Analysis

  • max time kernel
    147s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/12/2024, 01:49

General

  • Target

    JaffaCakes118_38529abe4880de3780b945a4015d6f8a6da474d300f55e72dcfcdc9765dd9c04.exe

  • Size

    1.3MB

  • MD5

    31cd6d1e3ad6e1f663f58cde4001cb19

  • SHA1

    e685f9a44bb921e0f4c34338b1a22dd3fd2230b2

  • SHA256

    38529abe4880de3780b945a4015d6f8a6da474d300f55e72dcfcdc9765dd9c04

  • SHA512

    70cf2ca610f251d94a98f06d358d2a1af31ba01836e7f2761bb1ff2c3b605035966d9c0d312f0575e67e6625f7e36bce3a8b3f1d54c17fcb6d1a16706d29aeca

  • SSDEEP

    24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Dcrat family
  • Process spawned unexpected child process 24 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • DCRat payload 2 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 9 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks computer location settings 2 TTPs 14 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 13 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 12 IoCs
  • Drops file in Program Files directory 8 IoCs
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 12 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 24 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 51 IoCs
  • Suspicious use of AdjustPrivilegeToken 22 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_38529abe4880de3780b945a4015d6f8a6da474d300f55e72dcfcdc9765dd9c04.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_38529abe4880de3780b945a4015d6f8a6da474d300f55e72dcfcdc9765dd9c04.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:3232
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
      2⤵
      • Checks computer location settings
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1652
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2248
        • C:\providercommon\DllCommonsvc.exe
          "C:\providercommon\DllCommonsvc.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:5116
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3576
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\security\audit\services.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4000
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft.NET\RedistList\explorer.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2972
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Common Files\System\fr-FR\TextInputHost.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3976
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Photo Viewer\it-IT\spoolsv.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:656
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Multimedia Platform\smss.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1784
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\conhost.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4872
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\CbsTemp\explorer.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4992
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\wininit.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1300
          • C:\providercommon\conhost.exe
            "C:\providercommon\conhost.exe"
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:4224
            • C:\Windows\System32\cmd.exe
              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\jFXOGCU6Cq.bat"
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:4644
              • C:\Windows\system32\w32tm.exe
                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                7⤵
                  PID:4148
                • C:\providercommon\conhost.exe
                  "C:\providercommon\conhost.exe"
                  7⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Modifies registry class
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:3324
                  • C:\Windows\System32\cmd.exe
                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\KYEunsIO9t.bat"
                    8⤵
                    • Suspicious use of WriteProcessMemory
                    PID:336
                    • C:\Windows\system32\w32tm.exe
                      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                      9⤵
                        PID:4976
                      • C:\providercommon\conhost.exe
                        "C:\providercommon\conhost.exe"
                        9⤵
                        • Checks computer location settings
                        • Executes dropped EXE
                        • Modifies registry class
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        PID:4024
                        • C:\Windows\System32\cmd.exe
                          "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\7hZg3igX7v.bat"
                          10⤵
                          • Suspicious use of WriteProcessMemory
                          PID:2796
                          • C:\Windows\system32\w32tm.exe
                            w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                            11⤵
                              PID:2996
                            • C:\providercommon\conhost.exe
                              "C:\providercommon\conhost.exe"
                              11⤵
                              • Checks computer location settings
                              • Executes dropped EXE
                              • Modifies registry class
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of WriteProcessMemory
                              PID:4420
                              • C:\Windows\System32\cmd.exe
                                "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\HcCr6nEVp7.bat"
                                12⤵
                                • Suspicious use of WriteProcessMemory
                                PID:948
                                • C:\Windows\system32\w32tm.exe
                                  w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                  13⤵
                                    PID:3100
                                  • C:\providercommon\conhost.exe
                                    "C:\providercommon\conhost.exe"
                                    13⤵
                                    • Checks computer location settings
                                    • Executes dropped EXE
                                    • Modifies registry class
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of AdjustPrivilegeToken
                                    • Suspicious use of WriteProcessMemory
                                    PID:4348
                                    • C:\Windows\System32\cmd.exe
                                      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\QUR8LTwG0H.bat"
                                      14⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:4652
                                      • C:\Windows\system32\w32tm.exe
                                        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                        15⤵
                                          PID:548
                                        • C:\providercommon\conhost.exe
                                          "C:\providercommon\conhost.exe"
                                          15⤵
                                          • Checks computer location settings
                                          • Executes dropped EXE
                                          • Modifies registry class
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of AdjustPrivilegeToken
                                          • Suspicious use of WriteProcessMemory
                                          PID:2972
                                          • C:\Windows\System32\cmd.exe
                                            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\tpXWVAFTZv.bat"
                                            16⤵
                                            • Suspicious use of WriteProcessMemory
                                            PID:2060
                                            • C:\Windows\system32\w32tm.exe
                                              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                              17⤵
                                                PID:3632
                                              • C:\providercommon\conhost.exe
                                                "C:\providercommon\conhost.exe"
                                                17⤵
                                                • Checks computer location settings
                                                • Executes dropped EXE
                                                • Modifies registry class
                                                • Suspicious behavior: EnumeratesProcesses
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:892
                                                • C:\Windows\System32\cmd.exe
                                                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\YKuCD7w8Ue.bat"
                                                  18⤵
                                                    PID:4028
                                                    • C:\Windows\system32\w32tm.exe
                                                      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                      19⤵
                                                        PID:3724
                                                      • C:\providercommon\conhost.exe
                                                        "C:\providercommon\conhost.exe"
                                                        19⤵
                                                        • Checks computer location settings
                                                        • Executes dropped EXE
                                                        • Modifies registry class
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:4152
                                                        • C:\Windows\System32\cmd.exe
                                                          "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\oxTQ808hvM.bat"
                                                          20⤵
                                                            PID:3380
                                                            • C:\Windows\system32\w32tm.exe
                                                              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                              21⤵
                                                                PID:4876
                                                              • C:\providercommon\conhost.exe
                                                                "C:\providercommon\conhost.exe"
                                                                21⤵
                                                                • Checks computer location settings
                                                                • Executes dropped EXE
                                                                • Modifies registry class
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:2764
                                                                • C:\Windows\System32\cmd.exe
                                                                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\m1RNSv4oba.bat"
                                                                  22⤵
                                                                    PID:540
                                                                    • C:\Windows\system32\w32tm.exe
                                                                      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                      23⤵
                                                                        PID:3644
                                                                      • C:\providercommon\conhost.exe
                                                                        "C:\providercommon\conhost.exe"
                                                                        23⤵
                                                                        • Checks computer location settings
                                                                        • Executes dropped EXE
                                                                        • Modifies registry class
                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        PID:4020
                                                                        • C:\Windows\System32\cmd.exe
                                                                          "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\9minE9DcLk.bat"
                                                                          24⤵
                                                                            PID:5068
                                                                            • C:\Windows\system32\w32tm.exe
                                                                              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                              25⤵
                                                                                PID:536
                                                                              • C:\providercommon\conhost.exe
                                                                                "C:\providercommon\conhost.exe"
                                                                                25⤵
                                                                                • Checks computer location settings
                                                                                • Executes dropped EXE
                                                                                • Modifies registry class
                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                PID:1616
                                                                                • C:\Windows\System32\cmd.exe
                                                                                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\tpXWVAFTZv.bat"
                                                                                  26⤵
                                                                                    PID:4032
                                                                                    • C:\Windows\system32\w32tm.exe
                                                                                      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                      27⤵
                                                                                        PID:1016
                                                                                      • C:\providercommon\conhost.exe
                                                                                        "C:\providercommon\conhost.exe"
                                                                                        27⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        PID:3164
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "servicess" /sc MINUTE /mo 11 /tr "'C:\Windows\security\audit\services.exe'" /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Scheduled Task/Job: Scheduled Task
                                    PID:3076
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Windows\security\audit\services.exe'" /rl HIGHEST /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Scheduled Task/Job: Scheduled Task
                                    PID:1616
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "servicess" /sc MINUTE /mo 12 /tr "'C:\Windows\security\audit\services.exe'" /rl HIGHEST /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Scheduled Task/Job: Scheduled Task
                                    PID:4244
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\explorer.exe'" /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Scheduled Task/Job: Scheduled Task
                                    PID:2804
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\explorer.exe'" /rl HIGHEST /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Scheduled Task/Job: Scheduled Task
                                    PID:4588
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\explorer.exe'" /rl HIGHEST /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Scheduled Task/Job: Scheduled Task
                                    PID:1992
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Common Files\System\fr-FR\TextInputHost.exe'" /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Scheduled Task/Job: Scheduled Task
                                    PID:3100
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\System\fr-FR\TextInputHost.exe'" /rl HIGHEST /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Scheduled Task/Job: Scheduled Task
                                    PID:3156
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Common Files\System\fr-FR\TextInputHost.exe'" /rl HIGHEST /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Scheduled Task/Job: Scheduled Task
                                    PID:4144
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Photo Viewer\it-IT\spoolsv.exe'" /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Scheduled Task/Job: Scheduled Task
                                    PID:2900
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\it-IT\spoolsv.exe'" /rl HIGHEST /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Scheduled Task/Job: Scheduled Task
                                    PID:2436
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Photo Viewer\it-IT\spoolsv.exe'" /rl HIGHEST /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Scheduled Task/Job: Scheduled Task
                                    PID:1624
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "smsss" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Multimedia Platform\smss.exe'" /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Scheduled Task/Job: Scheduled Task
                                    PID:2944
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files\Windows Multimedia Platform\smss.exe'" /rl HIGHEST /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Scheduled Task/Job: Scheduled Task
                                    PID:3152
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "smsss" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Multimedia Platform\smss.exe'" /rl HIGHEST /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Scheduled Task/Job: Scheduled Task
                                    PID:2544
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 10 /tr "'C:\providercommon\conhost.exe'" /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Scheduled Task/Job: Scheduled Task
                                    PID:2904
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\providercommon\conhost.exe'" /rl HIGHEST /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Scheduled Task/Job: Scheduled Task
                                    PID:4028
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 14 /tr "'C:\providercommon\conhost.exe'" /rl HIGHEST /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Scheduled Task/Job: Scheduled Task
                                    PID:3520
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "explorere" /sc MINUTE /mo 5 /tr "'C:\Windows\CbsTemp\explorer.exe'" /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Scheduled Task/Job: Scheduled Task
                                    PID:1464
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\CbsTemp\explorer.exe'" /rl HIGHEST /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Scheduled Task/Job: Scheduled Task
                                    PID:3236
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\Windows\CbsTemp\explorer.exe'" /rl HIGHEST /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Scheduled Task/Job: Scheduled Task
                                    PID:3680
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\wininit.exe'" /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Scheduled Task/Job: Scheduled Task
                                    PID:1376
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\wininit.exe'" /rl HIGHEST /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Scheduled Task/Job: Scheduled Task
                                    PID:3272
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\wininit.exe'" /rl HIGHEST /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Scheduled Task/Job: Scheduled Task
                                    PID:3676

                                  Network

                                        MITRE ATT&CK Enterprise v15

                                        Replay Monitor

                                        Loading Replay Monitor...

                                        Downloads

                                        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\conhost.exe.log

                                          Filesize

                                          1KB

                                          MD5

                                          baf55b95da4a601229647f25dad12878

                                          SHA1

                                          abc16954ebfd213733c4493fc1910164d825cac8

                                          SHA256

                                          ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

                                          SHA512

                                          24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

                                        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                          Filesize

                                          2KB

                                          MD5

                                          d85ba6ff808d9e5444a4b369f5bc2730

                                          SHA1

                                          31aa9d96590fff6981b315e0b391b575e4c0804a

                                          SHA256

                                          84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                          SHA512

                                          8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                          Filesize

                                          944B

                                          MD5

                                          2e907f77659a6601fcc408274894da2e

                                          SHA1

                                          9f5b72abef1cd7145bf37547cdb1b9254b4efe9d

                                          SHA256

                                          385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233

                                          SHA512

                                          34fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721

                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                          Filesize

                                          944B

                                          MD5

                                          cadef9abd087803c630df65264a6c81c

                                          SHA1

                                          babbf3636c347c8727c35f3eef2ee643dbcc4bd2

                                          SHA256

                                          cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

                                          SHA512

                                          7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                          Filesize

                                          944B

                                          MD5

                                          62623d22bd9e037191765d5083ce16a3

                                          SHA1

                                          4a07da6872672f715a4780513d95ed8ddeefd259

                                          SHA256

                                          95d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010

                                          SHA512

                                          9a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992

                                        • C:\Users\Admin\AppData\Local\Temp\7hZg3igX7v.bat

                                          Filesize

                                          194B

                                          MD5

                                          270162444fdc5e4dc7a952c9cde14e08

                                          SHA1

                                          66cbe2c029a20e1dc6f4e89a7d739648a6b4fc53

                                          SHA256

                                          43255271a31471dbef19f9405fb16398113ba115ffae1b66dd9a45dccbde31ff

                                          SHA512

                                          4be304e7f3322a7088ede2a2401b101b355458d0d34368e2302c4c72b564a9d8bd51e900b3aa72927ea7c9d87fc116e310b31488119a65d3928f2621295e6d6f

                                        • C:\Users\Admin\AppData\Local\Temp\9minE9DcLk.bat

                                          Filesize

                                          194B

                                          MD5

                                          286c235ba7d5a29c868b6856173d38e6

                                          SHA1

                                          bb2230127f6a1e571675e82e28017ca3ef1de8da

                                          SHA256

                                          34a3f5a74f122d92897509e9fbd49936a252799938dc07bc02fb7d2dd4626091

                                          SHA512

                                          dbafa17cca1b91b5253b23d007044f9af826b804955f0f927b71c29bcef1e250b4330378d01168a64dee7f3f3f2c733b0d168f4eff858cad802163c9fe331081

                                        • C:\Users\Admin\AppData\Local\Temp\HcCr6nEVp7.bat

                                          Filesize

                                          194B

                                          MD5

                                          2ce6fe662832cdddcbbdff44646414f8

                                          SHA1

                                          d6f427689a6ba957bc1ce9318d6b76a9241dab07

                                          SHA256

                                          5cb36ddbab6d9a2a6168164675e507438c053f732d1340c451c8b9dfc6099612

                                          SHA512

                                          92d59d853898b7bfaeda3194221439fc0f3068c25d7145adb894e06d3af6275c09c0357beb45575ced9695c9c6560354863ba99f398b34a7a55e467352d6cdc0

                                        • C:\Users\Admin\AppData\Local\Temp\KYEunsIO9t.bat

                                          Filesize

                                          194B

                                          MD5

                                          1a3d939ba875788b3431eb0faeca2d14

                                          SHA1

                                          b50668667fd84d02a0533f658e3650dba92c2fe1

                                          SHA256

                                          a007b2ad26e815356dcd48375eb211327a33aa80880b6fafc6f7f41a07d5e8db

                                          SHA512

                                          d772fec4819e34f0e3fccaedf2ae45f18201b52018358d5ff3794aac7b8b57fbbe59a8894b958092986eabfaa991b2d9e777c679f044a882593cf325c1816063

                                        • C:\Users\Admin\AppData\Local\Temp\QUR8LTwG0H.bat

                                          Filesize

                                          194B

                                          MD5

                                          279ad3a80809c8181ed38dc009eb1302

                                          SHA1

                                          7ac6aa57f3e91e5898beb0dc2d2fbed2e99d1d25

                                          SHA256

                                          bc526d51eb6d14806a6a0cb2e73b025fe2f4f3af15695ba42b96cc3a334ad273

                                          SHA512

                                          0e8568a08c00f1ffb192643b4617419983edaa3585d71202e982cdf6e7ffbd9d1098253b4430898052c0f4bacdb1c232f680d39c64f09047ff3256890741a7d7

                                        • C:\Users\Admin\AppData\Local\Temp\YKuCD7w8Ue.bat

                                          Filesize

                                          194B

                                          MD5

                                          980d79a212b8efcc13ae73aa20079ce7

                                          SHA1

                                          d6bdc0b686d0a38ef435db1e059285779f76ff4f

                                          SHA256

                                          83abf9d29084236a0bd7e3119dfd9ca811f44fc3ebab42af53c8fd52a4e61b7d

                                          SHA512

                                          4250f38a256895da99858575cf21e2680b846d8dcf3e79af9d879b535a47f66a277dc8b5d39738658542a006a33e7847773e92782e6b3f762a95c41c5b9e16f2

                                        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kkx41dvg.lvn.ps1

                                          Filesize

                                          60B

                                          MD5

                                          d17fe0a3f47be24a6453e9ef58c94641

                                          SHA1

                                          6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                          SHA256

                                          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                          SHA512

                                          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                        • C:\Users\Admin\AppData\Local\Temp\jFXOGCU6Cq.bat

                                          Filesize

                                          194B

                                          MD5

                                          ae384fb1482269377812c3e1882b2cb1

                                          SHA1

                                          0577182c38e2b1c9ee27a9fde67678d30d6cbc75

                                          SHA256

                                          cc7c052f4ee57918058d69dbf0212bdacef0f2decf41aebd4a8fb2dd0b253eaf

                                          SHA512

                                          849885aebbf0e521b2b1fa6b35478bfeac77ad58ce7e19a74640fb0e47afea735fa7c459fefcdd193fcfcadccd9074f043ca27ba4f77422af3c4f1990985fd2c

                                        • C:\Users\Admin\AppData\Local\Temp\m1RNSv4oba.bat

                                          Filesize

                                          194B

                                          MD5

                                          16c6331c595996aa5dad7afafca4931b

                                          SHA1

                                          d96e8c86859d2e5096d3456e307f120b26aed0f6

                                          SHA256

                                          58407d15ca525e5d0152a101f422df4004efe8635d62e2cf6b56792fba1e874c

                                          SHA512

                                          ffc74b170132486cb062e86b241cfe110e0eac1a08770ebb81dcc0c61b182296223d8fa95304aa09dfbb3cf036c94150e0f9e2ea78c9218453e8b01bf4d861c1

                                        • C:\Users\Admin\AppData\Local\Temp\oxTQ808hvM.bat

                                          Filesize

                                          194B

                                          MD5

                                          ab3a016fe579f0fa0fc91cb3dae5d0f5

                                          SHA1

                                          f86899db7fe2183c02ed1d2f8878de0c4c4a9b87

                                          SHA256

                                          1b7074ac3d537e9bccdfb70e08f1209012c0f503e2b2688e6092cf4a4110dd58

                                          SHA512

                                          ea7c513853298186ad5f0896689b3b88357b0ea180927187449696003764a8a77f4b8d257861c8aa6e21e6af574601cbc95a6292868ae8ec7d794681f50705a3

                                        • C:\Users\Admin\AppData\Local\Temp\tpXWVAFTZv.bat

                                          Filesize

                                          194B

                                          MD5

                                          4227dae00cead819ccd068d52feed121

                                          SHA1

                                          6cf220ad3b4f5fa989f0a7d2039fb16efab9e154

                                          SHA256

                                          c6441d4a49cd406d71dcb17687cc6cdef61c17053177dfa49008548110293389

                                          SHA512

                                          30cc362b897d2c9c330d5a4e786ee387e7ab74f56f9ca7187af22220da3836b6dc0254aa9228ff3c2e98b79ba38e49c338a2cf4ef0d2d8dcf3d1ef887e2e2f2a

                                        • C:\providercommon\1zu9dW.bat

                                          Filesize

                                          36B

                                          MD5

                                          6783c3ee07c7d151ceac57f1f9c8bed7

                                          SHA1

                                          17468f98f95bf504cc1f83c49e49a78526b3ea03

                                          SHA256

                                          8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

                                          SHA512

                                          c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

                                        • C:\providercommon\DllCommonsvc.exe

                                          Filesize

                                          1.0MB

                                          MD5

                                          bd31e94b4143c4ce49c17d3af46bcad0

                                          SHA1

                                          f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                          SHA256

                                          b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                          SHA512

                                          f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                        • C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

                                          Filesize

                                          197B

                                          MD5

                                          8088241160261560a02c84025d107592

                                          SHA1

                                          083121f7027557570994c9fc211df61730455bb5

                                          SHA256

                                          2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

                                          SHA512

                                          20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

                                        • memory/3324-154-0x0000000001A30000-0x0000000001A42000-memory.dmp

                                          Filesize

                                          72KB

                                        • memory/4020-204-0x00000000024C0000-0x00000000024D2000-memory.dmp

                                          Filesize

                                          72KB

                                        • memory/4420-167-0x0000000000D80000-0x0000000000D92000-memory.dmp

                                          Filesize

                                          72KB

                                        • memory/4992-54-0x00000166EF380000-0x00000166EF3A2000-memory.dmp

                                          Filesize

                                          136KB

                                        • memory/5116-17-0x000000001B7F0000-0x000000001B7FC000-memory.dmp

                                          Filesize

                                          48KB

                                        • memory/5116-16-0x000000001B6D0000-0x000000001B6DC000-memory.dmp

                                          Filesize

                                          48KB

                                        • memory/5116-15-0x000000001B6C0000-0x000000001B6CC000-memory.dmp

                                          Filesize

                                          48KB

                                        • memory/5116-14-0x000000001B6B0000-0x000000001B6C2000-memory.dmp

                                          Filesize

                                          72KB

                                        • memory/5116-13-0x0000000000AB0000-0x0000000000BC0000-memory.dmp

                                          Filesize

                                          1.1MB

                                        • memory/5116-12-0x00007FFFFDBF3000-0x00007FFFFDBF5000-memory.dmp

                                          Filesize

                                          8KB