Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2024, 02:41
Behavioral task
behavioral1
Sample
JaffaCakes118_0d1424eaa60b12379d786db65f2d5d735802e80d10bb801421cc8b2b6115a598.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_0d1424eaa60b12379d786db65f2d5d735802e80d10bb801421cc8b2b6115a598.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_0d1424eaa60b12379d786db65f2d5d735802e80d10bb801421cc8b2b6115a598.exe
-
Size
1.3MB
-
MD5
d56ce03b4b90817dd9b3146e7ad21e32
-
SHA1
bdcf7fb63bf4a57487fce8daee047c0ae3495c4e
-
SHA256
0d1424eaa60b12379d786db65f2d5d735802e80d10bb801421cc8b2b6115a598
-
SHA512
376c62ffebec37af68258c3f349b610a46a890bdbb758bf5b4a40d20f958a9ca022fdaff708438dba8772c700e2f0cb5eecf492e46f2167c1d84cbdb067714e5
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Process spawned unexpected child process 51 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 64 4408 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4412 4408 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4616 4408 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3176 4408 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2352 4408 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2584 4408 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2300 4408 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2124 4408 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1648 4408 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4620 4408 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3140 4408 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1644 4408 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4028 4408 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2668 4408 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4000 4408 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4112 4408 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 756 4408 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3736 4408 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1496 4408 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3268 4408 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4820 4408 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4452 4408 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4968 4408 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3060 4408 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4232 4408 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4560 4408 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3456 4408 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 764 4408 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 372 4408 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1128 4408 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3068 4408 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2520 4408 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4944 4408 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1716 4408 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2484 4408 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5056 4408 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3756 4408 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1124 4408 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4220 4408 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4808 4408 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3424 4408 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4108 4408 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2724 4408 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4044 4408 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4964 4408 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3916 4408 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2164 4408 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3980 4408 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4896 4408 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 812 4408 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2096 4408 schtasks.exe 88 -
resource yara_rule behavioral2/files/0x000a000000023b94-9.dat dcrat behavioral2/memory/1456-13-0x0000000000CE0000-0x0000000000DF0000-memory.dmp dcrat -
Command and Scripting Interpreter: PowerShell 1 TTPs 18 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 876 powershell.exe 552 powershell.exe 3076 powershell.exe 3248 powershell.exe 3680 powershell.exe 1596 powershell.exe 4244 powershell.exe 1636 powershell.exe 4148 powershell.exe 2100 powershell.exe 4960 powershell.exe 3512 powershell.exe 1816 powershell.exe 1076 powershell.exe 2360 powershell.exe 3516 powershell.exe 1660 powershell.exe 1192 powershell.exe -
Checks computer location settings 2 TTPs 15 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation unsecapp.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation unsecapp.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation unsecapp.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation DllCommonsvc.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation unsecapp.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation unsecapp.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation unsecapp.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation unsecapp.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation unsecapp.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation JaffaCakes118_0d1424eaa60b12379d786db65f2d5d735802e80d10bb801421cc8b2b6115a598.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation unsecapp.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation unsecapp.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation unsecapp.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation unsecapp.exe -
Executes dropped EXE 13 IoCs
pid Process 1456 DllCommonsvc.exe 5472 unsecapp.exe 5832 unsecapp.exe 2360 unsecapp.exe 1416 unsecapp.exe 1816 unsecapp.exe 3372 unsecapp.exe 5304 unsecapp.exe 4088 unsecapp.exe 5648 unsecapp.exe 4556 unsecapp.exe 5960 unsecapp.exe 2916 unsecapp.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 13 IoCs
flow ioc 13 raw.githubusercontent.com 39 raw.githubusercontent.com 40 raw.githubusercontent.com 42 raw.githubusercontent.com 45 raw.githubusercontent.com 52 raw.githubusercontent.com 53 raw.githubusercontent.com 54 raw.githubusercontent.com 12 raw.githubusercontent.com 20 raw.githubusercontent.com 41 raw.githubusercontent.com 51 raw.githubusercontent.com 55 raw.githubusercontent.com -
Drops file in Program Files directory 6 IoCs
description ioc Process File created C:\Program Files\Internet Explorer\it-IT\22eafd247d37c3 DllCommonsvc.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\sysmon.exe DllCommonsvc.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\121e5b5079f7c0 DllCommonsvc.exe File created C:\Program Files\Microsoft Office 15\ClientX64\RuntimeBroker.exe DllCommonsvc.exe File created C:\Program Files\Microsoft Office 15\ClientX64\9e8d7a4ca61bd9 DllCommonsvc.exe File created C:\Program Files\Internet Explorer\it-IT\TextInputHost.exe DllCommonsvc.exe -
Drops file in Windows directory 7 IoCs
description ioc Process File created C:\Windows\CbsTemp\9e8d7a4ca61bd9 DllCommonsvc.exe File created C:\Windows\Speech\Common\fr-FR\RuntimeBroker.exe DllCommonsvc.exe File created C:\Windows\Downloaded Program Files\dwm.exe DllCommonsvc.exe File created C:\Windows\Downloaded Program Files\6cb0b6c459d5d3 DllCommonsvc.exe File created C:\Windows\IdentityCRL\INT\fontdrvhost.exe DllCommonsvc.exe File created C:\Windows\IdentityCRL\INT\5b884080fd4f94 DllCommonsvc.exe File created C:\Windows\CbsTemp\RuntimeBroker.exe DllCommonsvc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_0d1424eaa60b12379d786db65f2d5d735802e80d10bb801421cc8b2b6115a598.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies registry class 14 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings unsecapp.exe Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings unsecapp.exe Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings unsecapp.exe Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings unsecapp.exe Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings DllCommonsvc.exe Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings unsecapp.exe Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings unsecapp.exe Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings unsecapp.exe Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings unsecapp.exe Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings unsecapp.exe Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings unsecapp.exe Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings unsecapp.exe Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings unsecapp.exe Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings JaffaCakes118_0d1424eaa60b12379d786db65f2d5d735802e80d10bb801421cc8b2b6115a598.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 51 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1496 schtasks.exe 4452 schtasks.exe 372 schtasks.exe 1128 schtasks.exe 2724 schtasks.exe 4412 schtasks.exe 1648 schtasks.exe 2668 schtasks.exe 4044 schtasks.exe 4964 schtasks.exe 1644 schtasks.exe 4232 schtasks.exe 764 schtasks.exe 2520 schtasks.exe 1124 schtasks.exe 64 schtasks.exe 2352 schtasks.exe 2584 schtasks.exe 4808 schtasks.exe 3424 schtasks.exe 4820 schtasks.exe 3756 schtasks.exe 4896 schtasks.exe 812 schtasks.exe 4112 schtasks.exe 756 schtasks.exe 3268 schtasks.exe 2096 schtasks.exe 3736 schtasks.exe 3456 schtasks.exe 4108 schtasks.exe 4968 schtasks.exe 4220 schtasks.exe 2164 schtasks.exe 4616 schtasks.exe 2124 schtasks.exe 4000 schtasks.exe 3176 schtasks.exe 4620 schtasks.exe 2484 schtasks.exe 3916 schtasks.exe 3980 schtasks.exe 2300 schtasks.exe 3068 schtasks.exe 4944 schtasks.exe 4560 schtasks.exe 1716 schtasks.exe 5056 schtasks.exe 3140 schtasks.exe 4028 schtasks.exe 3060 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1456 DllCommonsvc.exe 1456 DllCommonsvc.exe 1456 DllCommonsvc.exe 1456 DllCommonsvc.exe 1456 DllCommonsvc.exe 1456 DllCommonsvc.exe 1456 DllCommonsvc.exe 1456 DllCommonsvc.exe 1456 DllCommonsvc.exe 1456 DllCommonsvc.exe 1456 DllCommonsvc.exe 1456 DllCommonsvc.exe 1456 DllCommonsvc.exe 1456 DllCommonsvc.exe 1456 DllCommonsvc.exe 1456 DllCommonsvc.exe 1456 DllCommonsvc.exe 1456 DllCommonsvc.exe 1456 DllCommonsvc.exe 1456 DllCommonsvc.exe 4960 powershell.exe 4960 powershell.exe 3516 powershell.exe 3516 powershell.exe 3512 powershell.exe 3512 powershell.exe 1660 powershell.exe 1660 powershell.exe 2360 powershell.exe 2360 powershell.exe 1076 powershell.exe 1076 powershell.exe 1596 powershell.exe 1596 powershell.exe 552 powershell.exe 552 powershell.exe 4148 powershell.exe 4148 powershell.exe 3076 powershell.exe 3076 powershell.exe 3680 powershell.exe 3680 powershell.exe 3248 powershell.exe 3248 powershell.exe 2360 powershell.exe 1816 powershell.exe 1816 powershell.exe 1636 powershell.exe 1636 powershell.exe 2100 powershell.exe 2100 powershell.exe 4244 powershell.exe 4244 powershell.exe 1192 powershell.exe 1192 powershell.exe 876 powershell.exe 876 powershell.exe 2100 powershell.exe 1596 powershell.exe 1596 powershell.exe 1192 powershell.exe 1660 powershell.exe 1660 powershell.exe 4960 powershell.exe -
Suspicious use of AdjustPrivilegeToken 31 IoCs
description pid Process Token: SeDebugPrivilege 1456 DllCommonsvc.exe Token: SeDebugPrivilege 4960 powershell.exe Token: SeDebugPrivilege 3516 powershell.exe Token: SeDebugPrivilege 3512 powershell.exe Token: SeDebugPrivilege 1660 powershell.exe Token: SeDebugPrivilege 2100 powershell.exe Token: SeDebugPrivilege 2360 powershell.exe Token: SeDebugPrivilege 1076 powershell.exe Token: SeDebugPrivilege 1596 powershell.exe Token: SeDebugPrivilege 4148 powershell.exe Token: SeDebugPrivilege 552 powershell.exe Token: SeDebugPrivilege 1192 powershell.exe Token: SeDebugPrivilege 3076 powershell.exe Token: SeDebugPrivilege 3680 powershell.exe Token: SeDebugPrivilege 3248 powershell.exe Token: SeDebugPrivilege 1816 powershell.exe Token: SeDebugPrivilege 4244 powershell.exe Token: SeDebugPrivilege 1636 powershell.exe Token: SeDebugPrivilege 876 powershell.exe Token: SeDebugPrivilege 5472 unsecapp.exe Token: SeDebugPrivilege 5832 unsecapp.exe Token: SeDebugPrivilege 2360 unsecapp.exe Token: SeDebugPrivilege 1416 unsecapp.exe Token: SeDebugPrivilege 1816 unsecapp.exe Token: SeDebugPrivilege 3372 unsecapp.exe Token: SeDebugPrivilege 5304 unsecapp.exe Token: SeDebugPrivilege 4088 unsecapp.exe Token: SeDebugPrivilege 5648 unsecapp.exe Token: SeDebugPrivilege 4556 unsecapp.exe Token: SeDebugPrivilege 5960 unsecapp.exe Token: SeDebugPrivilege 2916 unsecapp.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 984 wrote to memory of 452 984 JaffaCakes118_0d1424eaa60b12379d786db65f2d5d735802e80d10bb801421cc8b2b6115a598.exe 83 PID 984 wrote to memory of 452 984 JaffaCakes118_0d1424eaa60b12379d786db65f2d5d735802e80d10bb801421cc8b2b6115a598.exe 83 PID 984 wrote to memory of 452 984 JaffaCakes118_0d1424eaa60b12379d786db65f2d5d735802e80d10bb801421cc8b2b6115a598.exe 83 PID 452 wrote to memory of 2372 452 WScript.exe 85 PID 452 wrote to memory of 2372 452 WScript.exe 85 PID 452 wrote to memory of 2372 452 WScript.exe 85 PID 2372 wrote to memory of 1456 2372 cmd.exe 87 PID 2372 wrote to memory of 1456 2372 cmd.exe 87 PID 1456 wrote to memory of 876 1456 DllCommonsvc.exe 141 PID 1456 wrote to memory of 876 1456 DllCommonsvc.exe 141 PID 1456 wrote to memory of 552 1456 DllCommonsvc.exe 142 PID 1456 wrote to memory of 552 1456 DllCommonsvc.exe 142 PID 1456 wrote to memory of 3680 1456 DllCommonsvc.exe 143 PID 1456 wrote to memory of 3680 1456 DllCommonsvc.exe 143 PID 1456 wrote to memory of 1816 1456 DllCommonsvc.exe 144 PID 1456 wrote to memory of 1816 1456 DllCommonsvc.exe 144 PID 1456 wrote to memory of 1076 1456 DllCommonsvc.exe 145 PID 1456 wrote to memory of 1076 1456 DllCommonsvc.exe 145 PID 1456 wrote to memory of 4244 1456 DllCommonsvc.exe 146 PID 1456 wrote to memory of 4244 1456 DllCommonsvc.exe 146 PID 1456 wrote to memory of 1636 1456 DllCommonsvc.exe 147 PID 1456 wrote to memory of 1636 1456 DllCommonsvc.exe 147 PID 1456 wrote to memory of 2360 1456 DllCommonsvc.exe 148 PID 1456 wrote to memory of 2360 1456 DllCommonsvc.exe 148 PID 1456 wrote to memory of 2100 1456 DllCommonsvc.exe 149 PID 1456 wrote to memory of 2100 1456 DllCommonsvc.exe 149 PID 1456 wrote to memory of 4148 1456 DllCommonsvc.exe 150 PID 1456 wrote to memory of 4148 1456 DllCommonsvc.exe 150 PID 1456 wrote to memory of 1596 1456 DllCommonsvc.exe 151 PID 1456 wrote to memory of 1596 1456 DllCommonsvc.exe 151 PID 1456 wrote to memory of 4960 1456 DllCommonsvc.exe 152 PID 1456 wrote to memory of 4960 1456 DllCommonsvc.exe 152 PID 1456 wrote to memory of 3516 1456 DllCommonsvc.exe 153 PID 1456 wrote to memory of 3516 1456 DllCommonsvc.exe 153 PID 1456 wrote to memory of 3076 1456 DllCommonsvc.exe 154 PID 1456 wrote to memory of 3076 1456 DllCommonsvc.exe 154 PID 1456 wrote to memory of 3512 1456 DllCommonsvc.exe 155 PID 1456 wrote to memory of 3512 1456 DllCommonsvc.exe 155 PID 1456 wrote to memory of 1660 1456 DllCommonsvc.exe 156 PID 1456 wrote to memory of 1660 1456 DllCommonsvc.exe 156 PID 1456 wrote to memory of 3248 1456 DllCommonsvc.exe 157 PID 1456 wrote to memory of 3248 1456 DllCommonsvc.exe 157 PID 1456 wrote to memory of 1192 1456 DllCommonsvc.exe 158 PID 1456 wrote to memory of 1192 1456 DllCommonsvc.exe 158 PID 1456 wrote to memory of 940 1456 DllCommonsvc.exe 176 PID 1456 wrote to memory of 940 1456 DllCommonsvc.exe 176 PID 940 wrote to memory of 3944 940 cmd.exe 180 PID 940 wrote to memory of 3944 940 cmd.exe 180 PID 940 wrote to memory of 5472 940 cmd.exe 181 PID 940 wrote to memory of 5472 940 cmd.exe 181 PID 5472 wrote to memory of 5640 5472 unsecapp.exe 183 PID 5472 wrote to memory of 5640 5472 unsecapp.exe 183 PID 5640 wrote to memory of 5700 5640 cmd.exe 185 PID 5640 wrote to memory of 5700 5640 cmd.exe 185 PID 5640 wrote to memory of 5832 5640 cmd.exe 187 PID 5640 wrote to memory of 5832 5640 cmd.exe 187 PID 5832 wrote to memory of 404 5832 unsecapp.exe 194 PID 5832 wrote to memory of 404 5832 unsecapp.exe 194 PID 404 wrote to memory of 4828 404 cmd.exe 196 PID 404 wrote to memory of 4828 404 cmd.exe 196 PID 404 wrote to memory of 2360 404 cmd.exe 204 PID 404 wrote to memory of 2360 404 cmd.exe 204 PID 2360 wrote to memory of 2548 2360 unsecapp.exe 207 PID 2360 wrote to memory of 2548 2360 unsecapp.exe 207 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0d1424eaa60b12379d786db65f2d5d735802e80d10bb801421cc8b2b6115a598.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0d1424eaa60b12379d786db65f2d5d735802e80d10bb801421cc8b2b6115a598.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:984 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:452 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\providercommon\DllCommonsvc.exe"C:\providercommon\DllCommonsvc.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:876
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\upfc.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:552
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Downloaded Program Files\dwm.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3680
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\dllhost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1816
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Internet Explorer\it-IT\TextInputHost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1076
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\dwm.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4244
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\sysmon.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1636
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Desktop\StartMenuExperienceHost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2360
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Documents\My Pictures\SearchApp.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2100
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\fontdrvhost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4148
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\System.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1596
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\IdentityCRL\INT\fontdrvhost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4960
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\CbsTemp\RuntimeBroker.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3516
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Templates\unsecapp.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3076
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\RuntimeBroker.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3512
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Microsoft Office 15\ClientX64\RuntimeBroker.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1660
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\SppExtComObj.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3248
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\AppData\Local\winlogon.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1192
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\KKwjPx7JIG.bat"5⤵
- Suspicious use of WriteProcessMemory
PID:940 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:26⤵PID:3944
-
-
C:\Users\Default\Templates\unsecapp.exe"C:\Users\Default\Templates\unsecapp.exe"6⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5472 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\QHkN6qNcbm.bat"7⤵
- Suspicious use of WriteProcessMemory
PID:5640 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:28⤵PID:5700
-
-
C:\Users\Default\Templates\unsecapp.exe"C:\Users\Default\Templates\unsecapp.exe"8⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5832 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\8Usvo58uhQ.bat"9⤵
- Suspicious use of WriteProcessMemory
PID:404 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:210⤵PID:4828
-
-
C:\Users\Default\Templates\unsecapp.exe"C:\Users\Default\Templates\unsecapp.exe"10⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\hlBWXN5z7R.bat"11⤵PID:2548
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:212⤵PID:2124
-
-
C:\Users\Default\Templates\unsecapp.exe"C:\Users\Default\Templates\unsecapp.exe"12⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1416 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\CMv1BFFgLz.bat"13⤵PID:4260
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:214⤵PID:776
-
-
C:\Users\Default\Templates\unsecapp.exe"C:\Users\Default\Templates\unsecapp.exe"14⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1816 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\XBBOHPKclM.bat"15⤵PID:3612
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:216⤵PID:2488
-
-
C:\Users\Default\Templates\unsecapp.exe"C:\Users\Default\Templates\unsecapp.exe"16⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3372 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\GN7B3lpeta.bat"17⤵PID:396
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:218⤵PID:3512
-
-
C:\Users\Default\Templates\unsecapp.exe"C:\Users\Default\Templates\unsecapp.exe"18⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:5304 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\GTS4B5cy6p.bat"19⤵PID:5396
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:220⤵PID:2164
-
-
C:\Users\Default\Templates\unsecapp.exe"C:\Users\Default\Templates\unsecapp.exe"20⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4088 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\GTS4B5cy6p.bat"21⤵PID:5744
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:222⤵PID:5820
-
-
C:\Users\Default\Templates\unsecapp.exe"C:\Users\Default\Templates\unsecapp.exe"22⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:5648 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\HEz7ZQMTyX.bat"23⤵PID:5000
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:224⤵PID:5868
-
-
C:\Users\Default\Templates\unsecapp.exe"C:\Users\Default\Templates\unsecapp.exe"24⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4556 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\NHYDEKme3A.bat"25⤵PID:2708
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:226⤵PID:3720
-
-
C:\Users\Default\Templates\unsecapp.exe"C:\Users\Default\Templates\unsecapp.exe"26⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:5960 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\7ezzJRb6cS.bat"27⤵PID:2360
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:228⤵PID:456
-
-
C:\Users\Default\Templates\unsecapp.exe"C:\Users\Default\Templates\unsecapp.exe"28⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2916 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\4WSxKcEorb.bat"29⤵PID:3796
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:230⤵PID:5128
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "upfcu" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\upfc.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:64
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\upfc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4412
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "upfcu" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\upfc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4616
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 10 /tr "'C:\Windows\Downloaded Program Files\dwm.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3176
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\Downloaded Program Files\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2352
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 6 /tr "'C:\Windows\Downloaded Program Files\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2584
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\providercommon\dllhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2300
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\providercommon\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2124
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\providercommon\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1648
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 13 /tr "'C:\Program Files\Internet Explorer\it-IT\TextInputHost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4620
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\it-IT\TextInputHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3140
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 7 /tr "'C:\Program Files\Internet Explorer\it-IT\TextInputHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1644
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\dwm.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4028
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2668
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4000
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmons" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\sysmon.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4112
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\sysmon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:756
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmons" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\sysmon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3736
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 10 /tr "'C:\Users\Public\Desktop\StartMenuExperienceHost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1496
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Users\Public\Desktop\StartMenuExperienceHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3268
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 7 /tr "'C:\Users\Public\Desktop\StartMenuExperienceHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4820
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\Documents\My Pictures\SearchApp.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4452
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Users\Admin\Documents\My Pictures\SearchApp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4968
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\Documents\My Pictures\SearchApp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3060
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\fontdrvhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4232
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\All Users\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4560
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3456
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 9 /tr "'C:\Users\Public\System.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:764
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Users\Public\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:372
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 6 /tr "'C:\Users\Public\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1128
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\Windows\IdentityCRL\INT\fontdrvhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3068
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\IdentityCRL\INT\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2520
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\Windows\IdentityCRL\INT\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4944
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Windows\CbsTemp\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1716
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\CbsTemp\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2484
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Windows\CbsTemp\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5056
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 6 /tr "'C:\Users\Default\Templates\unsecapp.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3756
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Users\Default\Templates\unsecapp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1124
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 13 /tr "'C:\Users\Default\Templates\unsecapp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4220
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4808
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3424
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4108
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2724
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office 15\ClientX64\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4044
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4964
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3916
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2164
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3980
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'C:\Users\Default\AppData\Local\winlogon.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4896
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Users\Default\AppData\Local\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:812
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\Users\Default\AppData\Local\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2096
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5a43e653ffb5ab07940f4bdd9cc8fade4
SHA1af43d04e3427f111b22dc891c5c7ee8a10ac4123
SHA256c4c53abb13e99475aebfbe9fec7a8fead81c14c80d9dcc2b81375304f3a683fe
SHA51262a97e95e1f19a8d4302847110dae44f469877eed6aa8ea22345c6eb25ee220e7d310fa0b7ec5df42356815421c0af7c46a0f1fee8933cc446641800eda6cd1b
-
Filesize
1KB
MD5baf55b95da4a601229647f25dad12878
SHA1abc16954ebfd213733c4493fc1910164d825cac8
SHA256ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
SHA51224f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545
-
Filesize
944B
MD53b387104c7229348274d18cf0351b050
SHA1fa8e878ccaed2bc9aeb8322631a3e8b9fcfdab04
SHA256ee90089822718af3ec05ea4846850e21790163a593e101312fe0ec1d20177fdb
SHA51223fe2aedc0130c25a0aba854f506b0a48657132792265e63c658fcfe6b0c8327c7ae951b7456707ec626b69b3716232c685fb7f82174a1d29ab0c66c307a29e2
-
Filesize
944B
MD559d97011e091004eaffb9816aa0b9abd
SHA11602a56b01dd4b7c577ca27d3117e4bcc1aa657b
SHA25618f381e0db020a763b8c515c346ef58679ab9c403267eacfef5359e272f7e71d
SHA512d9ca49c1a17580981e2c1a50d73c0eecaa7a62f8514741512172e395af2a3d80aeb0f71c58bc7f52c18246d57ba67af09b6bff4776877d6cc6f0245c30e092d6
-
Filesize
944B
MD5cadef9abd087803c630df65264a6c81c
SHA1babbf3636c347c8727c35f3eef2ee643dbcc4bd2
SHA256cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438
SHA5127278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085
-
Filesize
944B
MD5bd5940f08d0be56e65e5f2aaf47c538e
SHA1d7e31b87866e5e383ab5499da64aba50f03e8443
SHA2562d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6
SHA512c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406
-
Filesize
944B
MD5e243a38635ff9a06c87c2a61a2200656
SHA1ecd95ed5bf1a9fbe96a8448fc2814a0210fa2afc
SHA256af5782703f3f2d5a29fb313dae6680a64134db26064d4a321a3f23b75f6ca00f
SHA5124418957a1b10eee44cf270c81816ae707352411c4f5ac14b6b61ab537c91480e24e0a0a2c276a6291081b4984c123cf673a45dcedb0ceeef682054ba0fc19cb4
-
Filesize
944B
MD5aaaac7c68d2b7997ed502c26fd9f65c2
SHA17c5a3731300d672bf53c43e2f9e951c745f7fbdf
SHA2568724dc2c3c8e8f17aeefae44a23741b1ea3b43c490fbc52fd61575ffe1cd82bb
SHA512c526febd9430413b48bed976edd9a795793ad1f06c8ff4f6b768b4ad63f4d2f06b9da72d4fcfa7cb9530a64e2dc3554f5ad97fd0ab60129701d175f2724ef1ac
-
Filesize
204B
MD56c4ef59fc5adfb7ac881ac5935a2b10b
SHA1f2409c711760d8e1aa1d27172ee5bdaabee8aa7e
SHA256209ebd100b224269a6c408d88fc0b7771e3c7568e11eb3f598f5d1288a796bc0
SHA5124274e929e45b2a4a8ee967506345d6fce489f2121ed9ed0a3d19a93db3be82c4e308cf5a47bce45185afa4007ae3563be27af64bcc58c17f2e7006d495744bae
-
Filesize
204B
MD5ffc78199e07c01fcfd0bb27c0007f5c4
SHA1a0ff619cb17c2706bb8f6497f104aa5f25244846
SHA25604839925a01d0814383ac48c973dcf17c070549ee72f4e95604f6b2bf2abb487
SHA512d37deb4267d9bc63efe9950860dab88f7ce52a01444cf4560e1f21087d1c2a0efcff73ec8ded90eb26dea382d6dd45f5326e1aceb319f4f032a2c88f9cdf536e
-
Filesize
204B
MD579c0a05a10eea50ac37cc41c166873b1
SHA11abc2a0283427985bd68f01b0515b9d9285fdb85
SHA2562b947194415f51c093061234e85a1a6a1c9c4dd20b84d2d00cf3621a1334c2c6
SHA512fc41b58c8a22663050ab0011ba538fe7db533b747107dbf84a22c8dd492220232fa662b3fc96450483e0f5b55c53e28dd78784c32e8d5b715cdb110aa5f1014d
-
Filesize
204B
MD5ea3bf1f152016542782574cc270bc26f
SHA12b579ed9c8f0494e87eac5a662d1847a63cfb700
SHA2567f15c23e854a0d20dd2fb8cc184425473e2196ffaa5e1fc28ce8f46c2d867d39
SHA512284e99b182c18d7525e765fae2d833985c33fefbe94802b968c6c6f22145605ac935ecc93b66f445df087b1200142fe538bd5ae5af095321998fb89a40e7a91b
-
Filesize
204B
MD5de54df26cda763a15d4d03fc3f1fa9a1
SHA1df8d86e541cf87350bfd5b3c9245f33d4550c85c
SHA256089b52d859b771f3a90007c3ebd4329958f6a822a743ff3d03bc88acaaed3c21
SHA512c8e032f149c2251831f1c67c1e2669ece4b20bd37692eaeebb6e2345f92a533517ad64241f20978f4cc2dc9e6c0d09b16e925d223c84d0e1a8df3fa6073f1b6f
-
Filesize
204B
MD5b528402fbd020622be330aaee980e2f5
SHA1fe938613240fceacbf871c40d2799187bf0c50fa
SHA256cdbaa98a2652141edefeea8d27ef8ed8f31b02fad4a656475aa6bb04b79b70f9
SHA5125126f49e546a04311e33c39188be8e4bc560724b94122028e72349482318493317018a20a2c1f4ace25b04dcc1028ab40ee0966f9c01f9643dbd7845527185b8
-
Filesize
204B
MD58050dad0cc21d384bb7a0ac7462b0f63
SHA17e73176cb44290d7e503b8eeb164819486dff433
SHA256ba9349a59b66b47ab48b9ea61f30e1f6a8f95ec9cccf0e8c2739e218ef45dc17
SHA51297dc4b2184eed143345dddec1d515b5a3f88add01bd64836a6c46ee4cf4ac61ce6273ebc1c45c1d48ba677aae031736ddb42f3d3d5f51c2f1a8115798e64d34a
-
Filesize
204B
MD5bb8faab5fff8bfbe236a2f80b59bf7e8
SHA1ccbd10fa2a162545968ae76a6e16ac307c6e9abc
SHA256b0f29157b0fd44f599ffd2da7a52421563ef85d68df28eb44bf1d0927b3e48fe
SHA512f100bc4235e6da2b4c98397cf4181f0eed837a88d7d92501480146a981243428a35e3a93e917ae5d3dea60ef23fb2e6d8ab30671941a232b70099805e90e653c
-
Filesize
204B
MD5892404a2213aa8781ebd79822124b3bd
SHA1e0bce3b62f3288fce0508c08112c97c1562e0ad1
SHA256715cf5b583b17471cfee8859118110c8d331d1c67f8b427982518d75de4183b3
SHA512213c890f9f06bda92ed1ca9b6f997c9715b020eaf92cd41c87b45e5fbe0b09664700db3d7310b3fd2eb13d086864d19eae9fae7fc551f213250684531f6009b0
-
Filesize
204B
MD5206b5c4e535c93c1f99653168388d72d
SHA1bb388e3b9af65507955e5c0769b5b4aff19db696
SHA2566fd32885716b985a81e5726319978de3b31b2cc51b2dbdb5d1a66bc1849906d3
SHA5120f9c8f7a50a18011402a4857d01d3071af292c8238cd62558ac46097e0a2d8872d4e59dddeeb2d719f1d7df4d639bdd60b6965c82361981b6b81fd8308711990
-
Filesize
204B
MD5014fe1f8e6b797e801f5a0412c61ea4a
SHA1014b629d1c1a73019d17da4c8270665fd8d6637c
SHA256571e0323298d0de854f31c97e5481b32982620d5ce0dd8957c1114d5a2c49a9b
SHA512983344bd8297b3e49ad99a2615f7853eab6b191180d30b12e6b767c0d243592d9fc077fba8891f5af6e9d1a803ad006fe8d320956dd81bf2b20b74387fc800db
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
204B
MD5724426cbdadfbfe08efd2bd0fda836d2
SHA197e68441c74b23789c0e792a3fa7121a454f30d1
SHA2563202f92580d8dbbfa62ecc83fa1df539d33ece9f4c015d608ae15bdc0eeff252
SHA512631a9729484f2330b55b837b4d561c8c85ef5eaafc2150fe023080b56d1b1ba4248efe26e0f796c0afdf2e6fbd7368217f099531cc6f11c7d6a2de169a85a21c
-
Filesize
36B
MD56783c3ee07c7d151ceac57f1f9c8bed7
SHA117468f98f95bf504cc1f83c49e49a78526b3ea03
SHA2568ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322
SHA512c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8
-
Filesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
Filesize
197B
MD58088241160261560a02c84025d107592
SHA1083121f7027557570994c9fc211df61730455bb5
SHA2562072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1
SHA51220d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478