec7ce8db6012d5490b44d36b7cfc0439b3d75
SHA512

14fa96fa25efa4457c983c5a56e9135fb95372c62ecbe580d082743497349332e0b871528abd214b305554d12a1f1cb765ad863983c4ed1eecb7c90f73f2b617
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 39 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2192	3524	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4868	3524	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	228	3524	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4836	3524	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2320	3524	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2400	3524	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	784	3524	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4840	3524	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3088	3524	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	804	3524	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4640	3524	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	860	3524	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5016	3524	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2280	3524	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	396	3524	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3532	3524	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1520	3524	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3684	3524	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4324	3524	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3332	3524	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3976	3524	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4932	3524	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1636	3524	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3636	3524	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2028	3524	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3212	3524	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3200	3524	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3236	3524	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4724	3524	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1380	3524	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3948	3524	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3960	3524	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1640	3524	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2548	3524	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4484	3524	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3480	3524	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2924	3524	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2484	3524	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	788	3524	schtasks.exe	86

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x0008000000023c03-10.dat	dcrat
behavioral2/memory/2728-13-0x0000000000A90000-0x0000000000BA0000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 14 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1892	powershell.exe
4076	powershell.exe
4844	powershell.exe
1512	powershell.exe
3104	powershell.exe
3632	powershell.exe
3360	powershell.exe
864	powershell.exe
116	powershell.exe
3728	powershell.exe
3172	powershell.exe
1468	powershell.exe
3724	powershell.exe
980	powershell.exe

Checks computer location settings 2 TTPs 16 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	explorer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	explorer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	explorer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	explorer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	explorer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	explorer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	explorer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	explorer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	explorer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	explorer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	explorer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	explorer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	JaffaCakes118_726f523af341fa9fb3a32810498ec7ce8db6012d5490b44d36b7cfc0439b3d75.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	explorer.exe

Executes dropped EXE 14 IoCs

pid	Process
2728	DllCommonsvc.exe
1040	explorer.exe
3912	explorer.exe
3328	explorer.exe
5064	explorer.exe
4204	explorer.exe
1484	explorer.exe
1424	explorer.exe
3064	explorer.exe
2480	explorer.exe
1020	explorer.exe
3532	explorer.exe
2264	explorer.exe
2924	explorer.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 14 IoCs

Web Service

T1102

flow	ioc
43	raw.githubusercontent.com
51	raw.githubusercontent.com
20	raw.githubusercontent.com
44	raw.githubusercontent.com
53	raw.githubusercontent.com
54	raw.githubusercontent.com
23	raw.githubusercontent.com
37	raw.githubusercontent.com
38	raw.githubusercontent.com
39	raw.githubusercontent.com
55	raw.githubusercontent.com
19	raw.githubusercontent.com
50	raw.githubusercontent.com
52	raw.githubusercontent.com

Drops file in Program Files directory 11 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows NT\9e8d7a4ca61bd9	DllCommonsvc.exe
File created	C:\Program Files\Microsoft Office 15\spoolsv.exe	DllCommonsvc.exe
File created	C:\Program Files\Microsoft Office 15\f3b6ecef712a24	DllCommonsvc.exe
File created	C:\Program Files\Windows Portable Devices\121e5b5079f7c0	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\Idle.exe	DllCommonsvc.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\Idle.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\6ccacd8608530f	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows NT\RuntimeBroker.exe	DllCommonsvc.exe
File created	C:\Program Files\Crashpad\reports\csrss.exe	DllCommonsvc.exe
File created	C:\Program Files\Crashpad\reports\886983d96e3d3e	DllCommonsvc.exe
File created	C:\Program Files\Windows Portable Devices\sysmon.exe	DllCommonsvc.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\OfficeClickToRun.exe	DllCommonsvc.exe
File created	C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\e6c9b481da804f	DllCommonsvc.exe
File created	C:\Windows\Registration\CRMLog\smss.exe	DllCommonsvc.exe
File created	C:\Windows\Registration\CRMLog\69ddcba757bf72	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_726f523af341fa9fb3a32810498ec7ce8db6012d5490b44d36b7cfc0439b3d75.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	JaffaCakes118_726f523af341fa9fb3a32810498ec7ce8db6012d5490b44d36b7cfc0439b3d75.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	explorer.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 39 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2280	schtasks.exe
3532	schtasks.exe
3976	schtasks.exe
4932	schtasks.exe
2028	schtasks.exe
2924	schtasks.exe
228	schtasks.exe
3088	schtasks.exe
3212	schtasks.exe
1380	schtasks.exe
2548	schtasks.exe
4324	schtasks.exe
3636	schtasks.exe
4724	schtasks.exe
3948	schtasks.exe
4836	schtasks.exe
396	schtasks.exe
1520	schtasks.exe
3200	schtasks.exe
3480	schtasks.exe
2484	schtasks.exe
784	schtasks.exe
804	schtasks.exe
1636	schtasks.exe
3960	schtasks.exe
1640	schtasks.exe
4484	schtasks.exe
2400	schtasks.exe
4840	schtasks.exe
4640	schtasks.exe
860	schtasks.exe
4868	schtasks.exe
2320	schtasks.exe
5016	schtasks.exe
2192	schtasks.exe
3684	schtasks.exe
3332	schtasks.exe
3236	schtasks.exe
788	schtasks.exe

Suspicious behavior: EnumeratesProcesses 61 IoCs

pid	Process
2728	DllCommonsvc.exe
2728	DllCommonsvc.exe
2728	DllCommonsvc.exe
2728	DllCommonsvc.exe
2728	DllCommonsvc.exe
864	powershell.exe
864	powershell.exe
1468	powershell.exe
1468	powershell.exe
3724	powershell.exe
3724	powershell.exe
4076	powershell.exe
4076	powershell.exe
3104	powershell.exe
3104	powershell.exe
3172	powershell.exe
3172	powershell.exe
4844	powershell.exe
4844	powershell.exe
3632	powershell.exe
3632	powershell.exe
116	powershell.exe
116	powershell.exe
1512	powershell.exe
1512	powershell.exe
1892	powershell.exe
1892	powershell.exe
3360	powershell.exe
3360	powershell.exe
980	powershell.exe
980	powershell.exe
3728	powershell.exe
3728	powershell.exe
864	powershell.exe
864	powershell.exe
4076	powershell.exe
1468	powershell.exe
3104	powershell.exe
3632	powershell.exe
3728	powershell.exe
3724	powershell.exe
3172	powershell.exe
116	powershell.exe
1512	powershell.exe
4844	powershell.exe
1892	powershell.exe
3360	powershell.exe
980	powershell.exe
1040	explorer.exe
3912	explorer.exe
3328	explorer.exe
5064	explorer.exe
4204	explorer.exe
1484	explorer.exe
1424	explorer.exe
3064	explorer.exe
2480	explorer.exe
1020	explorer.exe
3532	explorer.exe
2264	explorer.exe
2924	explorer.exe

Suspicious use of AdjustPrivilegeToken 28 IoCs

description	pid	Process
Token: SeDebugPrivilege	2728	DllCommonsvc.exe
Token: SeDebugPrivilege	864	powershell.exe
Token: SeDebugPrivilege	1468	powershell.exe
Token: SeDebugPrivilege	3724	powershell.exe
Token: SeDebugPrivilege	4076	powershell.exe
Token: SeDebugPrivilege	3104	powershell.exe
Token: SeDebugPrivilege	3172	powershell.exe
Token: SeDebugPrivilege	4844	powershell.exe
Token: SeDebugPrivilege	3632	powershell.exe
Token: SeDebugPrivilege	116	powershell.exe
Token: SeDebugPrivilege	1512	powershell.exe
Token: SeDebugPrivilege	1892	powershell.exe
Token: SeDebugPrivilege	3360	powershell.exe
Token: SeDebugPrivilege	980	powershell.exe
Token: SeDebugPrivilege	3728	powershell.exe
Token: SeDebugPrivilege	1040	explorer.exe
Token: SeDebugPrivilege	3912	explorer.exe
Token: SeDebugPrivilege	3328	explorer.exe
Token: SeDebugPrivilege	5064	explorer.exe
Token: SeDebugPrivilege	4204	explorer.exe
Token: SeDebugPrivilege	1484	explorer.exe
Token: SeDebugPrivilege	1424	explorer.exe
Token: SeDebugPrivilege	3064	explorer.exe
Token: SeDebugPrivilege	2480	explorer.exe
Token: SeDebugPrivilege	1020	explorer.exe
Token: SeDebugPrivilege	3532	explorer.exe
Token: SeDebugPrivilege	2264	explorer.exe
Token: SeDebugPrivilege	2924	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2460 wrote to memory of 2424	2460	JaffaCakes118_726f523af341fa9fb3a32810498ec7ce8db6012d5490b44d36b7cfc0439b3d75.exe	82
PID 2460 wrote to memory of 2424	2460	JaffaCakes118_726f523af341fa9fb3a32810498ec7ce8db6012d5490b44d36b7cfc0439b3d75.exe	82
PID 2460 wrote to memory of 2424	2460	JaffaCakes118_726f523af341fa9fb3a32810498ec7ce8db6012d5490b44d36b7cfc0439b3d75.exe	82
PID 2424 wrote to memory of 4980	2424	WScript.exe	83
PID 2424 wrote to memory of 4980	2424	WScript.exe	83
PID 2424 wrote to memory of 4980	2424	WScript.exe	83
PID 4980 wrote to memory of 2728	4980	cmd.exe	85
PID 4980 wrote to memory of 2728	4980	cmd.exe	85
PID 2728 wrote to memory of 3728	2728	DllCommonsvc.exe	126
PID 2728 wrote to memory of 3728	2728	DllCommonsvc.exe	126
PID 2728 wrote to memory of 3104	2728	DllCommonsvc.exe	127
PID 2728 wrote to memory of 3104	2728	DllCommonsvc.exe	127
PID 2728 wrote to memory of 4076	2728	DllCommonsvc.exe	128
PID 2728 wrote to memory of 4076	2728	DllCommonsvc.exe	128
PID 2728 wrote to memory of 116	2728	DllCommonsvc.exe	129
PID 2728 wrote to memory of 116	2728	DllCommonsvc.exe	129
PID 2728 wrote to memory of 1512	2728	DllCommonsvc.exe	130
PID 2728 wrote to memory of 1512	2728	DllCommonsvc.exe	130
PID 2728 wrote to memory of 4844	2728	DllCommonsvc.exe	132
PID 2728 wrote to memory of 4844	2728	DllCommonsvc.exe	132
PID 2728 wrote to memory of 3632	2728	DllCommonsvc.exe	133
PID 2728 wrote to memory of 3632	2728	DllCommonsvc.exe	133
PID 2728 wrote to memory of 3172	2728	DllCommonsvc.exe	134
PID 2728 wrote to memory of 3172	2728	DllCommonsvc.exe	134
PID 2728 wrote to memory of 980	2728	DllCommonsvc.exe	135
PID 2728 wrote to memory of 980	2728	DllCommonsvc.exe	135
PID 2728 wrote to memory of 3724	2728	DllCommonsvc.exe	136
PID 2728 wrote to memory of 3724	2728	DllCommonsvc.exe	136
PID 2728 wrote to memory of 864	2728	DllCommonsvc.exe	137
PID 2728 wrote to memory of 864	2728	DllCommonsvc.exe	137
PID 2728 wrote to memory of 1468	2728	DllCommonsvc.exe	138
PID 2728 wrote to memory of 1468	2728	DllCommonsvc.exe	138
PID 2728 wrote to memory of 3360	2728	DllCommonsvc.exe	140
PID 2728 wrote to memory of 3360	2728	DllCommonsvc.exe	140
PID 2728 wrote to memory of 1892	2728	DllCommonsvc.exe	141
PID 2728 wrote to memory of 1892	2728	DllCommonsvc.exe	141
PID 2728 wrote to memory of 756	2728	DllCommonsvc.exe	154
PID 2728 wrote to memory of 756	2728	DllCommonsvc.exe	154
PID 756 wrote to memory of 760	756	cmd.exe	156
PID 756 wrote to memory of 760	756	cmd.exe	156
PID 756 wrote to memory of 1040	756	cmd.exe	160
PID 756 wrote to memory of 1040	756	cmd.exe	160
PID 1040 wrote to memory of 3836	1040	explorer.exe	164
PID 1040 wrote to memory of 3836	1040	explorer.exe	164
PID 3836 wrote to memory of 3512	3836	cmd.exe	166
PID 3836 wrote to memory of 3512	3836	cmd.exe	166
PID 3836 wrote to memory of 3912	3836	cmd.exe	167
PID 3836 wrote to memory of 3912	3836	cmd.exe	167
PID 3912 wrote to memory of 116	3912	explorer.exe	169
PID 3912 wrote to memory of 116	3912	explorer.exe	169
PID 116 wrote to memory of 4876	116	cmd.exe	171
PID 116 wrote to memory of 4876	116	cmd.exe	171
PID 116 wrote to memory of 3328	116	cmd.exe	173
PID 116 wrote to memory of 3328	116	cmd.exe	173
PID 3328 wrote to memory of 4868	3328	explorer.exe	174
PID 3328 wrote to memory of 4868	3328	explorer.exe	174
PID 4868 wrote to memory of 3672	4868	cmd.exe	176
PID 4868 wrote to memory of 3672	4868	cmd.exe	176
PID 4868 wrote to memory of 5064	4868	cmd.exe	177
PID 4868 wrote to memory of 5064	4868	cmd.exe	177
PID 5064 wrote to memory of 4120	5064	explorer.exe	178
PID 5064 wrote to memory of 4120	5064	explorer.exe	178
PID 4120 wrote to memory of 3532	4120	cmd.exe	180
PID 4120 wrote to memory of 3532	4120	cmd.exe	180

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_726f523af341fa9fb3a32810498ec7ce8db6012d5490b44d36b7cfc0439b3d75.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_726f523af341fa9fb3a32810498ec7ce8db6012d5490b44d36b7cfc0439b3d75.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2460
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2424
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4980
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2728
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3728
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\Idle.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3104
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\upfc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4076
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Registration\CRMLog\smss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:116
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows NT\RuntimeBroker.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1512
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Application Data\dllhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4844
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\OfficeClickToRun.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3632
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Pictures\SppExtComObj.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3172
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Application Data\explorer.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:980
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\StartMenuExperienceHost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3724
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Microsoft Office 15\spoolsv.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:864
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Crashpad\reports\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1468
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\System.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3360
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Portable Devices\sysmon.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1892
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\17nw1paBjj.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:756
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:760
      - C:\Users\All Users\Application Data\explorer.exe
        
        "C:\Users\All Users\Application Data\explorer.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1040
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\XkJigN4PJf.bat"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:3836
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:3512
        
        C:\Users\All Users\Application Data\explorer.exe
        
        "C:\Users\All Users\Application Data\explorer.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3912
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\H7kUlUtrsw.bat"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:116
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:4876
        
        C:\Users\All Users\Application Data\explorer.exe
        
        "C:\Users\All Users\Application Data\explorer.exe"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3328
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\jaxwQXfGLd.bat"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:4868
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:3672
        
        C:\Users\All Users\Application Data\explorer.exe
        
        "C:\Users\All Users\Application Data\explorer.exe"
        12⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5064
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\bbMo3XBCxD.bat"
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:4120
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        14⤵
        
        PID:3532
        
        C:\Users\All Users\Application Data\explorer.exe
        
        "C:\Users\All Users\Application Data\explorer.exe"
        14⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4204
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\dekjrv1PTF.bat"
        15⤵
        
        PID:3632
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        16⤵
        
        PID:4640
        
        C:\Users\All Users\Application Data\explorer.exe
        
        "C:\Users\All Users\Application Data\explorer.exe"
        16⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1484
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\mNrvcGFykN.bat"
        17⤵
        
        PID:4104
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        18⤵
        
        PID:756
        
        C:\Users\All Users\Application Data\explorer.exe
        
        "C:\Users\All Users\Application Data\explorer.exe"
        18⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1424
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\QwDZd8tkMK.bat"
        19⤵
        
        PID:4292
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        20⤵
        
        PID:4404
        
        C:\Users\All Users\Application Data\explorer.exe
        
        "C:\Users\All Users\Application Data\explorer.exe"
        20⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3064
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\dekjrv1PTF.bat"
        21⤵
        
        PID:532
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        22⤵
        
        PID:3912
        
        C:\Users\All Users\Application Data\explorer.exe
        
        "C:\Users\All Users\Application Data\explorer.exe"
        22⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2480
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\xHU7fKnwSZ.bat"
        23⤵
        
        PID:2068
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        24⤵
        
        PID:536
        
        C:\Users\All Users\Application Data\explorer.exe
        
        "C:\Users\All Users\Application Data\explorer.exe"
        24⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1020
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\B4BP5ZSgoJ.bat"
        25⤵
        
        PID:2360
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        26⤵
        
        PID:4420
        
        C:\Users\All Users\Application Data\explorer.exe
        
        "C:\Users\All Users\Application Data\explorer.exe"
        26⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3532
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\57xCWyooww.bat"
        27⤵
        
        PID:4936
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        28⤵
        
        PID:3432
        
        C:\Users\All Users\Application Data\explorer.exe
        
        "C:\Users\All Users\Application Data\explorer.exe"
        28⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2264
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\J2mXRZwkCj.bat"
        29⤵
        
        PID:4472
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        30⤵
        
        PID:3360
        
        C:\Users\All Users\Application Data\explorer.exe
        
        "C:\Users\All Users\Application Data\explorer.exe"
        30⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2924
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\hevtjRcN1r.bat"
        31⤵
        
        PID:1852
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        32⤵
        
        PID:1092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2192

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\upfc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 8 /tr "'C:\Windows\Registration\CRMLog\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\Registration\CRMLog\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 6 /tr "'C:\Windows\Registration\CRMLog\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows NT\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows NT\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Users\Default\Application Data\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Default\Application Data\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2280

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Users\Default\Application Data\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 11 /tr "'C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 6 /tr "'C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 6 /tr "'C:\Users\Public\Pictures\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Users\Public\Pictures\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3332

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 8 /tr "'C:\Users\Public\Pictures\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\Application Data\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Users\All Users\Application Data\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\Application Data\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 13 /tr "'C:\Users\Public\Videos\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Users\Public\Videos\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3212

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 10 /tr "'C:\Users\Public\Videos\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\Program Files\Microsoft Office 15\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office 15\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 11 /tr "'C:\Program Files\Microsoft Office 15\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Program Files\Crashpad\reports\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Crashpad\reports\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Program Files\Crashpad\reports\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 12 /tr "'C:\providercommon\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\providercommon\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 6 /tr "'C:\providercommon\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Portable Devices\sysmon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Portable Devices\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\explorer.exe.log

Filesize
1KB

MD5
baf55b95da4a601229647f25dad12878

SHA1
abc16954ebfd213733c4493fc1910164d825cac8

SHA256
ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

SHA512
24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
5f0ddc7f3691c81ee14d17b419ba220d

SHA1
f0ef5fde8bab9d17c0b47137e014c91be888ee53

SHA256
a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

SHA512
2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e448fe0d240184c6597a31d3be2ced58

SHA1
372b8d8c19246d3e38cd3ba123cc0f56070f03cd

SHA256
c660f0db85a1e7f0f68db19868979bf50bd541531babf77a701e1b1ce5e6a391

SHA512
0b7f7eae7700d32b18eee3677cb7f89b46ace717fa7e6b501d6c47d54f15dff7e12b49f5a7d36a6ffe4c16165c7d55162db4f3621db545b6af638035752beab4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e243a38635ff9a06c87c2a61a2200656

SHA1
ecd95ed5bf1a9fbe96a8448fc2814a0210fa2afc

SHA256
af5782703f3f2d5a29fb313dae6680a64134db26064d4a321a3f23b75f6ca00f

SHA512
4418957a1b10eee44cf270c81816ae707352411c4f5ac14b6b61ab537c91480e24e0a0a2c276a6291081b4984c123cf673a45dcedb0ceeef682054ba0fc19cb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3a6bad9528f8e23fb5c77fbd81fa28e8

SHA1
f127317c3bc6407f536c0f0600dcbcf1aabfba36

SHA256
986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

SHA512
846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
ecceac16628651c18879d836acfcb062

SHA1
420502b3e5220a01586c59504e94aa1ee11982c9

SHA256
58238de09a8817ed9f894ed8e5bf06a897fd08e0b0bd77e508d37b2598edd2a9

SHA512
be3c7cb529cafb00f58790a6f8b35c4ff6db9f7f43a507d2218fd80cebc88413e46f71b1bc35b8afcc36b68f9409c946470d1e74a4fe225400eeb6f3f898f5b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\17nw1paBjj.bat

Filesize
213B

MD5
e886d2161db48c6108175454ca0e845c

SHA1
9bac5694bbf182ea5ff32eb112ee0dbef6e88473

SHA256
18be9debc427e85f117b1776cc71572bffe9cd6220edbf508d8e853ec570a711

SHA512
d72a3cdb5c6b247dad0d2e5c2e647593fdc35068bfa40e8ab04cde38a8f294abb87bfd0987c89d35170398de1191670ffd6908df70ae281cd150e9262d99cd9e

Download Submit
C:\Users\Admin\AppData\Local\Temp\57xCWyooww.bat

Filesize
213B

MD5
41699aa7fd4de89804336c732f3e0bca

SHA1
796f5b13f5bf90a5b304ae36107fc43183d97dd3

SHA256
0203771d7a3379f46ca82a842b9ab1fd9b36bf63c1f366a93643bb63fb985665

SHA512
33d04cd1dd12167a627bafd9b3cf2a9560a6a2a66994011b26a64015947a32f3c8c5c7c5138e8180597c91fb3363e9d64e0989ab8667471b8daf4fae38bd789c

Download Submit
C:\Users\Admin\AppData\Local\Temp\B4BP5ZSgoJ.bat

Filesize
213B

MD5
69f3fe7b2f6c1f8783483cbbff8b8a90

SHA1
916aefe584c6bf7b0268fc1859aec92b264721cc

SHA256
a711063e4982a638ec88d0f1d0f95c3295516b6965d29636923c93fb74727261

SHA512
563ba4ae651f471b7849e1292d57ef7d51f4772a0010631a843029c84649ff3f358df7bd72c225c2eb68c7b81835106b4683cbe450094d687e90139ad5f6b1d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\H7kUlUtrsw.bat

Filesize
213B

MD5
4425a049bacf4d29bb23ebf47dce331e

SHA1
e82a299bdcee539569fb73919cd592020cd6b873

SHA256
721bac725358120e06b166f7ca9794f185a3300598385b5cb18111f08b4a06ac

SHA512
927614e52f49364524f6e899419551057f336d1276d78404c252324cff648bd9b611689f68e36952892d317bc092ff923ceb173d9623e8fa02a87fb369858eaf

Download Submit
C:\Users\Admin\AppData\Local\Temp\J2mXRZwkCj.bat

Filesize
213B

MD5
144e4b4764a72ad1ac89adcad96f2554

SHA1
9713e7f0d2c0294f71fc7d6eedba7c32f51dbf82

SHA256
48349a8b80363db0878793093af7d29135c09af5bbd3dfad1b3a71e9deca10dd

SHA512
61dfa202e9b6ce8f209d4d66c82f8499f5a08e31e07350e486dd23fe4333fefcaf6608682fd474ec73e87adcda4375e0ebda86b4eb15ece519d43a6885a9e08b

Download Submit
C:\Users\Admin\AppData\Local\Temp\QwDZd8tkMK.bat

Filesize
213B

MD5
b6efcfa3a67e2738c8a2807cabdddbaa

SHA1
282e2e20abd471a0b7056fc8fa58a8dee0349636

SHA256
79a6ebff3d3962c59d05f949d5794e3b9affd9d23b784e4ed758a8cb17af4022

SHA512
5ac03025848abd609f24202b1ce2e695152ccf1cea4995da1557c7735dec4af7ee7e752c4caafec9fa0b7e9638e44b1bfc0843b6313e20a2e1f3073af87ae51f

Download Submit
C:\Users\Admin\AppData\Local\Temp\XkJigN4PJf.bat

Filesize
213B

MD5
01eee1a104951c0b135f672f63f4b348

SHA1
4eaedf3ee29fa280572f629bb81343be41e9622f

SHA256
6f63f76361acba17d2b1163200cc95fc53809c503aad9722a87abfa3f4a4aef3

SHA512
cdb11ee9fcb5c7850e5c997bb9912f34d56810196b5185706c7167b0cd0749a0585532b94cd8837e0f84016dcca128e4ad53dffe9f40e2683ea0f1a5921b897e

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_taevuggr.2kz.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\bbMo3XBCxD.bat

Filesize
213B

MD5
4e74ab9ad0e3b34bf53ad568e87357eb

SHA1
b52e8d78a1b829f95791f9876e2c341acc505cf0

SHA256
dbcce6d3948c9c6e8402ac4b2723cffd7fd34e0f0e7b7f5594cc34d69e9b1b2e

SHA512
6bcf6a439720606a2228c996063230818dd418bd3876e32bf593f1d20b8c081a2415928d9be4f85dc1fb37832a0d953793bfdd52d16fe2d1ab130e61076c0ce9

Download Submit
C:\Users\Admin\AppData\Local\Temp\dekjrv1PTF.bat

Filesize
213B

MD5
97b8209b683bfdd93734f7a151577370

SHA1
88d94d1afbd1a8f91d4121d44a8ed44c5d4dbb17

SHA256
a096b20fc540d4d35fab2bd2728f76ee452ecf56bf45acef06c95960ed8f4c99

SHA512
1a9f9a95a5ce58c206b3d133d0873febbaf6a1ef6fb313d29b007156a32f7e1705297f6ef9262158b1a42848b694065db9f69302db08000be4600843ac922491

Download Submit
C:\Users\Admin\AppData\Local\Temp\hevtjRcN1r.bat

Filesize
213B

MD5
4467c702b3463f9581e8bc3e8d4e8260

SHA1
1d82ec00866c8cda05bd82a25b9001c72c3eedc6

SHA256
5c51ae7155f4007bed6760f9cc9e07f5518d252687ce6ad4fd4f437bb8335a90

SHA512
ed92bbb99eb61d095a13e2ba1d6f07ab47f382152602df28c067a9ea4a4fe485ab8e9329244e8f30a4f45f34a5896b739a2e901e8bcdf1a4aad3552be31c0280

Download Submit
C:\Users\Admin\AppData\Local\Temp\jaxwQXfGLd.bat

Filesize
213B

MD5
e32e7d321092c0d12de00ff5ae7d467e

SHA1
b8e1a7feb4b64c157ba66542644b25f012ffa0a7

SHA256
e806f394cf26fa8152908196ad263cb60c6d7a4e8aba69cdcd2202bb7d6359b4

SHA512
83ae6f4e630a122ca90014c67b8a86c1fa9e2cea00f34cb0c477e2813a5c5536d69d394624098fa107c859939c60e94ef46e8438724bf4a89764ca2c374976c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\mNrvcGFykN.bat

Filesize
213B

MD5
4791eeed039db9d916d7d6f2fb8bec96

SHA1
19294dbeedeaeca57cd605ddae063f47a0466a50

SHA256
b05a755d6092423fcae8a82b5d80609cc47f30eb58e8d4d34820a82bf3084bf3

SHA512
0a96fc53d2565e1c3e00fa5741efc9313de017196677e9296bce214df533e352421baaece77d0b9ac4b2c29677aa50be870c1eba9e38b1540dd08798fa5d909a

Download Submit
C:\Users\Admin\AppData\Local\Temp\xHU7fKnwSZ.bat

Filesize
213B

MD5
b181c7e20954fd74d02f5888947f10cb

SHA1
5f72cad4cc4c4f864cc48fa1990612ad2afa308a

SHA256
5a4329637ba0ce1378d5fad133b42c8b56072ab61cd36b32ed0258da49006d20

SHA512
a24ce4cba1bbc5178e55ac4193f1831b3f7df89a3239ebfa5cc186eae32a86d6d25827113c070338a594801a60da1637d362cfe04242ae5e40b5491cf9bca5a6

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/864-53-0x00000155A32F0000-0x00000155A3312000-memory.dmp

Filesize
136KB

Download
memory/1020-266-0x0000000002B00000-0x0000000002B12000-memory.dmp

Filesize
72KB

Download
memory/2480-259-0x0000000003020000-0x0000000003032000-memory.dmp

Filesize
72KB

Download
memory/2728-13-0x0000000000A90000-0x0000000000BA0000-memory.dmp

Filesize
1.1MB

Download
memory/2728-14-0x0000000002DB0000-0x0000000002DC2000-memory.dmp

Filesize
72KB

Download
memory/2728-12-0x00007FFDBE573000-0x00007FFDBE575000-memory.dmp

Filesize
8KB

Download
memory/2728-15-0x0000000002DC0000-0x0000000002DCC000-memory.dmp

Filesize
48KB

Download
memory/2728-16-0x0000000002DD0000-0x0000000002DDC000-memory.dmp

Filesize
48KB

Download
memory/2728-17-0x0000000002DE0000-0x0000000002DEC000-memory.dmp

Filesize
48KB

Download
memory/3532-273-0x0000000002F20000-0x0000000002F32000-memory.dmp

Filesize
72KB

Download