Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2024, 02:01
Behavioral task
behavioral1
Sample
JaffaCakes118_9b0a5f42d1ac58b0a6513d3d41b638c5757268a0bf012c0344c16fad9e124254.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_9b0a5f42d1ac58b0a6513d3d41b638c5757268a0bf012c0344c16fad9e124254.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_9b0a5f42d1ac58b0a6513d3d41b638c5757268a0bf012c0344c16fad9e124254.exe
-
Size
1.3MB
-
MD5
83b2f842bf049010a6f5efcd7cc633b4
-
SHA1
57daa8df96556dde2bb2a64d38815fb572c2c3bc
-
SHA256
9b0a5f42d1ac58b0a6513d3d41b638c5757268a0bf012c0344c16fad9e124254
-
SHA512
8838de90aac93883bc0c67b5a11128609c1a3207b56fe0b1e5b9a1fcc800284b0b71d42d837e1c532846f2cab81b13196a2e313d74eb28bb2b683819782ca0fd
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Process spawned unexpected child process 45 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 832 2112 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 740 2112 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3316 2112 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2644 2112 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4024 2112 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1052 2112 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2476 2112 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3636 2112 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1164 2112 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3216 2112 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3696 2112 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2912 2112 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2540 2112 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3592 2112 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 228 2112 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 364 2112 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2668 2112 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4704 2112 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4380 2112 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 764 2112 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4156 2112 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2292 2112 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4584 2112 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4560 2112 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1156 2112 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2872 2112 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1912 2112 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4608 2112 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4604 2112 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1364 2112 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 376 2112 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3096 2112 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3176 2112 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4864 2112 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4796 2112 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2796 2112 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2892 2112 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1232 2112 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 184 2112 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1216 2112 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3624 2112 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1388 2112 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3396 2112 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 452 2112 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 684 2112 schtasks.exe 88 -
resource yara_rule behavioral2/files/0x0007000000023c65-10.dat dcrat behavioral2/memory/4820-13-0x0000000000600000-0x0000000000710000-memory.dmp dcrat -
Command and Scripting Interpreter: PowerShell 1 TTPs 16 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 1560 powershell.exe 4832 powershell.exe 1864 powershell.exe 4724 powershell.exe 3860 powershell.exe 2100 powershell.exe 3452 powershell.exe 3828 powershell.exe 4392 powershell.exe 2228 powershell.exe 2708 powershell.exe 720 powershell.exe 2368 powershell.exe 1696 powershell.exe 1196 powershell.exe 3980 powershell.exe -
Checks computer location settings 2 TTPs 17 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation JaffaCakes118_9b0a5f42d1ac58b0a6513d3d41b638c5757268a0bf012c0344c16fad9e124254.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation Idle.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation Idle.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation Idle.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation Idle.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation Idle.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation Idle.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation Idle.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation DllCommonsvc.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation Idle.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation Idle.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation Idle.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation Idle.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation Idle.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation Idle.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation Idle.exe -
Executes dropped EXE 16 IoCs
pid Process 4820 DllCommonsvc.exe 2212 Idle.exe 3836 Idle.exe 4108 Idle.exe 4376 Idle.exe 2220 Idle.exe 2392 Idle.exe 2008 Idle.exe 2476 Idle.exe 5024 Idle.exe 3640 Idle.exe 2364 Idle.exe 912 Idle.exe 3056 Idle.exe 2892 Idle.exe 5004 Idle.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 15 IoCs
flow ioc 18 raw.githubusercontent.com 39 raw.githubusercontent.com 45 raw.githubusercontent.com 54 raw.githubusercontent.com 56 raw.githubusercontent.com 23 raw.githubusercontent.com 50 raw.githubusercontent.com 16 raw.githubusercontent.com 38 raw.githubusercontent.com 40 raw.githubusercontent.com 43 raw.githubusercontent.com 46 raw.githubusercontent.com 52 raw.githubusercontent.com 53 raw.githubusercontent.com 55 raw.githubusercontent.com -
Drops file in Program Files directory 15 IoCs
description ioc Process File created C:\Program Files\Windows Defender\it-IT\886983d96e3d3e DllCommonsvc.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\fontdrvhost.exe DllCommonsvc.exe File created C:\Program Files (x86)\Windows Portable Devices\ea1d8f6d871115 DllCommonsvc.exe File created C:\Program Files\Windows Defender\es-ES\sppsvc.exe DllCommonsvc.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\SppExtComObj.exe DllCommonsvc.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\e1ef82546f0b02 DllCommonsvc.exe File created C:\Program Files\Windows Defender\it-IT\csrss.exe DllCommonsvc.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\5b884080fd4f94 DllCommonsvc.exe File created C:\Program Files\ModifiableWindowsApps\Registry.exe DllCommonsvc.exe File created C:\Program Files\VideoLAN\VLC\plugins\spu\StartMenuExperienceHost.exe DllCommonsvc.exe File created C:\Program Files\VideoLAN\VLC\plugins\spu\55b276f4edf653 DllCommonsvc.exe File created C:\Program Files\Windows Defender\es-ES\0a1fd5f707cd16 DllCommonsvc.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\smss.exe DllCommonsvc.exe File created C:\Program Files (x86)\Windows Portable Devices\upfc.exe DllCommonsvc.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\69ddcba757bf72 DllCommonsvc.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\WinSxS\wow64_microsoft-windows-web-app-host.resources_31bf3856ad364e35_10.0.19041.1_en-us_589340c13ae35eb0\winlogon.exe DllCommonsvc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_9b0a5f42d1ac58b0a6513d3d41b638c5757268a0bf012c0344c16fad9e124254.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies registry class 15 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings Idle.exe Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings Idle.exe Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings Idle.exe Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings Idle.exe Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings Idle.exe Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings Idle.exe Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings Idle.exe Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings Idle.exe Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings Idle.exe Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings Idle.exe Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings Idle.exe Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings Idle.exe Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings Idle.exe Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings Idle.exe Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings JaffaCakes118_9b0a5f42d1ac58b0a6513d3d41b638c5757268a0bf012c0344c16fad9e124254.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 45 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4024 schtasks.exe 2912 schtasks.exe 1156 schtasks.exe 3176 schtasks.exe 4704 schtasks.exe 4156 schtasks.exe 2292 schtasks.exe 4864 schtasks.exe 3696 schtasks.exe 2540 schtasks.exe 228 schtasks.exe 364 schtasks.exe 3636 schtasks.exe 3216 schtasks.exe 4560 schtasks.exe 2796 schtasks.exe 1164 schtasks.exe 3592 schtasks.exe 2892 schtasks.exe 376 schtasks.exe 740 schtasks.exe 2476 schtasks.exe 4380 schtasks.exe 2872 schtasks.exe 3396 schtasks.exe 452 schtasks.exe 832 schtasks.exe 4584 schtasks.exe 184 schtasks.exe 1388 schtasks.exe 4604 schtasks.exe 3096 schtasks.exe 1232 schtasks.exe 1216 schtasks.exe 2644 schtasks.exe 1052 schtasks.exe 2668 schtasks.exe 1912 schtasks.exe 684 schtasks.exe 4796 schtasks.exe 3624 schtasks.exe 3316 schtasks.exe 764 schtasks.exe 4608 schtasks.exe 1364 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4820 DllCommonsvc.exe 4820 DllCommonsvc.exe 4820 DllCommonsvc.exe 4820 DllCommonsvc.exe 4820 DllCommonsvc.exe 4820 DllCommonsvc.exe 4820 DllCommonsvc.exe 4820 DllCommonsvc.exe 4820 DllCommonsvc.exe 4820 DllCommonsvc.exe 4820 DllCommonsvc.exe 4820 DllCommonsvc.exe 4820 DllCommonsvc.exe 4820 DllCommonsvc.exe 4820 DllCommonsvc.exe 4820 DllCommonsvc.exe 4820 DllCommonsvc.exe 4820 DllCommonsvc.exe 4820 DllCommonsvc.exe 4820 DllCommonsvc.exe 4820 DllCommonsvc.exe 4820 DllCommonsvc.exe 4820 DllCommonsvc.exe 4820 DllCommonsvc.exe 4820 DllCommonsvc.exe 4820 DllCommonsvc.exe 4820 DllCommonsvc.exe 3860 powershell.exe 3860 powershell.exe 1196 powershell.exe 1196 powershell.exe 2368 powershell.exe 2368 powershell.exe 2100 powershell.exe 2100 powershell.exe 720 powershell.exe 720 powershell.exe 1696 powershell.exe 1696 powershell.exe 4832 powershell.exe 4832 powershell.exe 3828 powershell.exe 3828 powershell.exe 4392 powershell.exe 4392 powershell.exe 4724 powershell.exe 4724 powershell.exe 1560 powershell.exe 1560 powershell.exe 2228 powershell.exe 2228 powershell.exe 720 powershell.exe 2708 powershell.exe 2708 powershell.exe 3980 powershell.exe 3980 powershell.exe 1696 powershell.exe 3452 powershell.exe 3452 powershell.exe 1864 powershell.exe 1864 powershell.exe 2212 Idle.exe 2212 Idle.exe 3860 powershell.exe -
Suspicious use of AdjustPrivilegeToken 32 IoCs
description pid Process Token: SeDebugPrivilege 4820 DllCommonsvc.exe Token: SeDebugPrivilege 3860 powershell.exe Token: SeDebugPrivilege 1196 powershell.exe Token: SeDebugPrivilege 2368 powershell.exe Token: SeDebugPrivilege 2100 powershell.exe Token: SeDebugPrivilege 4832 powershell.exe Token: SeDebugPrivilege 1696 powershell.exe Token: SeDebugPrivilege 720 powershell.exe Token: SeDebugPrivilege 3828 powershell.exe Token: SeDebugPrivilege 4392 powershell.exe Token: SeDebugPrivilege 4724 powershell.exe Token: SeDebugPrivilege 1560 powershell.exe Token: SeDebugPrivilege 3452 powershell.exe Token: SeDebugPrivilege 2212 Idle.exe Token: SeDebugPrivilege 2228 powershell.exe Token: SeDebugPrivilege 2708 powershell.exe Token: SeDebugPrivilege 3980 powershell.exe Token: SeDebugPrivilege 1864 powershell.exe Token: SeDebugPrivilege 3836 Idle.exe Token: SeDebugPrivilege 4108 Idle.exe Token: SeDebugPrivilege 4376 Idle.exe Token: SeDebugPrivilege 2220 Idle.exe Token: SeDebugPrivilege 2392 Idle.exe Token: SeDebugPrivilege 2008 Idle.exe Token: SeDebugPrivilege 2476 Idle.exe Token: SeDebugPrivilege 5024 Idle.exe Token: SeDebugPrivilege 3640 Idle.exe Token: SeDebugPrivilege 2364 Idle.exe Token: SeDebugPrivilege 912 Idle.exe Token: SeDebugPrivilege 3056 Idle.exe Token: SeDebugPrivilege 2892 Idle.exe Token: SeDebugPrivilege 5004 Idle.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3448 wrote to memory of 2220 3448 JaffaCakes118_9b0a5f42d1ac58b0a6513d3d41b638c5757268a0bf012c0344c16fad9e124254.exe 83 PID 3448 wrote to memory of 2220 3448 JaffaCakes118_9b0a5f42d1ac58b0a6513d3d41b638c5757268a0bf012c0344c16fad9e124254.exe 83 PID 3448 wrote to memory of 2220 3448 JaffaCakes118_9b0a5f42d1ac58b0a6513d3d41b638c5757268a0bf012c0344c16fad9e124254.exe 83 PID 2220 wrote to memory of 2812 2220 WScript.exe 85 PID 2220 wrote to memory of 2812 2220 WScript.exe 85 PID 2220 wrote to memory of 2812 2220 WScript.exe 85 PID 2812 wrote to memory of 4820 2812 cmd.exe 87 PID 2812 wrote to memory of 4820 2812 cmd.exe 87 PID 4820 wrote to memory of 1864 4820 DllCommonsvc.exe 135 PID 4820 wrote to memory of 1864 4820 DllCommonsvc.exe 135 PID 4820 wrote to memory of 4724 4820 DllCommonsvc.exe 136 PID 4820 wrote to memory of 4724 4820 DllCommonsvc.exe 136 PID 4820 wrote to memory of 2368 4820 DllCommonsvc.exe 137 PID 4820 wrote to memory of 2368 4820 DllCommonsvc.exe 137 PID 4820 wrote to memory of 3860 4820 DllCommonsvc.exe 138 PID 4820 wrote to memory of 3860 4820 DllCommonsvc.exe 138 PID 4820 wrote to memory of 1696 4820 DllCommonsvc.exe 139 PID 4820 wrote to memory of 1696 4820 DllCommonsvc.exe 139 PID 4820 wrote to memory of 1196 4820 DllCommonsvc.exe 140 PID 4820 wrote to memory of 1196 4820 DllCommonsvc.exe 140 PID 4820 wrote to memory of 4832 4820 DllCommonsvc.exe 141 PID 4820 wrote to memory of 4832 4820 DllCommonsvc.exe 141 PID 4820 wrote to memory of 1560 4820 DllCommonsvc.exe 142 PID 4820 wrote to memory of 1560 4820 DllCommonsvc.exe 142 PID 4820 wrote to memory of 720 4820 DllCommonsvc.exe 143 PID 4820 wrote to memory of 720 4820 DllCommonsvc.exe 143 PID 4820 wrote to memory of 2708 4820 DllCommonsvc.exe 144 PID 4820 wrote to memory of 2708 4820 DllCommonsvc.exe 144 PID 4820 wrote to memory of 3980 4820 DllCommonsvc.exe 146 PID 4820 wrote to memory of 3980 4820 DllCommonsvc.exe 146 PID 4820 wrote to memory of 3452 4820 DllCommonsvc.exe 147 PID 4820 wrote to memory of 3452 4820 DllCommonsvc.exe 147 PID 4820 wrote to memory of 2228 4820 DllCommonsvc.exe 148 PID 4820 wrote to memory of 2228 4820 DllCommonsvc.exe 148 PID 4820 wrote to memory of 3828 4820 DllCommonsvc.exe 149 PID 4820 wrote to memory of 3828 4820 DllCommonsvc.exe 149 PID 4820 wrote to memory of 4392 4820 DllCommonsvc.exe 151 PID 4820 wrote to memory of 4392 4820 DllCommonsvc.exe 151 PID 4820 wrote to memory of 2100 4820 DllCommonsvc.exe 152 PID 4820 wrote to memory of 2100 4820 DllCommonsvc.exe 152 PID 4820 wrote to memory of 2212 4820 DllCommonsvc.exe 166 PID 4820 wrote to memory of 2212 4820 DllCommonsvc.exe 166 PID 2212 wrote to memory of 4304 2212 Idle.exe 171 PID 2212 wrote to memory of 4304 2212 Idle.exe 171 PID 4304 wrote to memory of 2032 4304 cmd.exe 175 PID 4304 wrote to memory of 2032 4304 cmd.exe 175 PID 4304 wrote to memory of 3836 4304 cmd.exe 178 PID 4304 wrote to memory of 3836 4304 cmd.exe 178 PID 3836 wrote to memory of 1052 3836 Idle.exe 184 PID 3836 wrote to memory of 1052 3836 Idle.exe 184 PID 1052 wrote to memory of 2008 1052 cmd.exe 186 PID 1052 wrote to memory of 2008 1052 cmd.exe 186 PID 1052 wrote to memory of 4108 1052 cmd.exe 188 PID 1052 wrote to memory of 4108 1052 cmd.exe 188 PID 4108 wrote to memory of 3180 4108 Idle.exe 193 PID 4108 wrote to memory of 3180 4108 Idle.exe 193 PID 3180 wrote to memory of 4340 3180 cmd.exe 195 PID 3180 wrote to memory of 4340 3180 cmd.exe 195 PID 3180 wrote to memory of 4376 3180 cmd.exe 197 PID 3180 wrote to memory of 4376 3180 cmd.exe 197 PID 4376 wrote to memory of 1864 4376 Idle.exe 199 PID 4376 wrote to memory of 1864 4376 Idle.exe 199 PID 1864 wrote to memory of 4124 1864 cmd.exe 201 PID 1864 wrote to memory of 4124 1864 cmd.exe 201 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9b0a5f42d1ac58b0a6513d3d41b638c5757268a0bf012c0344c16fad9e124254.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9b0a5f42d1ac58b0a6513d3d41b638c5757268a0bf012c0344c16fad9e124254.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3448 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\providercommon\DllCommonsvc.exe"C:\providercommon\DllCommonsvc.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1864
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\upfc.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4724
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\SppExtComObj.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2368
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\wininit.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3860
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Defender\it-IT\csrss.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1696
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\VideoLAN\VLC\plugins\spu\StartMenuExperienceHost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1196
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\TextInputHost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4832
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\fontdrvhost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1560
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Portable Devices\upfc.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:720
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\RuntimeBroker.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2708
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Defender\es-ES\sppsvc.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3980
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\Idle.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3452
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\smss.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2228
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\regid.1991-06.com.microsoft\Idle.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3828
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\System.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4392
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Cookies\winlogon.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2100
-
-
C:\Users\All Users\regid.1991-06.com.microsoft\Idle.exe"C:\Users\All Users\regid.1991-06.com.microsoft\Idle.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\etpQuxQFPn.bat"6⤵
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:27⤵PID:2032
-
-
C:\Users\All Users\regid.1991-06.com.microsoft\Idle.exe"C:\Users\All Users\regid.1991-06.com.microsoft\Idle.exe"7⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3836 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\3jGxsc69Nm.bat"8⤵
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:29⤵PID:2008
-
-
C:\Users\All Users\regid.1991-06.com.microsoft\Idle.exe"C:\Users\All Users\regid.1991-06.com.microsoft\Idle.exe"9⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4108 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\7aJ3FmDw0K.bat"10⤵
- Suspicious use of WriteProcessMemory
PID:3180 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:211⤵PID:4340
-
-
C:\Users\All Users\regid.1991-06.com.microsoft\Idle.exe"C:\Users\All Users\regid.1991-06.com.microsoft\Idle.exe"11⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4376 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\BYj1kG62r9.bat"12⤵
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:213⤵PID:4124
-
-
C:\Users\All Users\regid.1991-06.com.microsoft\Idle.exe"C:\Users\All Users\regid.1991-06.com.microsoft\Idle.exe"13⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2220 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Z4XVup0LT1.bat"14⤵PID:1640
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:215⤵PID:4492
-
-
C:\Users\All Users\regid.1991-06.com.microsoft\Idle.exe"C:\Users\All Users\regid.1991-06.com.microsoft\Idle.exe"15⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2392 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\3a8tNGcxSj.bat"16⤵PID:4724
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:217⤵PID:992
-
-
C:\Users\All Users\regid.1991-06.com.microsoft\Idle.exe"C:\Users\All Users\regid.1991-06.com.microsoft\Idle.exe"17⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2008 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ZAtO29mfgG.bat"18⤵PID:2708
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:219⤵PID:1488
-
-
C:\Users\All Users\regid.1991-06.com.microsoft\Idle.exe"C:\Users\All Users\regid.1991-06.com.microsoft\Idle.exe"19⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2476 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\sodlpYYBfa.bat"20⤵PID:1480
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:221⤵PID:2860
-
-
C:\Users\All Users\regid.1991-06.com.microsoft\Idle.exe"C:\Users\All Users\regid.1991-06.com.microsoft\Idle.exe"21⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:5024 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\m1XclINWiF.bat"22⤵PID:1864
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:223⤵PID:1656
-
-
C:\Users\All Users\regid.1991-06.com.microsoft\Idle.exe"C:\Users\All Users\regid.1991-06.com.microsoft\Idle.exe"23⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3640 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\DJG58brWjr.bat"24⤵PID:4492
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:225⤵PID:3028
-
-
C:\Users\All Users\regid.1991-06.com.microsoft\Idle.exe"C:\Users\All Users\regid.1991-06.com.microsoft\Idle.exe"25⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2364 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Z4XVup0LT1.bat"26⤵PID:2232
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:227⤵PID:3152
-
-
C:\Users\All Users\regid.1991-06.com.microsoft\Idle.exe"C:\Users\All Users\regid.1991-06.com.microsoft\Idle.exe"27⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:912 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\BYj1kG62r9.bat"28⤵PID:3092
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:229⤵PID:2744
-
-
C:\Users\All Users\regid.1991-06.com.microsoft\Idle.exe"C:\Users\All Users\regid.1991-06.com.microsoft\Idle.exe"29⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3056 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ZAtO29mfgG.bat"30⤵PID:1576
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:231⤵PID:3928
-
-
C:\Users\All Users\regid.1991-06.com.microsoft\Idle.exe"C:\Users\All Users\regid.1991-06.com.microsoft\Idle.exe"31⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2892 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ZAtO29mfgG.bat"32⤵PID:2208
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:233⤵PID:1156
-
-
C:\Users\All Users\regid.1991-06.com.microsoft\Idle.exe"C:\Users\All Users\regid.1991-06.com.microsoft\Idle.exe"33⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5004
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "upfcu" /sc MINUTE /mo 6 /tr "'C:\providercommon\upfc.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:832
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\providercommon\upfc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:740
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "upfcu" /sc MINUTE /mo 6 /tr "'C:\providercommon\upfc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3316
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 14 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\SppExtComObj.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2644
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\SppExtComObj.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4024
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 13 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\SppExtComObj.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1052
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\wininit.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2476
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\wininit.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3636
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\wininit.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1164
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Defender\it-IT\csrss.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3216
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\it-IT\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3696
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Defender\it-IT\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2912
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 6 /tr "'C:\Program Files\VideoLAN\VLC\plugins\spu\StartMenuExperienceHost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2540
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\VLC\plugins\spu\StartMenuExperienceHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3592
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 8 /tr "'C:\Program Files\VideoLAN\VLC\plugins\spu\StartMenuExperienceHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:228
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 9 /tr "'C:\providercommon\TextInputHost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:364
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\providercommon\TextInputHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2668
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 11 /tr "'C:\providercommon\TextInputHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4704
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\fontdrvhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4380
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:764
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4156
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "upfcu" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Portable Devices\upfc.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2292
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\upfc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4584
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "upfcu" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Portable Devices\upfc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4560
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\providercommon\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1156
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\providercommon\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2872
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\providercommon\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1912
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Defender\es-ES\sppsvc.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4608
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\es-ES\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4604
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Defender\es-ES\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1364
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 10 /tr "'C:\providercommon\Idle.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:376
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\providercommon\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3096
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\providercommon\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3176
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\smss.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4864
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4796
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2796
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\regid.1991-06.com.microsoft\Idle.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2892
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Users\All Users\regid.1991-06.com.microsoft\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1232
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\regid.1991-06.com.microsoft\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:184
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'C:\providercommon\System.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1216
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\providercommon\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3624
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 8 /tr "'C:\providercommon\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1388
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'C:\Users\Admin\Cookies\winlogon.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3396
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Users\Admin\Cookies\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:452
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\Cookies\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:684
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5baf55b95da4a601229647f25dad12878
SHA1abc16954ebfd213733c4493fc1910164d825cac8
SHA256ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
SHA51224f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD54d8567f2d1c8a09bbfe613145bf78577
SHA1f2af10d629e6d7d2ecec76c34bd755ecf61be931
SHA2567437b098af4618fbcefe7522942c862aeaf39a0b82ce05b0797185c552f22a3c
SHA51289130e5c514e33f5108e308f300614dc63989f3e6a4e762a12982af341ab1c5748dd93fd185698dcf6d3a1ea7234228d04ad962e4ee0a15a683e988f115a84ea
-
Filesize
944B
MD5bd5940f08d0be56e65e5f2aaf47c538e
SHA1d7e31b87866e5e383ab5499da64aba50f03e8443
SHA2562d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6
SHA512c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406
-
Filesize
944B
MD5cadef9abd087803c630df65264a6c81c
SHA1babbf3636c347c8727c35f3eef2ee643dbcc4bd2
SHA256cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438
SHA5127278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085
-
Filesize
944B
MD53a6bad9528f8e23fb5c77fbd81fa28e8
SHA1f127317c3bc6407f536c0f0600dcbcf1aabfba36
SHA256986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05
SHA512846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2
-
Filesize
944B
MD5e243a38635ff9a06c87c2a61a2200656
SHA1ecd95ed5bf1a9fbe96a8448fc2814a0210fa2afc
SHA256af5782703f3f2d5a29fb313dae6680a64134db26064d4a321a3f23b75f6ca00f
SHA5124418957a1b10eee44cf270c81816ae707352411c4f5ac14b6b61ab537c91480e24e0a0a2c276a6291081b4984c123cf673a45dcedb0ceeef682054ba0fc19cb4
-
Filesize
944B
MD5e448fe0d240184c6597a31d3be2ced58
SHA1372b8d8c19246d3e38cd3ba123cc0f56070f03cd
SHA256c660f0db85a1e7f0f68db19868979bf50bd541531babf77a701e1b1ce5e6a391
SHA5120b7f7eae7700d32b18eee3677cb7f89b46ace717fa7e6b501d6c47d54f15dff7e12b49f5a7d36a6ffe4c16165c7d55162db4f3621db545b6af638035752beab4
-
Filesize
220B
MD51b6c9682c5581c6a2aa2b643077b279a
SHA1e2dab127f321facd83066d44f9405b0c50a367aa
SHA2567edeab69712a1f50fba992bd4b86b3abd71912b642458c7ad2f285e816c22aab
SHA51203c0ff797c641c09533b30c7f61146983bd15825f6d1548f8bcd3736fbfc33935d6d327fc08297dd86fec98f4eeef730b1c4281d00bc024b7fb20d217e3e21b4
-
Filesize
220B
MD5b94103fb5d097336e6349d00e0a81014
SHA10026b15094edb52bf368241b325abd6e2ccb768e
SHA256a721d01caab61e38381a9761e9c4b87aa85d0d1f0949319284ee00863b8fb7fd
SHA5121bcdad610f24334b757777f5022a657895a1e696fb951c5a2f4e2603977406a46bf6aa4b6cc56b040d8a58a3f9a4ae3f2288fdccb3ec5bd029099c1502deccd4
-
Filesize
220B
MD54a859b23561be37dfca9c74572b475fe
SHA1b5715954a8b3017d9a5e0f876dbbcb8ffd45d052
SHA256c6c0d8a023430ab12a992def27781b38eef3747f2e3f686292de0eed3bab2502
SHA51208ce5d661d43e6d65220be609277fbf9d9284d4096e5a91da06bb9efbc0c77e843bf4d6db2387f2996199222ec3931eedfdec4ad557b9d95d2b4d4723fec0595
-
Filesize
220B
MD59d9b5e7dc479060c3ede18a23cab31c0
SHA1f549dd86b0a9f0bcac6895343c4f4f76aaabac12
SHA2569a6dc35cffa53c0febbea6eba076c1c8fc2180a70098d8f41adba85d33429330
SHA512e78895d3db4935e990a68567f739560acc6dc46e63ea0abe29b382bbcfdd8dce9146208431cbf4797def720c388969bdac32b6037592816c346044fafbff5d95
-
Filesize
220B
MD50eaf0b6d61f20e1bf9ad31736502dd9e
SHA10ec64eca5f4150b5b0c1f11e058f4342af4d7ecf
SHA256e72a0b847374350c1a71cec25c518e1cdce6ccb2b561868ab5c7fbbcccab4de1
SHA512672b024214fd5cb870c63bba8abf7ccdffe519f1db0b97d084b3c2628d7f9a1215d3d5b427235325a11ef3fa82307a458768df17f9551822715b19ee9b20863d
-
Filesize
220B
MD5e7f83f2ba0a921c379c82e10a278fde4
SHA197a4f70a47c716151f0a811712880cd79e8c89f0
SHA25604c60d8dfd30820782c7084049ef9986c9610ad3cb90cc550d77ff93ee4ad7f3
SHA5127b10e3599c237e5b7d9ca2ee1cf5a1a6946c0bc01c095d9df7b2ea350229d60f4725c407ef0f7864253f47e8fee8eabb742949c710eb0908ac0ee01ea876ced6
-
Filesize
220B
MD580969adfb0867e0506dab3b593a373e4
SHA17fbfb3ddc92e4d22e5f672d67412f5a073caff9a
SHA256adf8a9588dfc9248712826014341075449b3fd3a525361d83e4bc0cd3efe9179
SHA51205ada54099144b7f5b897f8dae5dc47e87f6d57faa1da9044663cd96189b607a8bb214ba81d08e7587fb19c1e5cd5c17d5149c4335c36ec7c3fc108acd82819a
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
220B
MD5f9f57d45610a0dc12fa056f32ce2b4b4
SHA1bcdb3c1df1faae19e399764c92a935b9fd0f21cc
SHA256d50a0670eeacac2f3a7875e8d1cabd45a4d9040ddcfd072918550d7f7b895b01
SHA51288c1b736e963c2b90201f5bf1b72d7c38a683dd666cbb8e349f41d16d62e266c248238f087c99a8d25f970f6f20b342b67d271a9b29df9ebf931d18bd86a22ca
-
Filesize
220B
MD51f5bb61983fa20374583c761d03a505f
SHA1e22ce42d350156b80ce8f8be37ee9d5233e33951
SHA2566af69b29a11603463e7dc302c8501620f4077cd904309c7188203991e5649b0e
SHA512928a7fa9b30539104c95d0c731bf7ae5d4989bf654b6111adc92790ad8f603cb50a78acfe0dd1b061e96740c80ff9200b4b0257c2d46b2b666d3fe1c7b0ff24d
-
Filesize
220B
MD595f3713aa143f6aa960ea2424e83f1ac
SHA1deee694603fdb72006567e973c79cdb1e5f9fd0c
SHA2565d896823a21bcaa53cc3133afda4f5b966a9524b1562a4b446bc757fd67b5d31
SHA51226783cbb1ee0456d34a1e0496fdf0ee39024e09bfaac1066b5a57d33d98abf512fff4303122af29e48003bf4946a212aaaaea193d00a696edb2d0cd3c9063651
-
Filesize
36B
MD56783c3ee07c7d151ceac57f1f9c8bed7
SHA117468f98f95bf504cc1f83c49e49a78526b3ea03
SHA2568ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322
SHA512c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8
-
Filesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
Filesize
197B
MD58088241160261560a02c84025d107592
SHA1083121f7027557570994c9fc211df61730455bb5
SHA2562072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1
SHA51220d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478