Analysis
-
max time kernel
147s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2024, 02:40
Behavioral task
behavioral1
Sample
JaffaCakes118_85632560897d9596e5f7eb16193e2d94d8208f2b26b1fd8f2ef1d95802674815.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_85632560897d9596e5f7eb16193e2d94d8208f2b26b1fd8f2ef1d95802674815.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_85632560897d9596e5f7eb16193e2d94d8208f2b26b1fd8f2ef1d95802674815.exe
-
Size
1.3MB
-
MD5
d5c604440c132b59058908a0b9e5d914
-
SHA1
116ee355f9e8895c59d2023fc2e597cd44e0dfd7
-
SHA256
85632560897d9596e5f7eb16193e2d94d8208f2b26b1fd8f2ef1d95802674815
-
SHA512
392a9fddf31c71f77d3392c1cad4d9eae63d1d8a87f7ed967d6ad86ac391adbcf6dd6dbd660a8dd014089a9c59a625626b7b48b8a72a296c2a02f95f88c983bd
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Process spawned unexpected child process 54 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3276 388 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2724 388 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3212 388 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2980 388 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1120 388 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4724 388 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3152 388 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4444 388 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3496 388 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4976 388 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4960 388 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1144 388 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1512 388 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4280 388 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2288 388 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2248 388 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3860 388 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4780 388 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1476 388 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3888 388 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1444 388 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1428 388 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4236 388 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 532 388 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4432 388 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3004 388 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2644 388 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4500 388 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3528 388 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2712 388 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4992 388 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5116 388 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1560 388 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4600 388 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4552 388 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4412 388 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3924 388 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2212 388 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1436 388 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4008 388 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2112 388 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1084 388 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4140 388 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1856 388 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3936 388 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4884 388 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4408 388 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1636 388 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4876 388 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4056 388 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2708 388 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4240 388 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4696 388 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3248 388 schtasks.exe 88 -
resource yara_rule behavioral2/files/0x0007000000023c8b-10.dat dcrat behavioral2/memory/4832-13-0x0000000000FF0000-0x0000000001100000-memory.dmp dcrat -
Command and Scripting Interpreter: PowerShell 1 TTPs 19 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 4608 powershell.exe 5020 powershell.exe 2732 powershell.exe 4312 powershell.exe 2088 powershell.exe 1848 powershell.exe 2784 powershell.exe 4048 powershell.exe 848 powershell.exe 1048 powershell.exe 3200 powershell.exe 920 powershell.exe 4128 powershell.exe 5012 powershell.exe 4796 powershell.exe 4260 powershell.exe 2124 powershell.exe 4384 powershell.exe 2688 powershell.exe -
Checks computer location settings 2 TTPs 15 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation sihost.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation sihost.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation sihost.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation sihost.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation sihost.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation sihost.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation sihost.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation DllCommonsvc.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation sihost.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation sihost.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation sihost.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation sihost.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation sihost.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation JaffaCakes118_85632560897d9596e5f7eb16193e2d94d8208f2b26b1fd8f2ef1d95802674815.exe -
Executes dropped EXE 14 IoCs
pid Process 4832 DllCommonsvc.exe 4596 sihost.exe 5740 sihost.exe 1208 sihost.exe 3668 sihost.exe 1084 sihost.exe 4500 sihost.exe 2800 sihost.exe 5708 sihost.exe 5436 sihost.exe 5856 sihost.exe 1040 sihost.exe 2848 sihost.exe 2696 sihost.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 13 IoCs
flow ioc 48 raw.githubusercontent.com 53 raw.githubusercontent.com 55 raw.githubusercontent.com 14 raw.githubusercontent.com 22 raw.githubusercontent.com 39 raw.githubusercontent.com 44 raw.githubusercontent.com 45 raw.githubusercontent.com 13 raw.githubusercontent.com 37 raw.githubusercontent.com 40 raw.githubusercontent.com 54 raw.githubusercontent.com 56 raw.githubusercontent.com -
Drops file in Program Files directory 15 IoCs
description ioc Process File created C:\Program Files (x86)\Windows Portable Devices\5b884080fd4f94 DllCommonsvc.exe File created C:\Program Files\Windows Multimedia Platform\886983d96e3d3e DllCommonsvc.exe File opened for modification C:\Program Files\Windows NT\TableTextService\en-US\System.exe DllCommonsvc.exe File created C:\Program Files\Windows NT\TableTextService\en-US\27d1bcfc3c54e0 DllCommonsvc.exe File created C:\Program Files\Windows Photo Viewer\fr-FR\sihost.exe DllCommonsvc.exe File created C:\Program Files\Windows Photo Viewer\fr-FR\66fc9ff0ee96c2 DllCommonsvc.exe File created C:\Program Files (x86)\Windows Portable Devices\fontdrvhost.exe DllCommonsvc.exe File created C:\Program Files\Windows Multimedia Platform\csrss.exe DllCommonsvc.exe File created C:\Program Files\Windows NT\TableTextService\en-US\System.exe DllCommonsvc.exe File created C:\Program Files (x86)\Internet Explorer\es-ES\ea9f0e6c9e2dcd DllCommonsvc.exe File created C:\Program Files (x86)\Internet Explorer\es-ES\taskhostw.exe DllCommonsvc.exe File created C:\Program Files (x86)\Windows Portable Devices\ea9f0e6c9e2dcd DllCommonsvc.exe File created C:\Program Files\Windows Defender\uk-UA\121e5b5079f7c0 DllCommonsvc.exe File created C:\Program Files (x86)\Windows Portable Devices\taskhostw.exe DllCommonsvc.exe File created C:\Program Files\Windows Defender\uk-UA\sysmon.exe DllCommonsvc.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Globalization\unsecapp.exe DllCommonsvc.exe File created C:\Windows\Globalization\29c1c3cc0f7685 DllCommonsvc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_85632560897d9596e5f7eb16193e2d94d8208f2b26b1fd8f2ef1d95802674815.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies registry class 13 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings sihost.exe Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings JaffaCakes118_85632560897d9596e5f7eb16193e2d94d8208f2b26b1fd8f2ef1d95802674815.exe Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings sihost.exe Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings sihost.exe Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings sihost.exe Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings sihost.exe Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings sihost.exe Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings sihost.exe Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings sihost.exe Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings sihost.exe Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings sihost.exe Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings sihost.exe Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings sihost.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 54 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4444 schtasks.exe 4412 schtasks.exe 2112 schtasks.exe 2288 schtasks.exe 3888 schtasks.exe 1428 schtasks.exe 4008 schtasks.exe 4408 schtasks.exe 1512 schtasks.exe 4780 schtasks.exe 3004 schtasks.exe 1560 schtasks.exe 4884 schtasks.exe 4724 schtasks.exe 1144 schtasks.exe 4280 schtasks.exe 2248 schtasks.exe 4600 schtasks.exe 1084 schtasks.exe 3248 schtasks.exe 3860 schtasks.exe 4236 schtasks.exe 1636 schtasks.exe 3152 schtasks.exe 4432 schtasks.exe 4552 schtasks.exe 3496 schtasks.exe 3528 schtasks.exe 3924 schtasks.exe 2708 schtasks.exe 2644 schtasks.exe 4500 schtasks.exe 5116 schtasks.exe 4056 schtasks.exe 4696 schtasks.exe 3212 schtasks.exe 2712 schtasks.exe 4140 schtasks.exe 1120 schtasks.exe 1436 schtasks.exe 3936 schtasks.exe 1856 schtasks.exe 2724 schtasks.exe 2980 schtasks.exe 4960 schtasks.exe 1476 schtasks.exe 1444 schtasks.exe 532 schtasks.exe 4992 schtasks.exe 4240 schtasks.exe 3276 schtasks.exe 4976 schtasks.exe 2212 schtasks.exe 4876 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4832 DllCommonsvc.exe 4832 DllCommonsvc.exe 4832 DllCommonsvc.exe 4832 DllCommonsvc.exe 4832 DllCommonsvc.exe 4832 DllCommonsvc.exe 4832 DllCommonsvc.exe 4832 DllCommonsvc.exe 4832 DllCommonsvc.exe 4128 powershell.exe 4128 powershell.exe 4048 powershell.exe 4048 powershell.exe 920 powershell.exe 920 powershell.exe 2732 powershell.exe 2732 powershell.exe 2784 powershell.exe 2124 powershell.exe 2784 powershell.exe 2124 powershell.exe 5012 powershell.exe 5012 powershell.exe 4312 powershell.exe 4312 powershell.exe 5020 powershell.exe 5020 powershell.exe 1048 powershell.exe 1048 powershell.exe 3200 powershell.exe 3200 powershell.exe 4260 powershell.exe 4260 powershell.exe 4608 powershell.exe 2088 powershell.exe 4608 powershell.exe 2088 powershell.exe 4796 powershell.exe 4796 powershell.exe 4384 powershell.exe 4384 powershell.exe 2688 powershell.exe 2688 powershell.exe 848 powershell.exe 848 powershell.exe 1848 powershell.exe 1848 powershell.exe 4596 sihost.exe 4596 sihost.exe 2124 powershell.exe 4608 powershell.exe 848 powershell.exe 2784 powershell.exe 4128 powershell.exe 2088 powershell.exe 4312 powershell.exe 4260 powershell.exe 4384 powershell.exe 920 powershell.exe 5012 powershell.exe 5020 powershell.exe 4048 powershell.exe 4048 powershell.exe 4796 powershell.exe -
Suspicious use of AdjustPrivilegeToken 33 IoCs
description pid Process Token: SeDebugPrivilege 4832 DllCommonsvc.exe Token: SeDebugPrivilege 4312 powershell.exe Token: SeDebugPrivilege 4128 powershell.exe Token: SeDebugPrivilege 4796 powershell.exe Token: SeDebugPrivilege 4048 powershell.exe Token: SeDebugPrivilege 2732 powershell.exe Token: SeDebugPrivilege 920 powershell.exe Token: SeDebugPrivilege 2784 powershell.exe Token: SeDebugPrivilege 2124 powershell.exe Token: SeDebugPrivilege 5012 powershell.exe Token: SeDebugPrivilege 4384 powershell.exe Token: SeDebugPrivilege 5020 powershell.exe Token: SeDebugPrivilege 3200 powershell.exe Token: SeDebugPrivilege 1048 powershell.exe Token: SeDebugPrivilege 848 powershell.exe Token: SeDebugPrivilege 4260 powershell.exe Token: SeDebugPrivilege 2688 powershell.exe Token: SeDebugPrivilege 4608 powershell.exe Token: SeDebugPrivilege 2088 powershell.exe Token: SeDebugPrivilege 4596 sihost.exe Token: SeDebugPrivilege 1848 powershell.exe Token: SeDebugPrivilege 5740 sihost.exe Token: SeDebugPrivilege 1208 sihost.exe Token: SeDebugPrivilege 3668 sihost.exe Token: SeDebugPrivilege 1084 sihost.exe Token: SeDebugPrivilege 4500 sihost.exe Token: SeDebugPrivilege 2800 sihost.exe Token: SeDebugPrivilege 5708 sihost.exe Token: SeDebugPrivilege 5436 sihost.exe Token: SeDebugPrivilege 5856 sihost.exe Token: SeDebugPrivilege 1040 sihost.exe Token: SeDebugPrivilege 2848 sihost.exe Token: SeDebugPrivilege 2696 sihost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2100 wrote to memory of 3648 2100 JaffaCakes118_85632560897d9596e5f7eb16193e2d94d8208f2b26b1fd8f2ef1d95802674815.exe 83 PID 2100 wrote to memory of 3648 2100 JaffaCakes118_85632560897d9596e5f7eb16193e2d94d8208f2b26b1fd8f2ef1d95802674815.exe 83 PID 2100 wrote to memory of 3648 2100 JaffaCakes118_85632560897d9596e5f7eb16193e2d94d8208f2b26b1fd8f2ef1d95802674815.exe 83 PID 3648 wrote to memory of 1900 3648 WScript.exe 85 PID 3648 wrote to memory of 1900 3648 WScript.exe 85 PID 3648 wrote to memory of 1900 3648 WScript.exe 85 PID 1900 wrote to memory of 4832 1900 cmd.exe 87 PID 1900 wrote to memory of 4832 1900 cmd.exe 87 PID 4832 wrote to memory of 1848 4832 DllCommonsvc.exe 144 PID 4832 wrote to memory of 1848 4832 DllCommonsvc.exe 144 PID 4832 wrote to memory of 3200 4832 DllCommonsvc.exe 145 PID 4832 wrote to memory of 3200 4832 DllCommonsvc.exe 145 PID 4832 wrote to memory of 4608 4832 DllCommonsvc.exe 146 PID 4832 wrote to memory of 4608 4832 DllCommonsvc.exe 146 PID 4832 wrote to memory of 2784 4832 DllCommonsvc.exe 147 PID 4832 wrote to memory of 2784 4832 DllCommonsvc.exe 147 PID 4832 wrote to memory of 4796 4832 DllCommonsvc.exe 148 PID 4832 wrote to memory of 4796 4832 DllCommonsvc.exe 148 PID 4832 wrote to memory of 4260 4832 DllCommonsvc.exe 149 PID 4832 wrote to memory of 4260 4832 DllCommonsvc.exe 149 PID 4832 wrote to memory of 2124 4832 DllCommonsvc.exe 150 PID 4832 wrote to memory of 2124 4832 DllCommonsvc.exe 150 PID 4832 wrote to memory of 920 4832 DllCommonsvc.exe 151 PID 4832 wrote to memory of 920 4832 DllCommonsvc.exe 151 PID 4832 wrote to memory of 5020 4832 DllCommonsvc.exe 152 PID 4832 wrote to memory of 5020 4832 DllCommonsvc.exe 152 PID 4832 wrote to memory of 4128 4832 DllCommonsvc.exe 153 PID 4832 wrote to memory of 4128 4832 DllCommonsvc.exe 153 PID 4832 wrote to memory of 4048 4832 DllCommonsvc.exe 154 PID 4832 wrote to memory of 4048 4832 DllCommonsvc.exe 154 PID 4832 wrote to memory of 848 4832 DllCommonsvc.exe 155 PID 4832 wrote to memory of 848 4832 DllCommonsvc.exe 155 PID 4832 wrote to memory of 2732 4832 DllCommonsvc.exe 156 PID 4832 wrote to memory of 2732 4832 DllCommonsvc.exe 156 PID 4832 wrote to memory of 4384 4832 DllCommonsvc.exe 157 PID 4832 wrote to memory of 4384 4832 DllCommonsvc.exe 157 PID 4832 wrote to memory of 4312 4832 DllCommonsvc.exe 158 PID 4832 wrote to memory of 4312 4832 DllCommonsvc.exe 158 PID 4832 wrote to memory of 2688 4832 DllCommonsvc.exe 159 PID 4832 wrote to memory of 2688 4832 DllCommonsvc.exe 159 PID 4832 wrote to memory of 5012 4832 DllCommonsvc.exe 160 PID 4832 wrote to memory of 5012 4832 DllCommonsvc.exe 160 PID 4832 wrote to memory of 2088 4832 DllCommonsvc.exe 161 PID 4832 wrote to memory of 2088 4832 DllCommonsvc.exe 161 PID 4832 wrote to memory of 1048 4832 DllCommonsvc.exe 162 PID 4832 wrote to memory of 1048 4832 DllCommonsvc.exe 162 PID 4832 wrote to memory of 4596 4832 DllCommonsvc.exe 181 PID 4832 wrote to memory of 4596 4832 DllCommonsvc.exe 181 PID 4596 wrote to memory of 5380 4596 sihost.exe 184 PID 4596 wrote to memory of 5380 4596 sihost.exe 184 PID 5380 wrote to memory of 5440 5380 cmd.exe 186 PID 5380 wrote to memory of 5440 5380 cmd.exe 186 PID 5380 wrote to memory of 5740 5380 cmd.exe 187 PID 5380 wrote to memory of 5740 5380 cmd.exe 187 PID 5740 wrote to memory of 1828 5740 sihost.exe 200 PID 5740 wrote to memory of 1828 5740 sihost.exe 200 PID 1828 wrote to memory of 4408 1828 cmd.exe 202 PID 1828 wrote to memory of 4408 1828 cmd.exe 202 PID 1828 wrote to memory of 1208 1828 cmd.exe 205 PID 1828 wrote to memory of 1208 1828 cmd.exe 205 PID 1208 wrote to memory of 4364 1208 sihost.exe 209 PID 1208 wrote to memory of 4364 1208 sihost.exe 209 PID 4364 wrote to memory of 856 4364 cmd.exe 211 PID 4364 wrote to memory of 856 4364 cmd.exe 211 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_85632560897d9596e5f7eb16193e2d94d8208f2b26b1fd8f2ef1d95802674815.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_85632560897d9596e5f7eb16193e2d94d8208f2b26b1fd8f2ef1d95802674815.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3648 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\providercommon\DllCommonsvc.exe"C:\providercommon\DllCommonsvc.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1848
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows NT\TableTextService\en-US\System.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3200
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\lsass.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4608
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Libraries\conhost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2784
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\conhost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4796
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\cmd.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4260
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Globalization\unsecapp.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2124
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Internet Explorer\es-ES\taskhostw.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:920
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Photo Viewer\fr-FR\sihost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5020
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\sihost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4128
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\fontdrvhost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4048
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Portable Devices\fontdrvhost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:848
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Portable Devices\taskhostw.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2732
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Defender\uk-UA\sysmon.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4384
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\SearchApp.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4312
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\LocalLow\Oracle\fontdrvhost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2688
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\services.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5012
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\csrss.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2088
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Multimedia Platform\csrss.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1048
-
-
C:\providercommon\sihost.exe"C:\providercommon\sihost.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\D9KWG0zl28.bat"6⤵
- Suspicious use of WriteProcessMemory
PID:5380 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:27⤵PID:5440
-
-
C:\providercommon\sihost.exe"C:\providercommon\sihost.exe"7⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5740 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\4yEObGBIDe.bat"8⤵
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:29⤵PID:4408
-
-
C:\providercommon\sihost.exe"C:\providercommon\sihost.exe"9⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\EtrZeLjFvq.bat"10⤵
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:211⤵PID:856
-
-
C:\providercommon\sihost.exe"C:\providercommon\sihost.exe"11⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3668 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Wm5t4PlH1R.bat"12⤵PID:5564
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:213⤵PID:1492
-
-
C:\providercommon\sihost.exe"C:\providercommon\sihost.exe"13⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1084 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\vF7CrwxjwX.bat"14⤵PID:5192
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:215⤵PID:5200
-
-
C:\providercommon\sihost.exe"C:\providercommon\sihost.exe"15⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4500 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Zi7wkUpBKE.bat"16⤵PID:2112
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:217⤵PID:5216
-
-
C:\providercommon\sihost.exe"C:\providercommon\sihost.exe"17⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2800 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\XdxpZ3I66P.bat"18⤵PID:2336
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:219⤵PID:5660
-
-
C:\providercommon\sihost.exe"C:\providercommon\sihost.exe"19⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:5708 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\OoUlhQHDc2.bat"20⤵PID:6064
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:221⤵PID:3368
-
-
C:\providercommon\sihost.exe"C:\providercommon\sihost.exe"21⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:5436 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\LnIbptgF5R.bat"22⤵PID:1996
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:223⤵PID:3228
-
-
C:\providercommon\sihost.exe"C:\providercommon\sihost.exe"23⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:5856 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\8xeM6k5O3T.bat"24⤵PID:3040
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:225⤵PID:60
-
-
C:\providercommon\sihost.exe"C:\providercommon\sihost.exe"25⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1040 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\XdxpZ3I66P.bat"26⤵PID:5208
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:227⤵PID:3672
-
-
C:\providercommon\sihost.exe"C:\providercommon\sihost.exe"27⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2848 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\sSDDfDN1Wn.bat"28⤵PID:2692
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:229⤵PID:4604
-
-
C:\providercommon\sihost.exe"C:\providercommon\sihost.exe"29⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2696
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows NT\TableTextService\en-US\System.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3276
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files\Windows NT\TableTextService\en-US\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2724
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows NT\TableTextService\en-US\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3212
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\providercommon\lsass.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2980
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\providercommon\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1120
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\providercommon\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4724
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 9 /tr "'C:\Users\Public\Libraries\conhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3152
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Users\Public\Libraries\conhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4444
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 8 /tr "'C:\Users\Public\Libraries\conhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3496
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\providercommon\conhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4976
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\providercommon\conhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4960
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\providercommon\conhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1144
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "cmdc" /sc MINUTE /mo 9 /tr "'C:\Users\Default User\cmd.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1512
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Users\Default User\cmd.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4280
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "cmdc" /sc MINUTE /mo 12 /tr "'C:\Users\Default User\cmd.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2288
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 14 /tr "'C:\Windows\Globalization\unsecapp.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2248
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Windows\Globalization\unsecapp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3860
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 6 /tr "'C:\Windows\Globalization\unsecapp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4780
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Internet Explorer\es-ES\taskhostw.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1476
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\es-ES\taskhostw.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3888
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Internet Explorer\es-ES\taskhostw.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1444
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihosts" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Photo Viewer\fr-FR\sihost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1428
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\fr-FR\sihost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4236
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihosts" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Photo Viewer\fr-FR\sihost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:532
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihosts" /sc MINUTE /mo 14 /tr "'C:\providercommon\sihost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4432
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\providercommon\sihost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3004
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihosts" /sc MINUTE /mo 6 /tr "'C:\providercommon\sihost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2644
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\providercommon\fontdrvhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4500
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\providercommon\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3528
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\providercommon\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2712
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Portable Devices\fontdrvhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4992
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5116
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Portable Devices\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1560
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Portable Devices\taskhostw.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4600
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\taskhostw.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4552
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Portable Devices\taskhostw.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4412
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmons" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Defender\uk-UA\sysmon.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3924
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\uk-UA\sysmon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2212
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmons" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Defender\uk-UA\sysmon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1436
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 10 /tr "'C:\providercommon\SearchApp.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4008
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\providercommon\SearchApp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2112
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 8 /tr "'C:\providercommon\SearchApp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1084
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\AppData\LocalLow\Oracle\fontdrvhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4140
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\Admin\AppData\LocalLow\Oracle\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1856
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\AppData\LocalLow\Oracle\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3936
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 9 /tr "'C:\providercommon\services.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4884
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\providercommon\services.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4408
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 8 /tr "'C:\providercommon\services.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1636
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4876
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4056
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2708
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Multimedia Platform\csrss.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4240
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Windows Multimedia Platform\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4696
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Multimedia Platform\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3248
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5750e4be22a6fdadd7778a388198a9ee3
SHA18feb2054d8a3767833dd972535df54f0c3ab6648
SHA25626209c196c9c45202d27468ea707b2b46f375bb612d50271924a28f9210df6a1
SHA512b0415087dfc32908b449b876b395a607698b0f7b72031916b6fe7c002e4b163ba318b7e85c8ce41f007429e666974c04967bc14345e3f4614e34d94f5c8ae804
-
Filesize
1KB
MD5baf55b95da4a601229647f25dad12878
SHA1abc16954ebfd213733c4493fc1910164d825cac8
SHA256ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
SHA51224f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545
-
Filesize
944B
MD562623d22bd9e037191765d5083ce16a3
SHA14a07da6872672f715a4780513d95ed8ddeefd259
SHA25695d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010
SHA5129a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992
-
Filesize
944B
MD5cadef9abd087803c630df65264a6c81c
SHA1babbf3636c347c8727c35f3eef2ee643dbcc4bd2
SHA256cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438
SHA5127278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085
-
Filesize
944B
MD52e907f77659a6601fcc408274894da2e
SHA19f5b72abef1cd7145bf37547cdb1b9254b4efe9d
SHA256385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233
SHA51234fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721
-
Filesize
944B
MD5e243a38635ff9a06c87c2a61a2200656
SHA1ecd95ed5bf1a9fbe96a8448fc2814a0210fa2afc
SHA256af5782703f3f2d5a29fb313dae6680a64134db26064d4a321a3f23b75f6ca00f
SHA5124418957a1b10eee44cf270c81816ae707352411c4f5ac14b6b61ab537c91480e24e0a0a2c276a6291081b4984c123cf673a45dcedb0ceeef682054ba0fc19cb4
-
Filesize
944B
MD55f0ddc7f3691c81ee14d17b419ba220d
SHA1f0ef5fde8bab9d17c0b47137e014c91be888ee53
SHA256a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5
SHA5122ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3
-
Filesize
944B
MD5aaaac7c68d2b7997ed502c26fd9f65c2
SHA17c5a3731300d672bf53c43e2f9e951c745f7fbdf
SHA2568724dc2c3c8e8f17aeefae44a23741b1ea3b43c490fbc52fd61575ffe1cd82bb
SHA512c526febd9430413b48bed976edd9a795793ad1f06c8ff4f6b768b4ad63f4d2f06b9da72d4fcfa7cb9530a64e2dc3554f5ad97fd0ab60129701d175f2724ef1ac
-
Filesize
193B
MD5f183e0cee57eaab2138f00da48804928
SHA14618d5eea097cbb92985bbdbf065d96d314445bd
SHA2567bbdcb3024a10dfba8d72132765c8de0e0348557c8170ece8397b83bce9c2926
SHA512f8a46fd4056b63deda519898d5c91d0c15f5c7a246a81b06b6e37c4513cf5f3b0debef31170b1e8f678cb8f72c3eb9f8ee02e4994c225b06e2bb5adac273f37a
-
Filesize
193B
MD5a2789134323d2ee85fecb5ba55356055
SHA1dcbb012aebe006d7c65be81a73c069dfe4739b56
SHA2564f65ed3cee986988ef06b89cd7eb80941382c4981ae3d3fb4641e03fc6247367
SHA5122a7ed4243604c743ed60a359c3c1d1401b783f8486e27add355c26c2fffefa03b642ad1d02635a16c8e1276a1aa0dcb79207f9fa08808b5cf251bbd65df2c683
-
Filesize
193B
MD5e0027d87f6c654b441f2fb293706ee93
SHA1f596fe7def3d8ad6b1be3e3d88f27d67961061ba
SHA256e0ee5700816fcb0ca68d35edb45aa2958a4091a60e9ede6419e07dcac90d47c8
SHA512e72eb507a7657753ae9fced405092d73231acada66f73e9c78624fc1e156c6edc0a89f99675f87e1a57f220539cd5674dbb5cbf34cafa898728fe1b740de2607
-
Filesize
193B
MD54e5656038a9e616ebceaef9b75782fce
SHA1ed3c06819e56c3df9163faa976473b7603dc12ca
SHA25638ffa56367bfd7ef99fd1cebff58d46500489cbe1669b6c9b4429969c8514776
SHA5125ec0eacdaf12e37fd1121fa69df813eda6b0147f2bbe9717ff6f6c87bd686854fec0bda7c1d825df31562a876844ba6578bcb3ed36c861b6f9b15fa3ccd5c256
-
Filesize
193B
MD59a6f37974d95ca3f8e9269352ebf07e8
SHA114af4f5a54d762efcccc80b2b775ddb31ff72cf4
SHA256adea284424d1e0a0709525beaaa5470d7ef41182214f9cb7bd8a75a33f5aacf9
SHA512acacaa2338488932345e730c41c3cb23ed27c67a77dba95fa090e2cd1be733a9c20f100024018055ba4d1663338d00cba010b296ef091d548899fc2fce8cd68b
-
Filesize
193B
MD5a4208f7891743a18ce1742b0d9e0cf60
SHA11ac2bdb340ef204884f442bb6fca4c549e22c7a2
SHA2563b19db6222ae1c3d47a848ee64714c8be1fe1eba4649322e7e6247c803ac0ef0
SHA5121b7e08106c707cc7cdaff04f4d4bf761210b9289d88bf2a652c0b1a42c7a2b6dc8e32b3b2fb4ef35dfdc97bcdcd8877897a1897a17dfa4c3fddfd9dfcdeb1fd3
-
Filesize
193B
MD51475a567c3eeedaf962f3dcb71aff934
SHA18f607b71269bef531ab6927c776215d9555564ea
SHA2566bcc69c930ce33d4814d0b96ab019aacb0a9e270ebe93dda85fdffc5584340b5
SHA512b5114ce3db52dfcceee358928f4c993c8a3c37e28b3c297c343f991c1b421de642f9e33909bd7e20997a0abd58aef741b5e1bb30251c26e4f2858d1929df79bc
-
Filesize
193B
MD54ffb3489c15a2e5b22a56dbd2537d85f
SHA1330c1a61f7f2e3d4278cec00d0117a3d2bfbbc57
SHA25646fb2e6312f5cbffc884649e9faa6f2b8309e5ba70c7bc1f8fc8a53353b62400
SHA512695ea7612ff1decf99c5ddebc81863f70ce32032f4aacc01f6766399cbd9a2aa34a88785ae7009d81d67feabeb08d72861346a6f9c8a53c4f9c38160d074aef3
-
Filesize
193B
MD5fcd2a350fa429f9fbab95b6380ee750f
SHA13923b84cb7da3319eed5c184117644cc22ce4a7c
SHA2560851bdf9de1ad0eed3ec090288e0602f28b1d3fd6b00a11fe7f8f9b2f09fefc7
SHA512edf235b6d45ff2ad154ebfc3397e3b4a46d51626ba36c49575c4d451dd6d95ec752376d2a62df76403dbd29ede505ce8ae775dce3bfbba28bffa23e976c31d16
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
193B
MD532f9f33300fcf931a818ca0e4bb19224
SHA14c0116f12de0fff587c81808710abd4e23d42947
SHA2567a145acafc62dbd8ecce84781b1fceb156df195ad55b859d8383f90de4af81d9
SHA5123a29306450e3e97b7bb6b6f0800b33e8d8524ebdb74bcf7c6ac3de5f52e5648d690d2a2e2c4e8f803901557b5eca772745f759d7c0fe8aebd4dbdb48b45de1d5
-
Filesize
193B
MD5b14d3425fe05956fd9e47901266995d4
SHA14bd3ff33daa504204e2830bbbca40d9740ee6921
SHA25661c77f5f82b750f9001d0bce886d6dbfca45d375ed1e527847931ae0ef280f67
SHA5121f31f605cc07e4414d3d3659416f008a30d1339cd392c5c99b14ba635adfe9de9a36173a66f261e9eac143ed921180e69b868203f4d417e5cd3732f7c5ffeddb
-
Filesize
36B
MD56783c3ee07c7d151ceac57f1f9c8bed7
SHA117468f98f95bf504cc1f83c49e49a78526b3ea03
SHA2568ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322
SHA512c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8
-
Filesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
Filesize
197B
MD58088241160261560a02c84025d107592
SHA1083121f7027557570994c9fc211df61730455bb5
SHA2562072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1
SHA51220d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478