Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2024, 02:34
Behavioral task
behavioral1
Sample
JaffaCakes118_cd2d9319ab9fd432fb58d195688ced06a6512d62dc6bf351b18b28653b9e883d.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_cd2d9319ab9fd432fb58d195688ced06a6512d62dc6bf351b18b28653b9e883d.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_cd2d9319ab9fd432fb58d195688ced06a6512d62dc6bf351b18b28653b9e883d.exe
-
Size
1.3MB
-
MD5
261c3f1e4b8be79a0fff991a0f1e90bf
-
SHA1
80c3f2f9cd8ed8622239ea802bb322c46530549e
-
SHA256
cd2d9319ab9fd432fb58d195688ced06a6512d62dc6bf351b18b28653b9e883d
-
SHA512
3287f2186ef49c89b015395dcc5f7e32058099aeb1cc09f054412dd46b29f5d9186acda2d94eadfbb16854f685b5d0870e6dcd5f28451a8f0e58e501cd4ea0f8
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Process spawned unexpected child process 33 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2676 5048 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1836 5048 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4692 5048 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4956 5048 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2320 5048 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4836 5048 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1728 5048 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2988 5048 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1808 5048 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4968 5048 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4948 5048 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4916 5048 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3672 5048 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4508 5048 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4512 5048 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2044 5048 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3808 5048 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 452 5048 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1972 5048 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 856 5048 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2020 5048 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4708 5048 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1232 5048 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2956 5048 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1528 5048 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1608 5048 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 728 5048 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3144 5048 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1944 5048 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4548 5048 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 904 5048 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4788 5048 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2668 5048 schtasks.exe 86 -
resource yara_rule behavioral2/files/0x0007000000023c89-10.dat dcrat behavioral2/memory/4536-13-0x0000000000FE0000-0x00000000010F0000-memory.dmp dcrat -
Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 3544 powershell.exe 1044 powershell.exe 3304 powershell.exe 4340 powershell.exe 4640 powershell.exe 4224 powershell.exe 4864 powershell.exe 4492 powershell.exe 1344 powershell.exe 3060 powershell.exe 3640 powershell.exe 1012 powershell.exe -
Checks computer location settings 2 TTPs 15 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation JaffaCakes118_cd2d9319ab9fd432fb58d195688ced06a6512d62dc6bf351b18b28653b9e883d.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation winlogon.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation winlogon.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation winlogon.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation winlogon.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation winlogon.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation winlogon.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation DllCommonsvc.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation winlogon.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation winlogon.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation winlogon.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation winlogon.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation winlogon.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation winlogon.exe -
Executes dropped EXE 14 IoCs
pid Process 4536 DllCommonsvc.exe 1772 winlogon.exe 552 winlogon.exe 1388 winlogon.exe 4368 winlogon.exe 5092 winlogon.exe 4268 winlogon.exe 4220 winlogon.exe 636 winlogon.exe 1736 winlogon.exe 2400 winlogon.exe 3576 winlogon.exe 4948 winlogon.exe 4408 winlogon.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 13 IoCs
flow ioc 18 raw.githubusercontent.com 19 raw.githubusercontent.com 47 raw.githubusercontent.com 48 raw.githubusercontent.com 57 raw.githubusercontent.com 28 raw.githubusercontent.com 42 raw.githubusercontent.com 43 raw.githubusercontent.com 49 raw.githubusercontent.com 56 raw.githubusercontent.com 58 raw.githubusercontent.com 59 raw.githubusercontent.com 60 raw.githubusercontent.com -
Drops file in Program Files directory 8 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\unsecapp.exe DllCommonsvc.exe File created C:\Program Files\Microsoft Office\29c1c3cc0f7685 DllCommonsvc.exe File created C:\Program Files\Windows Security\BrowserCore\en-US\explorer.exe DllCommonsvc.exe File created C:\Program Files\Windows Security\BrowserCore\en-US\7a0fd90576e088 DllCommonsvc.exe File created C:\Program Files\MSBuild\Microsoft\explorer.exe DllCommonsvc.exe File created C:\Program Files\MSBuild\Microsoft\7a0fd90576e088 DllCommonsvc.exe File created C:\Program Files\Windows NT\TableTextService\en-US\OfficeClickToRun.exe DllCommonsvc.exe File created C:\Program Files\Windows NT\TableTextService\en-US\e6c9b481da804f DllCommonsvc.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\IdentityCRL\production\conhost.exe DllCommonsvc.exe File created C:\Windows\IdentityCRL\production\088424020bedd6 DllCommonsvc.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.ConfigCI.Commands\fontdrvhost.exe DllCommonsvc.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.ConfigCI.Commands\5b884080fd4f94 DllCommonsvc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_cd2d9319ab9fd432fb58d195688ced06a6512d62dc6bf351b18b28653b9e883d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies registry class 13 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings winlogon.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings JaffaCakes118_cd2d9319ab9fd432fb58d195688ced06a6512d62dc6bf351b18b28653b9e883d.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings winlogon.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings winlogon.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings winlogon.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings winlogon.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings winlogon.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings winlogon.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings winlogon.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings winlogon.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings winlogon.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings winlogon.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings winlogon.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 33 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3808 schtasks.exe 2020 schtasks.exe 4708 schtasks.exe 1608 schtasks.exe 728 schtasks.exe 4968 schtasks.exe 4508 schtasks.exe 452 schtasks.exe 1232 schtasks.exe 4956 schtasks.exe 2320 schtasks.exe 4548 schtasks.exe 4788 schtasks.exe 2668 schtasks.exe 2988 schtasks.exe 1944 schtasks.exe 2956 schtasks.exe 3144 schtasks.exe 904 schtasks.exe 3672 schtasks.exe 4512 schtasks.exe 1808 schtasks.exe 4916 schtasks.exe 1972 schtasks.exe 856 schtasks.exe 2676 schtasks.exe 4692 schtasks.exe 1528 schtasks.exe 4836 schtasks.exe 1728 schtasks.exe 1836 schtasks.exe 2044 schtasks.exe 4948 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4536 DllCommonsvc.exe 4536 DllCommonsvc.exe 4536 DllCommonsvc.exe 4536 DllCommonsvc.exe 4536 DllCommonsvc.exe 4536 DllCommonsvc.exe 4536 DllCommonsvc.exe 4536 DllCommonsvc.exe 4536 DllCommonsvc.exe 4536 DllCommonsvc.exe 4536 DllCommonsvc.exe 4536 DllCommonsvc.exe 4536 DllCommonsvc.exe 4536 DllCommonsvc.exe 4536 DllCommonsvc.exe 4536 DllCommonsvc.exe 4536 DllCommonsvc.exe 4536 DllCommonsvc.exe 4536 DllCommonsvc.exe 4536 DllCommonsvc.exe 4536 DllCommonsvc.exe 4536 DllCommonsvc.exe 4536 DllCommonsvc.exe 4536 DllCommonsvc.exe 3640 powershell.exe 3640 powershell.exe 1044 powershell.exe 1044 powershell.exe 4224 powershell.exe 4224 powershell.exe 4340 powershell.exe 4340 powershell.exe 4492 powershell.exe 4492 powershell.exe 1012 powershell.exe 1012 powershell.exe 4864 powershell.exe 4864 powershell.exe 1344 powershell.exe 1344 powershell.exe 3304 powershell.exe 3304 powershell.exe 4640 powershell.exe 4640 powershell.exe 3060 powershell.exe 3060 powershell.exe 3544 powershell.exe 3544 powershell.exe 3304 powershell.exe 1772 winlogon.exe 1772 winlogon.exe 1044 powershell.exe 4864 powershell.exe 4224 powershell.exe 4492 powershell.exe 3640 powershell.exe 1344 powershell.exe 4340 powershell.exe 1012 powershell.exe 3060 powershell.exe 3544 powershell.exe 4640 powershell.exe 552 winlogon.exe 1388 winlogon.exe -
Suspicious use of AdjustPrivilegeToken 26 IoCs
description pid Process Token: SeDebugPrivilege 4536 DllCommonsvc.exe Token: SeDebugPrivilege 1044 powershell.exe Token: SeDebugPrivilege 3640 powershell.exe Token: SeDebugPrivilege 4224 powershell.exe Token: SeDebugPrivilege 4340 powershell.exe Token: SeDebugPrivilege 3304 powershell.exe Token: SeDebugPrivilege 4492 powershell.exe Token: SeDebugPrivilege 1012 powershell.exe Token: SeDebugPrivilege 4864 powershell.exe Token: SeDebugPrivilege 1344 powershell.exe Token: SeDebugPrivilege 4640 powershell.exe Token: SeDebugPrivilege 3060 powershell.exe Token: SeDebugPrivilege 1772 winlogon.exe Token: SeDebugPrivilege 3544 powershell.exe Token: SeDebugPrivilege 552 winlogon.exe Token: SeDebugPrivilege 1388 winlogon.exe Token: SeDebugPrivilege 4368 winlogon.exe Token: SeDebugPrivilege 5092 winlogon.exe Token: SeDebugPrivilege 4268 winlogon.exe Token: SeDebugPrivilege 4220 winlogon.exe Token: SeDebugPrivilege 636 winlogon.exe Token: SeDebugPrivilege 1736 winlogon.exe Token: SeDebugPrivilege 2400 winlogon.exe Token: SeDebugPrivilege 3576 winlogon.exe Token: SeDebugPrivilege 4948 winlogon.exe Token: SeDebugPrivilege 4408 winlogon.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2448 wrote to memory of 1288 2448 JaffaCakes118_cd2d9319ab9fd432fb58d195688ced06a6512d62dc6bf351b18b28653b9e883d.exe 82 PID 2448 wrote to memory of 1288 2448 JaffaCakes118_cd2d9319ab9fd432fb58d195688ced06a6512d62dc6bf351b18b28653b9e883d.exe 82 PID 2448 wrote to memory of 1288 2448 JaffaCakes118_cd2d9319ab9fd432fb58d195688ced06a6512d62dc6bf351b18b28653b9e883d.exe 82 PID 1288 wrote to memory of 1832 1288 WScript.exe 83 PID 1288 wrote to memory of 1832 1288 WScript.exe 83 PID 1288 wrote to memory of 1832 1288 WScript.exe 83 PID 1832 wrote to memory of 4536 1832 cmd.exe 85 PID 1832 wrote to memory of 4536 1832 cmd.exe 85 PID 4536 wrote to memory of 4224 4536 DllCommonsvc.exe 120 PID 4536 wrote to memory of 4224 4536 DllCommonsvc.exe 120 PID 4536 wrote to memory of 4864 4536 DllCommonsvc.exe 121 PID 4536 wrote to memory of 4864 4536 DllCommonsvc.exe 121 PID 4536 wrote to memory of 3544 4536 DllCommonsvc.exe 122 PID 4536 wrote to memory of 3544 4536 DllCommonsvc.exe 122 PID 4536 wrote to memory of 3640 4536 DllCommonsvc.exe 123 PID 4536 wrote to memory of 3640 4536 DllCommonsvc.exe 123 PID 4536 wrote to memory of 1044 4536 DllCommonsvc.exe 124 PID 4536 wrote to memory of 1044 4536 DllCommonsvc.exe 124 PID 4536 wrote to memory of 3304 4536 DllCommonsvc.exe 125 PID 4536 wrote to memory of 3304 4536 DllCommonsvc.exe 125 PID 4536 wrote to memory of 1012 4536 DllCommonsvc.exe 126 PID 4536 wrote to memory of 1012 4536 DllCommonsvc.exe 126 PID 4536 wrote to memory of 4492 4536 DllCommonsvc.exe 127 PID 4536 wrote to memory of 4492 4536 DllCommonsvc.exe 127 PID 4536 wrote to memory of 1344 4536 DllCommonsvc.exe 128 PID 4536 wrote to memory of 1344 4536 DllCommonsvc.exe 128 PID 4536 wrote to memory of 4340 4536 DllCommonsvc.exe 129 PID 4536 wrote to memory of 4340 4536 DllCommonsvc.exe 129 PID 4536 wrote to memory of 3060 4536 DllCommonsvc.exe 130 PID 4536 wrote to memory of 3060 4536 DllCommonsvc.exe 130 PID 4536 wrote to memory of 4640 4536 DllCommonsvc.exe 131 PID 4536 wrote to memory of 4640 4536 DllCommonsvc.exe 131 PID 4536 wrote to memory of 1772 4536 DllCommonsvc.exe 143 PID 4536 wrote to memory of 1772 4536 DllCommonsvc.exe 143 PID 1772 wrote to memory of 2044 1772 winlogon.exe 148 PID 1772 wrote to memory of 2044 1772 winlogon.exe 148 PID 2044 wrote to memory of 1972 2044 cmd.exe 150 PID 2044 wrote to memory of 1972 2044 cmd.exe 150 PID 2044 wrote to memory of 552 2044 cmd.exe 154 PID 2044 wrote to memory of 552 2044 cmd.exe 154 PID 552 wrote to memory of 1944 552 winlogon.exe 156 PID 552 wrote to memory of 1944 552 winlogon.exe 156 PID 1944 wrote to memory of 2412 1944 cmd.exe 158 PID 1944 wrote to memory of 2412 1944 cmd.exe 158 PID 1944 wrote to memory of 1388 1944 cmd.exe 160 PID 1944 wrote to memory of 1388 1944 cmd.exe 160 PID 1388 wrote to memory of 3568 1388 winlogon.exe 161 PID 1388 wrote to memory of 3568 1388 winlogon.exe 161 PID 3568 wrote to memory of 216 3568 cmd.exe 163 PID 3568 wrote to memory of 216 3568 cmd.exe 163 PID 3568 wrote to memory of 4368 3568 cmd.exe 164 PID 3568 wrote to memory of 4368 3568 cmd.exe 164 PID 4368 wrote to memory of 1804 4368 winlogon.exe 165 PID 4368 wrote to memory of 1804 4368 winlogon.exe 165 PID 1804 wrote to memory of 4744 1804 cmd.exe 167 PID 1804 wrote to memory of 4744 1804 cmd.exe 167 PID 1804 wrote to memory of 5092 1804 cmd.exe 168 PID 1804 wrote to memory of 5092 1804 cmd.exe 168 PID 5092 wrote to memory of 4764 5092 winlogon.exe 169 PID 5092 wrote to memory of 4764 5092 winlogon.exe 169 PID 4764 wrote to memory of 380 4764 cmd.exe 171 PID 4764 wrote to memory of 380 4764 cmd.exe 171 PID 4764 wrote to memory of 4268 4764 cmd.exe 172 PID 4764 wrote to memory of 4268 4764 cmd.exe 172 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_cd2d9319ab9fd432fb58d195688ced06a6512d62dc6bf351b18b28653b9e883d.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_cd2d9319ab9fd432fb58d195688ced06a6512d62dc6bf351b18b28653b9e883d.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\providercommon\DllCommonsvc.exe"C:\providercommon\DllCommonsvc.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4224
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\winlogon.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4864
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\winlogon.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3544
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\winlogon.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3640
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows NT\TableTextService\en-US\OfficeClickToRun.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1044
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Microsoft Office\unsecapp.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3304
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\IdentityCRL\production\conhost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1012
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.ConfigCI.Commands\fontdrvhost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4492
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\fontdrvhost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1344
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\WindowsHolographicDevices\TextInputHost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4340
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Security\BrowserCore\en-US\explorer.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3060
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\MSBuild\Microsoft\explorer.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4640
-
-
C:\Recovery\WindowsRE\winlogon.exe"C:\Recovery\WindowsRE\winlogon.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1772 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ZAtO29mfgG.bat"6⤵
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:27⤵PID:1972
-
-
C:\Recovery\WindowsRE\winlogon.exe"C:\Recovery\WindowsRE\winlogon.exe"7⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\m1XclINWiF.bat"8⤵
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:29⤵PID:2412
-
-
C:\Recovery\WindowsRE\winlogon.exe"C:\Recovery\WindowsRE\winlogon.exe"9⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\2Odt5WJZ2f.bat"10⤵
- Suspicious use of WriteProcessMemory
PID:3568 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:211⤵PID:216
-
-
C:\Recovery\WindowsRE\winlogon.exe"C:\Recovery\WindowsRE\winlogon.exe"11⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\cxnNEsMM51.bat"12⤵
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:213⤵PID:4744
-
-
C:\Recovery\WindowsRE\winlogon.exe"C:\Recovery\WindowsRE\winlogon.exe"13⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\msQYHxuKnC.bat"14⤵
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:215⤵PID:380
-
-
C:\Recovery\WindowsRE\winlogon.exe"C:\Recovery\WindowsRE\winlogon.exe"15⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4268 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\LIqDUaLb8G.bat"16⤵PID:4932
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:217⤵PID:3980
-
-
C:\Recovery\WindowsRE\winlogon.exe"C:\Recovery\WindowsRE\winlogon.exe"17⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4220 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\j5VZ5DKdOS.bat"18⤵PID:432
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:219⤵PID:2564
-
-
C:\Recovery\WindowsRE\winlogon.exe"C:\Recovery\WindowsRE\winlogon.exe"19⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:636 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\xm2kK1SIVO.bat"20⤵PID:2180
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:221⤵PID:3988
-
-
C:\Recovery\WindowsRE\winlogon.exe"C:\Recovery\WindowsRE\winlogon.exe"21⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1736 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\HHf3c4kdaf.bat"22⤵PID:4816
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:223⤵PID:460
-
-
C:\Recovery\WindowsRE\winlogon.exe"C:\Recovery\WindowsRE\winlogon.exe"23⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2400 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ANE2RWndQ4.bat"24⤵PID:2552
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:225⤵PID:4552
-
-
C:\Recovery\WindowsRE\winlogon.exe"C:\Recovery\WindowsRE\winlogon.exe"25⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3576 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\9dhy3B39XM.bat"26⤵PID:3460
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:227⤵PID:392
-
-
C:\Recovery\WindowsRE\winlogon.exe"C:\Recovery\WindowsRE\winlogon.exe"27⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4948 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\yXZnhMCmO6.bat"28⤵PID:4984
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:229⤵PID:1324
-
-
C:\Recovery\WindowsRE\winlogon.exe"C:\Recovery\WindowsRE\winlogon.exe"29⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4408
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2676
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1836
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4692
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4956
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2320
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4836
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1728
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2988
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1808
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows NT\TableTextService\en-US\OfficeClickToRun.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4968
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files\Windows NT\TableTextService\en-US\OfficeClickToRun.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4948
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows NT\TableTextService\en-US\OfficeClickToRun.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4916
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 13 /tr "'C:\Program Files\Microsoft Office\unsecapp.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3672
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\unsecapp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4508
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 8 /tr "'C:\Program Files\Microsoft Office\unsecapp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4512
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 12 /tr "'C:\Windows\IdentityCRL\production\conhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2044
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Windows\IdentityCRL\production\conhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3808
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\Windows\IdentityCRL\production\conhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:452
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.ConfigCI.Commands\fontdrvhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1972
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.ConfigCI.Commands\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:856
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.ConfigCI.Commands\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2020
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\providercommon\fontdrvhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4708
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\providercommon\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1232
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\providercommon\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2956
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\WindowsHolographicDevices\TextInputHost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1528
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Users\All Users\WindowsHolographicDevices\TextInputHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1608
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\WindowsHolographicDevices\TextInputHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:728
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\explorer.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3144
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1944
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4548
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\Program Files\MSBuild\Microsoft\explorer.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:904
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files\MSBuild\Microsoft\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4788
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\Program Files\MSBuild\Microsoft\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2668
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
1KB
MD5baf55b95da4a601229647f25dad12878
SHA1abc16954ebfd213733c4493fc1910164d825cac8
SHA256ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
SHA51224f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545
-
Filesize
944B
MD56c47b3f4e68eebd47e9332eebfd2dd4e
SHA167f0b143336d7db7b281ed3de5e877fa87261834
SHA2568c48b1f2338e5b24094821f41121d2221f1cb3200338f46df49f64d1c4bc3e0c
SHA5120acf302a9fc971ef9df65ed42c47ea17828e54dff685f4434f360556fd27cdc26a75069f00dcdc14ba174893c6fd7a2cfd8c6c07be3ce35dafee0a006914eaca
-
Filesize
944B
MD5bd5940f08d0be56e65e5f2aaf47c538e
SHA1d7e31b87866e5e383ab5499da64aba50f03e8443
SHA2562d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6
SHA512c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406
-
Filesize
944B
MD5cadef9abd087803c630df65264a6c81c
SHA1babbf3636c347c8727c35f3eef2ee643dbcc4bd2
SHA256cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438
SHA5127278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085
-
Filesize
944B
MD52979eabc783eaca50de7be23dd4eafcf
SHA1d709ce5f3a06b7958a67e20870bfd95b83cad2ea
SHA256006cca90e78fbb571532a83082ac6712721a34ea4b21f490058ffb3f521f4903
SHA51292bc433990572d9427d0c93eef9bd1cc23fa00ed60dd0c9c983d87d3421e02ce3f156c6f88fe916ef6782dbf185cbce083bc0094f8c527f302be6a37d1c53aba
-
Filesize
199B
MD5a09f15fc8cb8a185a298349f86a9b466
SHA1789f234694c0e78e608091c2aa4a325c3822ae4a
SHA2563ac913cf7e236c2d2fc97dd0288df42dbbf14d95df5d63c1c045cb13454b03c7
SHA512316859b56ce5468b14418700c73da9200c87def4685c6a3545701b493191fe4e2c5e603790eb0349175770fd0978274d661bb8c4d403d4595c461ff5320ae171
-
Filesize
199B
MD55e97ae1ce1e4764cbf6ab4ec8583685d
SHA1238b66e0522f7001510b8336324afedc8444a911
SHA256f49485a8048fdd43a6a3de51208ae84ff04104de206ac35154ebeb50fa8a840f
SHA5128f2e425c33fe2be619762163d0dad7866d4273f402bbdcd7b98c61c30a3e0688864bcb25903dfa09e5c1109424ac5b332f50310441d951dfe11363c1725a5825
-
Filesize
199B
MD5e182e7271bb08f306a2986cefb528881
SHA171502092562fde1d89f03add09bbebd49e859d3c
SHA25677ae6b851ac4a714ad10803ef5c7a10022123e12604ecd0db42eb281fef9cae9
SHA512e453314f1f5275157274bae40b8627ad483cc2f14b7b76620bcb2009f814af9781b1739c47d24a9a2d8f8a8b925d2f41d78b50976195ee59f0bc34bd0555a9bb
-
Filesize
199B
MD561d21ab0dbb0145f6a6dc6202389ac1d
SHA1a901a5e0dbfbdb1a6fe65575c5ce4c2a7bc131a7
SHA256805f8be7dbca7d2c4fcd265b338839a90a806c709def447ce491581268311cce
SHA512621aba23eadb41dc369376151f0ac93e6c2c403725192a8ee788f316e4c7f311227f5b00dd82a7c9f9893b9b04b72f7da80f3f8e24c190618386de9d230c8275
-
Filesize
199B
MD526d5a6956061122aa9c73eb14dd183c1
SHA1a7354e53a482cda0f1cadc79b165d0793ef5b581
SHA256dabbeadfebfb7c33b9b97885ab3cb9664cc231fcc7e6c7bb309cbe3b1a63e117
SHA512365d84317957d8b712ae9a89d220a1c37ca7c71ceba48f2da43ff2d6fd6ea35b5dfce279f41c44a6263d43d3387ade5fe067fe1adb277c961af9287575c6f910
-
Filesize
199B
MD5b8fd323f57aa4bb00d0c95355b936ee6
SHA15ea39cb4f072c3f1db347fb39ba42e458c6abf72
SHA25635201efabf434fa59e7e4452669f9d5c716a34619d43b182ea3a16eb03b65d0f
SHA512912260e89884f40ba81bf7527a53c4e0da7c1699cd10917c3b3140eacb670cd495a81c40b0832f6a14dfcce9126473c87582b2698bbfe14b5a1ad8c5975f42a8
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
199B
MD56d6f67bd7c53ad2078b9fd5c80aaba2a
SHA184afdcb389ed90e1b163bc078946d66871130568
SHA2561b20b15999d056ca3daa5c50161d1db3b15a299f21f89ec96a23ab1b6c48aeb9
SHA512681315360638df973fc2ab707b457957fd43363de8f20a30fbca58812baa4523113c17b9c404b85253fa3a6a06f430d8c5d4a785d1bbcc3d926c21d0f64dfe5f
-
Filesize
199B
MD5134376746b54b2b46b9bf64cf9664c13
SHA1eafe12291dba4a617b806277e17dd7d536885eec
SHA256248293fc5b6c393ccf66b84d22292307111200af48e8a41a56757127c24e5548
SHA512092bcc4ccbbaacbbee482ce640eb8b24f3ed7cd98e5af9a5a754da28c28931461b620c1e41d3ed66b5c9e0f80ddb2ae663d2359c2394113bdb35ef9923b86587
-
Filesize
199B
MD5c62a2e51617eda0052040072246c991f
SHA1268ad3d07c283352183040531555d5ac2848a0f4
SHA256bd9ef9e8f85e78a7e8ed28666305c9b9276c78328e2d29e21baf13b1c121ba93
SHA512bfc70e3309f6f7d909c495eb727fcad43920ee45a75ffde41210806abd842408052cc556b2c9127622594e8ee78384861bc8d0dcf685107323bb219d85db5d02
-
Filesize
199B
MD575c53d7b164fa00574ee0bf2a388bfa6
SHA16781f62bacd1f171c6c4fb5d160f2926839d61c5
SHA256e75b8b343b79604ccc54653bf47ec7deba5683fb70716266253ed5e58669a9c9
SHA5120e18d24b2e9673912edd37e4773ce4d1788d646754df69889845a91e3b6069c8a316b2a0240195c422ad6154e219ce4d5f56985bcddec7b8a9b9b2240a274bf1
-
Filesize
199B
MD5d705f53cbae66f2c4a03f73976393109
SHA1c8f0128f5bdb2a3e77d34814018251cd02a7dbc2
SHA256f1acb001161d0491e9b1ff9cac4438ff424ab9e83b55f6f07917afdf54a49ed5
SHA5123068ea8145b71d17b57211da988e2075acc1ec1afbbfdc39e843bfac7a30be0cb987c3f893769d10fa173b26074c0b8fca275ff50b9666474e17c0a9da7aa141
-
Filesize
199B
MD5448962e0b08f404f85dba3339ac0dea6
SHA133a779872561a846df5842b3b6ef024303e6e5bc
SHA256b417b332c0ff48fe89640a5f3a96dd19cb4d0db196f8f743fff68f94a39a2816
SHA5127b14e1effb4ba6896b91cdd9f1d62667907ab523ddbe7f2357db405fd97341815cff0638b85fae230d41831c7173612072b80b8f6cbf00ed1e221feb51fcbaa4
-
Filesize
36B
MD56783c3ee07c7d151ceac57f1f9c8bed7
SHA117468f98f95bf504cc1f83c49e49a78526b3ea03
SHA2568ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322
SHA512c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8
-
Filesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
Filesize
197B
MD58088241160261560a02c84025d107592
SHA1083121f7027557570994c9fc211df61730455bb5
SHA2562072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1
SHA51220d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478