Malware Analysis Report

2025-08-11 05:05

Sample ID 241230-cmsnhavken
Target JaffaCakes118_7904ef7344839fd1821fc0752a0fca2d1f2e5b960abad349965a765a938c83b3
SHA256 7904ef7344839fd1821fc0752a0fca2d1f2e5b960abad349965a765a938c83b3
Tags
rat dcrat discovery execution infostealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

7904ef7344839fd1821fc0752a0fca2d1f2e5b960abad349965a765a938c83b3

Threat Level: Known bad

The file JaffaCakes118_7904ef7344839fd1821fc0752a0fca2d1f2e5b960abad349965a765a938c83b3 was found to be: Known bad.

Malicious Activity Summary

rat dcrat discovery execution infostealer

DcRat

Process spawned unexpected child process

DCRat payload

Dcrat family

DCRat payload

Command and Scripting Interpreter: PowerShell

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Legitimate hosting services abused for malware hosting/C2

Drops file in Windows directory

Drops file in Program Files directory

Unsigned PE

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Scheduled Task/Job: Scheduled Task

Modifies registry class

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-12-30 02:11

Signatures

DCRat payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

Dcrat family

dcrat

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-12-30 02:11

Reported

2024-12-30 02:14

Platform

win7-20240903-en

Max time kernel

144s

Max time network

140s

Command Line

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7904ef7344839fd1821fc0752a0fca2d1f2e5b960abad349965a765a938c83b3.exe"

Signatures

DcRat

rat infostealer dcrat

Dcrat family

dcrat

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe

DCRat payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\resources\1033\75a57c1bdf437c C:\providercommon\DllCommonsvc.exe N/A
File created C:\Program Files\Google\Chrome\Application\lsm.exe C:\providercommon\DllCommonsvc.exe N/A
File created C:\Program Files (x86)\Windows NT\Accessories\ja-JP\886983d96e3d3e C:\providercommon\DllCommonsvc.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\System\System.exe C:\providercommon\DllCommonsvc.exe N/A
File created C:\Program Files (x86)\Common Files\System\27d1bcfc3c54e0 C:\providercommon\DllCommonsvc.exe N/A
File created C:\Program Files (x86)\Windows NT\Accessories\ja-JP\csrss.exe C:\providercommon\DllCommonsvc.exe N/A
File created C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\resources\1033\WMIADAP.exe C:\providercommon\DllCommonsvc.exe N/A
File created C:\Program Files\Google\Chrome\Application\101b941d020240 C:\providercommon\DllCommonsvc.exe N/A
File created C:\Program Files (x86)\Common Files\System\System.exe C:\providercommon\DllCommonsvc.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7904ef7344839fd1821fc0752a0fca2d1f2e5b960abad349965a765a938c83b3.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WScript.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\providercommon\DllCommonsvc.exe N/A
N/A N/A C:\providercommon\DllCommonsvc.exe N/A
N/A N/A C:\providercommon\DllCommonsvc.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Default User\lsass.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Default User\lsass.exe N/A
N/A N/A C:\Users\Default User\lsass.exe N/A
N/A N/A C:\Users\Default User\lsass.exe N/A
N/A N/A C:\Users\Default User\lsass.exe N/A
N/A N/A C:\Users\Default User\lsass.exe N/A
N/A N/A C:\Users\Default User\lsass.exe N/A
N/A N/A C:\Users\Default User\lsass.exe N/A
N/A N/A C:\Users\Default User\lsass.exe N/A
N/A N/A C:\Users\Default User\lsass.exe N/A
N/A N/A C:\Users\Default User\lsass.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\providercommon\DllCommonsvc.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Default User\lsass.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Default User\lsass.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Default User\lsass.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Default User\lsass.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Default User\lsass.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Default User\lsass.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Default User\lsass.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Default User\lsass.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Default User\lsass.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Default User\lsass.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Default User\lsass.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2148 wrote to memory of 2184 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7904ef7344839fd1821fc0752a0fca2d1f2e5b960abad349965a765a938c83b3.exe C:\Windows\SysWOW64\WScript.exe
PID 2148 wrote to memory of 2184 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7904ef7344839fd1821fc0752a0fca2d1f2e5b960abad349965a765a938c83b3.exe C:\Windows\SysWOW64\WScript.exe
PID 2148 wrote to memory of 2184 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7904ef7344839fd1821fc0752a0fca2d1f2e5b960abad349965a765a938c83b3.exe C:\Windows\SysWOW64\WScript.exe
PID 2148 wrote to memory of 2184 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7904ef7344839fd1821fc0752a0fca2d1f2e5b960abad349965a765a938c83b3.exe C:\Windows\SysWOW64\WScript.exe
PID 2184 wrote to memory of 1272 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2184 wrote to memory of 1272 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2184 wrote to memory of 1272 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2184 wrote to memory of 1272 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 1272 wrote to memory of 2688 N/A C:\Windows\SysWOW64\cmd.exe C:\providercommon\DllCommonsvc.exe
PID 1272 wrote to memory of 2688 N/A C:\Windows\SysWOW64\cmd.exe C:\providercommon\DllCommonsvc.exe
PID 1272 wrote to memory of 2688 N/A C:\Windows\SysWOW64\cmd.exe C:\providercommon\DllCommonsvc.exe
PID 1272 wrote to memory of 2688 N/A C:\Windows\SysWOW64\cmd.exe C:\providercommon\DllCommonsvc.exe
PID 2688 wrote to memory of 888 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2688 wrote to memory of 888 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2688 wrote to memory of 888 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2688 wrote to memory of 2460 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2688 wrote to memory of 2460 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2688 wrote to memory of 2460 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2688 wrote to memory of 704 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2688 wrote to memory of 704 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2688 wrote to memory of 704 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2688 wrote to memory of 2424 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2688 wrote to memory of 2424 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2688 wrote to memory of 2424 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2688 wrote to memory of 2324 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2688 wrote to memory of 2324 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2688 wrote to memory of 2324 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2688 wrote to memory of 2540 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2688 wrote to memory of 2540 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2688 wrote to memory of 2540 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2688 wrote to memory of 2520 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2688 wrote to memory of 2520 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2688 wrote to memory of 2520 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2688 wrote to memory of 2228 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2688 wrote to memory of 2228 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2688 wrote to memory of 2228 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2688 wrote to memory of 780 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2688 wrote to memory of 780 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2688 wrote to memory of 780 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2688 wrote to memory of 1776 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2688 wrote to memory of 1776 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2688 wrote to memory of 1776 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2688 wrote to memory of 564 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2688 wrote to memory of 564 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2688 wrote to memory of 564 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2688 wrote to memory of 2512 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2688 wrote to memory of 2512 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2688 wrote to memory of 2512 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2688 wrote to memory of 2172 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2688 wrote to memory of 2172 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2688 wrote to memory of 2172 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2688 wrote to memory of 592 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2688 wrote to memory of 592 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2688 wrote to memory of 592 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2688 wrote to memory of 2420 N/A C:\providercommon\DllCommonsvc.exe C:\Users\Default User\lsass.exe
PID 2688 wrote to memory of 2420 N/A C:\providercommon\DllCommonsvc.exe C:\Users\Default User\lsass.exe
PID 2688 wrote to memory of 2420 N/A C:\providercommon\DllCommonsvc.exe C:\Users\Default User\lsass.exe
PID 2420 wrote to memory of 2284 N/A C:\Users\Default User\lsass.exe C:\Windows\System32\cmd.exe
PID 2420 wrote to memory of 2284 N/A C:\Users\Default User\lsass.exe C:\Windows\System32\cmd.exe
PID 2420 wrote to memory of 2284 N/A C:\Users\Default User\lsass.exe C:\Windows\System32\cmd.exe
PID 2284 wrote to memory of 2224 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 2284 wrote to memory of 2224 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 2284 wrote to memory of 2224 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 2284 wrote to memory of 1920 N/A C:\Windows\System32\cmd.exe C:\Users\Default User\lsass.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7904ef7344839fd1821fc0752a0fca2d1f2e5b960abad349965a765a938c83b3.exe

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7904ef7344839fd1821fc0752a0fca2d1f2e5b960abad349965a765a938c83b3.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\providercommon\1zu9dW.bat" "

C:\providercommon\DllCommonsvc.exe

"C:\providercommon\DllCommonsvc.exe"

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Common Files\System\System.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\System\System.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Common Files\System\System.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows NT\Accessories\ja-JP\csrss.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\Accessories\ja-JP\csrss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows NT\Accessories\ja-JP\csrss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\spoolsv.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\spoolsv.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\spoolsv.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\providercommon\wininit.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\providercommon\wininit.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 6 /tr "'C:\providercommon\wininit.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\Users\All Users\Desktop\Idle.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Users\All Users\Desktop\Idle.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\Desktop\Idle.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\audiodg.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\MSOCache\All Users\audiodg.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\audiodg.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\Links\conhost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Users\Admin\Links\conhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 14 /tr "'C:\Users\Admin\Links\conhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\resources\1033\WMIADAP.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "WMIADAP" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\resources\1033\WMIADAP.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\resources\1033\WMIADAP.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\winlogon.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\winlogon.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\winlogon.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "lsml" /sc MINUTE /mo 5 /tr "'C:\Program Files\Google\Chrome\Application\lsm.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Program Files\Google\Chrome\Application\lsm.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "lsml" /sc MINUTE /mo 8 /tr "'C:\Program Files\Google\Chrome\Application\lsm.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\Users\Default User\lsass.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Users\Default User\lsass.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\Users\Default User\lsass.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 7 /tr "'C:\Users\Public\Music\Sample Music\dwm.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Users\Public\Music\Sample Music\dwm.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 7 /tr "'C:\Users\Public\Music\Sample Music\dwm.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "servicess" /sc MINUTE /mo 13 /tr "'C:\providercommon\services.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\providercommon\services.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\providercommon\services.exe'" /rl HIGHEST /f

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Common Files\System\System.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows NT\Accessories\ja-JP\csrss.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\spoolsv.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\wininit.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Desktop\Idle.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\audiodg.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Links\conhost.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\resources\1033\WMIADAP.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\winlogon.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Google\Chrome\Application\lsm.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\lsass.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Music\Sample Music\dwm.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\services.exe'

C:\Users\Default User\lsass.exe

"C:\Users\Default User\lsass.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Pkopelt31u.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Users\Default User\lsass.exe

"C:\Users\Default User\lsass.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\XIXHPi7vyc.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Users\Default User\lsass.exe

"C:\Users\Default User\lsass.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\HiXkD60p2N.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Users\Default User\lsass.exe

"C:\Users\Default User\lsass.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\F4MZx53eLu.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Users\Default User\lsass.exe

"C:\Users\Default User\lsass.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\tlxpltA24S.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Users\Default User\lsass.exe

"C:\Users\Default User\lsass.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\nAABNdhKLs.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Users\Default User\lsass.exe

"C:\Users\Default User\lsass.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\1e6qhBZ49x.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Users\Default User\lsass.exe

"C:\Users\Default User\lsass.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\GKRF07RVHS.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Users\Default User\lsass.exe

"C:\Users\Default User\lsass.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\TiDn8Em9ri.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Users\Default User\lsass.exe

"C:\Users\Default User\lsass.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\dgWvFyiHB2.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Users\Default User\lsass.exe

"C:\Users\Default User\lsass.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ctDgUbHuaY.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Users\Default User\lsass.exe

"C:\Users\Default User\lsass.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 raw.githubusercontent.com udp
US 185.199.109.133:443 raw.githubusercontent.com tcp
US 185.199.109.133:443 raw.githubusercontent.com tcp
US 185.199.109.133:443 raw.githubusercontent.com tcp
US 185.199.109.133:443 raw.githubusercontent.com tcp
US 185.199.109.133:443 raw.githubusercontent.com tcp
US 185.199.109.133:443 raw.githubusercontent.com tcp
US 185.199.109.133:443 raw.githubusercontent.com tcp
US 185.199.109.133:443 raw.githubusercontent.com tcp
US 185.199.109.133:443 raw.githubusercontent.com tcp
US 185.199.109.133:443 raw.githubusercontent.com tcp
US 185.199.109.133:443 raw.githubusercontent.com tcp

Files

C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

MD5 8088241160261560a02c84025d107592
SHA1 083121f7027557570994c9fc211df61730455bb5
SHA256 2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1
SHA512 20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

C:\providercommon\1zu9dW.bat

MD5 6783c3ee07c7d151ceac57f1f9c8bed7
SHA1 17468f98f95bf504cc1f83c49e49a78526b3ea03
SHA256 8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322
SHA512 c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

\providercommon\DllCommonsvc.exe

MD5 bd31e94b4143c4ce49c17d3af46bcad0
SHA1 f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256 b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512 f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

memory/2688-13-0x00000000013E0000-0x00000000014F0000-memory.dmp

memory/2688-14-0x0000000000240000-0x0000000000252000-memory.dmp

memory/2688-15-0x0000000000250000-0x000000000025C000-memory.dmp

memory/2688-16-0x0000000000270000-0x000000000027C000-memory.dmp

memory/2688-17-0x00000000004F0000-0x00000000004FC000-memory.dmp

memory/2420-50-0x0000000000270000-0x0000000000380000-memory.dmp

memory/2420-51-0x0000000000160000-0x0000000000172000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\O7W4XF1XZGEWDTO5ND3H.temp

MD5 f27f62e083d5b970a67b1b9c8d17f62f
SHA1 29a4ee3c74dfbc373bd380ba126b8b66bf323e54
SHA256 3a7f72730112febd0096d9c26092cc4f4f9fba71d070f02aa508e22689a0db99
SHA512 4c3df891c2e6dfe6769f2a4088b1e2a123149a86aceaf2bc2cbb95228a4b7df69b846261b94af3b9aeb9da37da4782c1fb81db7f648fd77d28c5d8513bc27c78

memory/564-61-0x000000001B6B0000-0x000000001B992000-memory.dmp

memory/564-63-0x0000000001DF0000-0x0000000001DF8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\CabFCA9.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\TarFCBB.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\Local\Temp\Pkopelt31u.bat

MD5 b9518a0f23d324ea823f8ca805e49f72
SHA1 e2894745a5a37687a494e5174c8a4fea76607a45
SHA256 04b48ca6fe6c30f3ac1471f32c30e391bd3aefd7db9a30cc7339da3a39a5ed01
SHA512 d5bcf8fa187982aaf102c8ad2929d00fe4453db3aa9f84af2007c1ddeb62f32650886d0c384cc44b418af51bef10f07eed445e4fa2ffd568ebfff3a545e381e5

memory/1920-181-0x0000000000340000-0x0000000000450000-memory.dmp

memory/1920-182-0x0000000000330000-0x0000000000342000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4d5732c51892974e2bb7b81f6c7be2b9
SHA1 6bbc9a5389b019a090260e9bf712c08bc524640a
SHA256 136bf7849af2b2bbdd45251db13394251808ac02a6d46d8a7f9d096fd3b68bfd
SHA512 5cbe1c347f16fa1da6e2a745bf2d505e47fb4661019db5e46d612809d377abafcea37a58b0cca87fe50b61842ec8c0fae23b68bf38ed9d31f6b4e2dc16f60512

C:\Users\Admin\AppData\Local\Temp\XIXHPi7vyc.bat

MD5 91f9b11f96186b68c1fbcf4f401c8b7c
SHA1 8c3c6566b157c2bed1b1615e78a1bf186b1b63b3
SHA256 f4952d8f1b794f4f9594e505faf73f314ef8cd69709cce2483f288f64eb04d55
SHA512 9e6a2dd8d995389761aff304ddc90dc2a6bdf0f13f41defa80d58c2538eaef593c6d865da5f1bc69ea8ab0b512ae6d013e1dc0fb8908fafee6bc6bc4b1f6ae4e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7c1c4aa989016a8987a70478d8500cff
SHA1 951920681378a3446ea35170919e0320070ecb08
SHA256 036c5bc4b8caa86b767e40b99398a289c5f77599ba815732278be604c22f64e3
SHA512 4dd48e8f2b0f729a9dd3d6728cdaa5af412dca380e48aec1020ce738966370bc75231daffa8832889300990e53a6a1da646cac17d2d81c84e910289a52ea0792

C:\Users\Admin\AppData\Local\Temp\HiXkD60p2N.bat

MD5 27f251dfd59c195b37c32a9f6ed1e52d
SHA1 3f35ed6b89f19d5541a6666fa072deac2ddbf719
SHA256 8669ad79b31487b5f28fac08c6beee89816323820a2fda30e62ae1e8f3e977da
SHA512 1b2c8a4bff9dd271d3099424c7ff52671ba1f79cf165ca8472b39599e9765aad39c4131b5f4dd4d92dee15d951dc05da72d4dd94c93d104cb3ce3cdfb73aaf70

memory/2940-301-0x0000000000E10000-0x0000000000F20000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 cf6642fc760e4a45d41216c08dcf5545
SHA1 056d80f50a75ade2323ecba78967c7c2265cbafa
SHA256 228fb233d45f341f26645a862f9ef8dfe5be3ce8afdaa7554a07d7acc83c8fed
SHA512 49e031d48f55b4ad74eb3b8f7613de2531d3d4af4c4288ed29fc73f6c02950b1ec3fcac1fa46a0929c01b98ef77d7acee0f3eb3e3916612e97550f92e7eac9fa

C:\Users\Admin\AppData\Local\Temp\F4MZx53eLu.bat

MD5 38a4810ce8774178b6a92a385d46ad3b
SHA1 a7c50f39c8e648b67054e27abd798d0253c9aff5
SHA256 1c113ff9858aba301b3b695d21133c8dd545cca9083128abf93db05d68e0fd0b
SHA512 1525bfd5ad467ec2a8b493ddc5519570528c4e5eb9d1d026c6711616c5bd2eedaee51841ba3b6464229dc3c8b68877cd95936b93b9a493aca4c7c9c86d42a055

memory/3004-361-0x0000000000F70000-0x0000000001080000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 43e7dcd407864d5950a9728d13fd7afc
SHA1 28e398ed1c35ecece83cc48d06b794cc5e68d300
SHA256 eea07d9181fb65972f3c3b4f14c38d0606a8ba95ffdb489cc56cc6e44dea5fcf
SHA512 ce8625661e484036f07276758fa7d21eeaa67b0fd1b2d69354b28d980eef46ed697b73f87af6dbacc959413806f5f621c79acff21bef75df01b3985c5d32b788

C:\Users\Admin\AppData\Local\Temp\tlxpltA24S.bat

MD5 3a71daebc58d501d2bb2858172b94d62
SHA1 37049df97aea859216770d26cc4338256b4e7aaa
SHA256 6a9b1d7942b03ad52b6936fdb6bd7f429cc466f172e4b74bea7d7fe125b2dec1
SHA512 7934f96d3deecdd19914948bcfd822bc6a452478417f8b843c2ab4aa6ace1f4065ee16afec2272a31ebb7633ce8bffa95a43d646966d33e25a00425c9acc7c71

memory/2080-421-0x0000000001050000-0x0000000001160000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 50e6a400518aae2568aba99bd8b0878f
SHA1 8023d659771368150557ca562f3baafba08ba7b9
SHA256 02b0825772a0f740bce4f85c0ffda43cd164e0dfc18efdfe3addd0299dd132cf
SHA512 fd79c471f2b9816f97dcdcdfb48c66820a6c11f2ce5c75837624aaf239ef9a17817a275300712842dddb3d783a68a946a145241d3603594e7077746350981541

C:\Users\Admin\AppData\Local\Temp\nAABNdhKLs.bat

MD5 09d595833f4d476a098465283b6dafc9
SHA1 15a8dbd5a3cfb42e4b96613e1917925048917267
SHA256 a022aae62bb93c844320caff24d19533b2c7e22f2f2c59d43bd1d56dabf4e905
SHA512 9d0565d5934670e7af025c1fd30e101ae48db1762715e54d9b9e31f68fda173ac7e43bf807256557038b1bff320ba95b840b4303dbbe50f0ab41782e6e142055

memory/2424-481-0x0000000000360000-0x0000000000470000-memory.dmp

memory/2424-482-0x0000000000470000-0x0000000000482000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0063aeaf68412009b6682128059b9421
SHA1 e2e37f98fc313cf501637ffc3fa55b18d313e54e
SHA256 f52d5084eb686e9fa9fbf792505343a9df19cc2af85e53a5bf77163c680de0b5
SHA512 6c977f9c2437495b564af4b0d94bb508dc6a25a3f6afb34ba7836335fa854f3c91f92c3907e2c8143502f77a5bef9b1b66841fc25f4702384bd3e29c3fda3b27

C:\Users\Admin\AppData\Local\Temp\1e6qhBZ49x.bat

MD5 1cb3d51356af1d2e79a5157431038ba2
SHA1 859e0248a3f3a5ee88c9eccd0ec47aa17a6e29cc
SHA256 fe8585e6fe768f36bf68e75032da1be3b0c822d440aa297622e0bf8f330e7196
SHA512 ce00804564039d8622c4946ead229b49e0d856b7eebae18d3897a7856da32cc879b664ccbb7f107cefddf85e0c8de368ef85ba63f9f63bc7db5be322ccb0b660

memory/2496-543-0x0000000000330000-0x0000000000440000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 07378f89ec73355ffc49f3f7bbc138aa
SHA1 83b18c8edc12a107e897de04607a75130f2d63c8
SHA256 a08f8d5ae3568e9a9b11c01bc8a5d71b917214cf0df9aab5cfc48901b09b661c
SHA512 3fc517f4e6f41d731375033d673fbaaacb8797d564a8412a046fc62ee42f641856353759092893afbc10ad062c46d41d883701665743a93bce1a05bb70a94af6

C:\Users\Admin\AppData\Local\Temp\TiDn8Em9ri.bat

MD5 5cf059a5d8342282e6da6efac8372888
SHA1 74182c78f8420a545e1a54ded82ad71efdef9f41
SHA256 b145ade1e5eea0335379a0a6fc0d76a25ca6ce63116b60c38fb64f36841f2ba0
SHA512 e27526f49f87d5e8f4fc5f0377bdb9aba0f59cdee5e173f49626a493d80ba532f40f6136a779a0c38972ddeef5d054ca5247556f03d67cd69bed24ab6b65afd6

memory/1740-603-0x00000000009A0000-0x0000000000AB0000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d33ee874712366bf069a2b2147a67806
SHA1 cba55154e0c3bc514017b5620f095b2ca2a21f29
SHA256 91fb8150885004581260c8e81008e5f012d7f9043a393d33acf6762b2487fc28
SHA512 78c440f207f7771344d10cd08b8fa43976b1d47e240ab26b5f083b5fdcae20d623144f7d7fb8d971bbdbd76d53a9f80ccf2f02487a0cbad8ae492da991afb471

C:\Users\Admin\AppData\Local\Temp\dgWvFyiHB2.bat

MD5 c381dc8ae50e9b69e9264137403cc6e2
SHA1 46fb9bb6b4bfa6754b5a9953a8288712204fa1d9
SHA256 5a5f89ae216ba764ad272f692714a62dc5f7f00eeb64bf69cf201552d9e01af5
SHA512 30599f95e8cd0f6a315fb4569ebfa10ff9a3611914f26993c480cb4d79cd09364e6bc6174ce23db62bf09a3e5bfb6c91c038f35d9680ada4aa095be9e7e9e15a

memory/1264-663-0x0000000001260000-0x0000000001370000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 92b3d175350b849cb3e88c3af5847795
SHA1 0bba3af7f7dc5b5500bf156ecab57767ccd6f2ec
SHA256 4b9e0ee317b4e73b1b7855b0eefd1592a223ba35294fe2e687b92ef4525bce50
SHA512 8e6022ca61ec4ff4563206346509c2ff4e59edf0ce6d184bab9102b660d3f9a5e0c5b36608f06445a5b7fdd0e62204c36e6088a4fb53af4d1e255cb0a8534e89

C:\Users\Admin\AppData\Local\Temp\ctDgUbHuaY.bat

MD5 3e2ec233ed95d11b68b781144e350b66
SHA1 799b74b3a64581e03ef6fcfb39f0fe5521ed47e9
SHA256 ea9863bfc8f22215ec33aa24675de0fb0021b45a23d5e1cfa024fc982f29ce1a
SHA512 8541c8ffce93f0b18dac88215ee2681cdeed628cc221416c1c00ec5f76304679ef8bfadb5067270c2173b12acda6cdf380d191357039759c2c086fdcd71b22b0

memory/1952-723-0x00000000003C0000-0x00000000004D0000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-12-30 02:11

Reported

2024-12-30 02:14

Platform

win10v2004-20241007-en

Max time kernel

145s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7904ef7344839fd1821fc0752a0fca2d1f2e5b960abad349965a765a938c83b3.exe"

Signatures

DcRat

rat infostealer dcrat

Dcrat family

dcrat

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe

DCRat payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\WScript.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation C:\Program Files\Windows Security\dllhost.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation C:\Program Files\Windows Security\dllhost.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7904ef7344839fd1821fc0752a0fca2d1f2e5b960abad349965a765a938c83b3.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation C:\Program Files\Windows Security\dllhost.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation C:\Program Files\Windows Security\dllhost.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation C:\Program Files\Windows Security\dllhost.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation C:\Program Files\Windows Security\dllhost.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation C:\Program Files\Windows Security\dllhost.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation C:\Program Files\Windows Security\dllhost.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation C:\providercommon\DllCommonsvc.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation C:\Program Files\Windows Security\dllhost.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation C:\Program Files\Windows Security\dllhost.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation C:\Program Files\Windows Security\dllhost.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation C:\Program Files\Windows Security\dllhost.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\5b884080fd4f94 C:\providercommon\DllCommonsvc.exe N/A
File created C:\Program Files\Internet Explorer\uk-UA\RuntimeBroker.exe C:\providercommon\DllCommonsvc.exe N/A
File created C:\Program Files\Windows Security\dllhost.exe C:\providercommon\DllCommonsvc.exe N/A
File created C:\Program Files\Windows Security\5940a34987c991 C:\providercommon\DllCommonsvc.exe N/A
File created C:\Program Files\Mozilla Firefox\defaults\pref\conhost.exe C:\providercommon\DllCommonsvc.exe N/A
File created C:\Program Files (x86)\Windows Photo Viewer\unsecapp.exe C:\providercommon\DllCommonsvc.exe N/A
File created C:\Program Files (x86)\Windows Photo Viewer\29c1c3cc0f7685 C:\providercommon\DllCommonsvc.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\Idle.exe C:\providercommon\DllCommonsvc.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\6ccacd8608530f C:\providercommon\DllCommonsvc.exe N/A
File created C:\Program Files\Mozilla Firefox\defaults\pref\088424020bedd6 C:\providercommon\DllCommonsvc.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\fontdrvhost.exe C:\providercommon\DllCommonsvc.exe N/A
File created C:\Program Files\Internet Explorer\uk-UA\9e8d7a4ca61bd9 C:\providercommon\DllCommonsvc.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Resources\Themes\aero\VSCache\StartMenuExperienceHost.exe C:\providercommon\DllCommonsvc.exe N/A
File created C:\Windows\Performance\WinSAT\DataStore\OfficeClickToRun.exe C:\providercommon\DllCommonsvc.exe N/A
File created C:\Windows\Performance\WinSAT\DataStore\e6c9b481da804f C:\providercommon\DllCommonsvc.exe N/A
File created C:\Windows\Containers\serviced\dllhost.exe C:\providercommon\DllCommonsvc.exe N/A
File created C:\Windows\Containers\serviced\5940a34987c991 C:\providercommon\DllCommonsvc.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7904ef7344839fd1821fc0752a0fca2d1f2e5b960abad349965a765a938c83b3.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WScript.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings C:\Program Files\Windows Security\dllhost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings C:\Program Files\Windows Security\dllhost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings C:\providercommon\DllCommonsvc.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings C:\Program Files\Windows Security\dllhost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings C:\Program Files\Windows Security\dllhost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings C:\Program Files\Windows Security\dllhost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings C:\Program Files\Windows Security\dllhost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings C:\Program Files\Windows Security\dllhost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings C:\Program Files\Windows Security\dllhost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7904ef7344839fd1821fc0752a0fca2d1f2e5b960abad349965a765a938c83b3.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings C:\Program Files\Windows Security\dllhost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings C:\Program Files\Windows Security\dllhost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings C:\Program Files\Windows Security\dllhost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings C:\Program Files\Windows Security\dllhost.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\providercommon\DllCommonsvc.exe N/A
N/A N/A C:\providercommon\DllCommonsvc.exe N/A
N/A N/A C:\providercommon\DllCommonsvc.exe N/A
N/A N/A C:\providercommon\DllCommonsvc.exe N/A
N/A N/A C:\providercommon\DllCommonsvc.exe N/A
N/A N/A C:\providercommon\DllCommonsvc.exe N/A
N/A N/A C:\providercommon\DllCommonsvc.exe N/A
N/A N/A C:\providercommon\DllCommonsvc.exe N/A
N/A N/A C:\providercommon\DllCommonsvc.exe N/A
N/A N/A C:\providercommon\DllCommonsvc.exe N/A
N/A N/A C:\providercommon\DllCommonsvc.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Program Files\Windows Security\dllhost.exe N/A
N/A N/A C:\Program Files\Windows Security\dllhost.exe N/A
N/A N/A C:\Program Files\Windows Security\dllhost.exe N/A
N/A N/A C:\Program Files\Windows Security\dllhost.exe N/A
N/A N/A C:\Program Files\Windows Security\dllhost.exe N/A
N/A N/A C:\Program Files\Windows Security\dllhost.exe N/A
N/A N/A C:\Program Files\Windows Security\dllhost.exe N/A
N/A N/A C:\Program Files\Windows Security\dllhost.exe N/A
N/A N/A C:\Program Files\Windows Security\dllhost.exe N/A
N/A N/A C:\Program Files\Windows Security\dllhost.exe N/A
N/A N/A C:\Program Files\Windows Security\dllhost.exe N/A
N/A N/A C:\Program Files\Windows Security\dllhost.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\providercommon\DllCommonsvc.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Windows Security\dllhost.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Windows Security\dllhost.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Windows Security\dllhost.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Windows Security\dllhost.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Windows Security\dllhost.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Windows Security\dllhost.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Windows Security\dllhost.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Windows Security\dllhost.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Windows Security\dllhost.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Windows Security\dllhost.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Windows Security\dllhost.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Windows Security\dllhost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2816 wrote to memory of 2288 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7904ef7344839fd1821fc0752a0fca2d1f2e5b960abad349965a765a938c83b3.exe C:\Windows\SysWOW64\WScript.exe
PID 2816 wrote to memory of 2288 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7904ef7344839fd1821fc0752a0fca2d1f2e5b960abad349965a765a938c83b3.exe C:\Windows\SysWOW64\WScript.exe
PID 2816 wrote to memory of 2288 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7904ef7344839fd1821fc0752a0fca2d1f2e5b960abad349965a765a938c83b3.exe C:\Windows\SysWOW64\WScript.exe
PID 2288 wrote to memory of 4416 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2288 wrote to memory of 4416 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2288 wrote to memory of 4416 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 4416 wrote to memory of 3640 N/A C:\Windows\SysWOW64\cmd.exe C:\providercommon\DllCommonsvc.exe
PID 4416 wrote to memory of 3640 N/A C:\Windows\SysWOW64\cmd.exe C:\providercommon\DllCommonsvc.exe
PID 3640 wrote to memory of 3304 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3640 wrote to memory of 3304 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3640 wrote to memory of 1776 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3640 wrote to memory of 1776 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3640 wrote to memory of 2044 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3640 wrote to memory of 2044 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3640 wrote to memory of 1656 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3640 wrote to memory of 1656 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3640 wrote to memory of 2780 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3640 wrote to memory of 2780 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3640 wrote to memory of 1916 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3640 wrote to memory of 1916 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3640 wrote to memory of 4364 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3640 wrote to memory of 4364 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3640 wrote to memory of 3148 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3640 wrote to memory of 3148 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3640 wrote to memory of 4876 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3640 wrote to memory of 4876 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3640 wrote to memory of 2656 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3640 wrote to memory of 2656 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3640 wrote to memory of 5096 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3640 wrote to memory of 5096 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3640 wrote to memory of 3948 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\cmd.exe
PID 3640 wrote to memory of 3948 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\cmd.exe
PID 3948 wrote to memory of 4432 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 3948 wrote to memory of 4432 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 3948 wrote to memory of 4456 N/A C:\Windows\System32\cmd.exe C:\Program Files\Windows Security\dllhost.exe
PID 3948 wrote to memory of 4456 N/A C:\Windows\System32\cmd.exe C:\Program Files\Windows Security\dllhost.exe
PID 4456 wrote to memory of 2380 N/A C:\Program Files\Windows Security\dllhost.exe C:\Windows\System32\cmd.exe
PID 4456 wrote to memory of 2380 N/A C:\Program Files\Windows Security\dllhost.exe C:\Windows\System32\cmd.exe
PID 2380 wrote to memory of 3592 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 2380 wrote to memory of 3592 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 2380 wrote to memory of 3356 N/A C:\Windows\System32\cmd.exe C:\Program Files\Windows Security\dllhost.exe
PID 2380 wrote to memory of 3356 N/A C:\Windows\System32\cmd.exe C:\Program Files\Windows Security\dllhost.exe
PID 3356 wrote to memory of 3756 N/A C:\Program Files\Windows Security\dllhost.exe C:\Windows\System32\cmd.exe
PID 3356 wrote to memory of 3756 N/A C:\Program Files\Windows Security\dllhost.exe C:\Windows\System32\cmd.exe
PID 3756 wrote to memory of 4860 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 3756 wrote to memory of 4860 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 3756 wrote to memory of 4244 N/A C:\Windows\System32\cmd.exe C:\Program Files\Windows Security\dllhost.exe
PID 3756 wrote to memory of 4244 N/A C:\Windows\System32\cmd.exe C:\Program Files\Windows Security\dllhost.exe
PID 4244 wrote to memory of 3804 N/A C:\Program Files\Windows Security\dllhost.exe C:\Windows\System32\cmd.exe
PID 4244 wrote to memory of 3804 N/A C:\Program Files\Windows Security\dllhost.exe C:\Windows\System32\cmd.exe
PID 3804 wrote to memory of 2968 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 3804 wrote to memory of 2968 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 3804 wrote to memory of 1252 N/A C:\Windows\System32\cmd.exe C:\Program Files\Windows Security\dllhost.exe
PID 3804 wrote to memory of 1252 N/A C:\Windows\System32\cmd.exe C:\Program Files\Windows Security\dllhost.exe
PID 1252 wrote to memory of 3268 N/A C:\Program Files\Windows Security\dllhost.exe C:\Windows\System32\cmd.exe
PID 1252 wrote to memory of 3268 N/A C:\Program Files\Windows Security\dllhost.exe C:\Windows\System32\cmd.exe
PID 3268 wrote to memory of 3016 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 3268 wrote to memory of 3016 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 3268 wrote to memory of 2520 N/A C:\Windows\System32\cmd.exe C:\Program Files\Windows Security\dllhost.exe
PID 3268 wrote to memory of 2520 N/A C:\Windows\System32\cmd.exe C:\Program Files\Windows Security\dllhost.exe
PID 2520 wrote to memory of 3664 N/A C:\Program Files\Windows Security\dllhost.exe C:\Windows\System32\cmd.exe
PID 2520 wrote to memory of 3664 N/A C:\Program Files\Windows Security\dllhost.exe C:\Windows\System32\cmd.exe
PID 3664 wrote to memory of 4936 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 3664 wrote to memory of 4936 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7904ef7344839fd1821fc0752a0fca2d1f2e5b960abad349965a765a938c83b3.exe

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7904ef7344839fd1821fc0752a0fca2d1f2e5b960abad349965a765a938c83b3.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "

C:\providercommon\DllCommonsvc.exe

"C:\providercommon\DllCommonsvc.exe"

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\providercommon\dllhost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\providercommon\dllhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\providercommon\dllhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Photo Viewer\unsecapp.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\unsecapp.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Photo Viewer\unsecapp.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 6 /tr "'C:\Windows\Performance\WinSAT\DataStore\OfficeClickToRun.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Windows\Performance\WinSAT\DataStore\OfficeClickToRun.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 8 /tr "'C:\Windows\Performance\WinSAT\DataStore\OfficeClickToRun.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\fontdrvhost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\fontdrvhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\fontdrvhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\Windows\Containers\serviced\dllhost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\Containers\serviced\dllhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Windows\Containers\serviced\dllhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Program Files\Internet Explorer\uk-UA\RuntimeBroker.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\uk-UA\RuntimeBroker.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Program Files\Internet Explorer\uk-UA\RuntimeBroker.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\Idle.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\Idle.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\Idle.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 13 /tr "'C:\providercommon\spoolsv.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\providercommon\spoolsv.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 9 /tr "'C:\providercommon\spoolsv.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Security\dllhost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\Windows Security\dllhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Security\dllhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 10 /tr "'C:\Program Files\Mozilla Firefox\defaults\pref\conhost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\defaults\pref\conhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 12 /tr "'C:\Program Files\Mozilla Firefox\defaults\pref\conhost.exe'" /rl HIGHEST /f

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\dllhost.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Photo Viewer\unsecapp.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Performance\WinSAT\DataStore\OfficeClickToRun.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\fontdrvhost.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Containers\serviced\dllhost.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Internet Explorer\uk-UA\RuntimeBroker.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\Idle.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\spoolsv.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Security\dllhost.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Mozilla Firefox\defaults\pref\conhost.exe'

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\cnVBdQlyaT.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Program Files\Windows Security\dllhost.exe

"C:\Program Files\Windows Security\dllhost.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\pkmftNZ3Wr.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Program Files\Windows Security\dllhost.exe

"C:\Program Files\Windows Security\dllhost.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\5bc4V3lt5Q.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Program Files\Windows Security\dllhost.exe

"C:\Program Files\Windows Security\dllhost.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\iqKdioc4MG.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Program Files\Windows Security\dllhost.exe

"C:\Program Files\Windows Security\dllhost.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\hlBWXN5z7R.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Program Files\Windows Security\dllhost.exe

"C:\Program Files\Windows Security\dllhost.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\R8cJcUuQgj.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Program Files\Windows Security\dllhost.exe

"C:\Program Files\Windows Security\dllhost.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\fjnbjzFmbP.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Program Files\Windows Security\dllhost.exe

"C:\Program Files\Windows Security\dllhost.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\dnlY2uCtHd.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Program Files\Windows Security\dllhost.exe

"C:\Program Files\Windows Security\dllhost.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\a1rZrAbBst.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Program Files\Windows Security\dllhost.exe

"C:\Program Files\Windows Security\dllhost.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\M53DwaTFc6.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Program Files\Windows Security\dllhost.exe

"C:\Program Files\Windows Security\dllhost.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ER58NgmlZn.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Program Files\Windows Security\dllhost.exe

"C:\Program Files\Windows Security\dllhost.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\4WSxKcEorb.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Program Files\Windows Security\dllhost.exe

"C:\Program Files\Windows Security\dllhost.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\7Xe7C8pmPD.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 2.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 raw.githubusercontent.com udp
US 185.199.108.133:443 raw.githubusercontent.com tcp
US 8.8.8.8:53 133.108.199.185.in-addr.arpa udp
US 185.199.108.133:443 raw.githubusercontent.com tcp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 185.199.108.133:443 raw.githubusercontent.com tcp
US 185.199.108.133:443 raw.githubusercontent.com tcp
US 185.199.108.133:443 raw.githubusercontent.com tcp
US 185.199.108.133:443 raw.githubusercontent.com tcp
US 185.199.108.133:443 raw.githubusercontent.com tcp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp
US 185.199.108.133:443 raw.githubusercontent.com tcp
US 185.199.108.133:443 raw.githubusercontent.com tcp
US 185.199.108.133:443 raw.githubusercontent.com tcp
US 185.199.108.133:443 raw.githubusercontent.com tcp
US 185.199.108.133:443 raw.githubusercontent.com tcp

Files

C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

MD5 8088241160261560a02c84025d107592
SHA1 083121f7027557570994c9fc211df61730455bb5
SHA256 2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1
SHA512 20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

C:\providercommon\1zu9dW.bat

MD5 6783c3ee07c7d151ceac57f1f9c8bed7
SHA1 17468f98f95bf504cc1f83c49e49a78526b3ea03
SHA256 8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322
SHA512 c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

C:\providercommon\DllCommonsvc.exe

MD5 bd31e94b4143c4ce49c17d3af46bcad0
SHA1 f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256 b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512 f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

memory/3640-12-0x00007FFEAEAB3000-0x00007FFEAEAB5000-memory.dmp

memory/3640-13-0x0000000000110000-0x0000000000220000-memory.dmp

memory/3640-14-0x00000000009D0000-0x00000000009E2000-memory.dmp

memory/3640-15-0x0000000000BA0000-0x0000000000BAC000-memory.dmp

memory/3640-16-0x00000000009E0000-0x00000000009EC000-memory.dmp

memory/3640-17-0x0000000000B90000-0x0000000000B9C000-memory.dmp

memory/5096-48-0x0000015F6D010000-0x0000015F6D032000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_eih21gc5.or1.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

C:\Users\Admin\AppData\Local\Temp\cnVBdQlyaT.bat

MD5 387b491b3916474873a6451b002f0f8d
SHA1 b798f057bb274dccbad905ad7f6889f0e097a0fb
SHA256 27cea23fa4b6cec77ab4ca60e99f7d2761d1163e1e3f51a230d459d7419cd1ef
SHA512 cf8cee1a28e87f180e8ea14472293234a5003d35fa607bce104cc1df71ba758039c8278c5977900ddac1e60623604ca42fcd4269577ca49cb0eaf6592031cabf

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 6d3e9c29fe44e90aae6ed30ccf799ca8
SHA1 c7974ef72264bbdf13a2793ccf1aed11bc565dce
SHA256 2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d
SHA512 60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 77d622bb1a5b250869a3238b9bc1402b
SHA1 d47f4003c2554b9dfc4c16f22460b331886b191b
SHA256 f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb
SHA512 d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 d28a889fd956d5cb3accfbaf1143eb6f
SHA1 157ba54b365341f8ff06707d996b3635da8446f7
SHA256 21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45
SHA512 0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 cadef9abd087803c630df65264a6c81c
SHA1 babbf3636c347c8727c35f3eef2ee643dbcc4bd2
SHA256 cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438
SHA512 7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 bd5940f08d0be56e65e5f2aaf47c538e
SHA1 d7e31b87866e5e383ab5499da64aba50f03e8443
SHA256 2d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6
SHA512 c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Temp\pkmftNZ3Wr.bat

MD5 f96a03f8598d9485075ba16f4ddccad7
SHA1 f7f23ae3ce669964d6ab880d1dc8e54ba30e5438
SHA256 e40baadc8db756f7dea696cdc02512346d17390b736f52e1ec00f608d13fb994
SHA512 a4b808036636dff6140d46e7f38813859bacb0a1c5af190fd6aa5b1dbdd335deb621f6647db78358d15d1beea59e17f06d06ebacb57bbe59d991167785c8325e

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\dllhost.exe.log

MD5 baf55b95da4a601229647f25dad12878
SHA1 abc16954ebfd213733c4493fc1910164d825cac8
SHA256 ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
SHA512 24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

memory/3356-178-0x000000001B0E0000-0x000000001B0F2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\5bc4V3lt5Q.bat

MD5 eff3ba8acb3245ed115b86704e6d0f8e
SHA1 79d27c87bb9c1fb3353d6cfe775368ae13083eb6
SHA256 caaa5c54c22d8213b4cd66282e5feb7901505424441b5dab098931182790c58b
SHA512 a30d67b32dad41dc3c05fed5ab2c8d07d2a02974bcae94dc9f3999d3397c4264cd3fa3f98224db14a5da3b51296165872ce5360ffd473585315994f408f7a9a1

memory/4244-185-0x0000000000BF0000-0x0000000000C02000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\iqKdioc4MG.bat

MD5 5de97ee7ed0ec2c73b8ce724268144a9
SHA1 4a51183a783e44492fc6a693e0a045cd4728970f
SHA256 c5367d5bca453be98995f8f6e3b8ee385efada8816527fe01f2da0d823370e5b
SHA512 54cb1351fae0c425741690116ed947015f5784ecd24bb87dfe630b54e659a07d60004b754f2c959a101b44fd2c258d61121861266b5125f7528891f3c796a3d1

C:\Users\Admin\AppData\Local\Temp\hlBWXN5z7R.bat

MD5 45b6f2da776da3ed197d4fb198e14c89
SHA1 7fb6c6b1bdff8d5ee1ed12bf2c213298cc8d4afc
SHA256 87bb0092066303458cdc8e80cf8c1bf5ebd6377d1ef6742ea05f47c7a531f687
SHA512 8852b951316dbc9438eaa6b4c4a549a6bb2f48f3f60fa4e4c060dd97c6cf4940c16959d432a6c52aa8081a2257eb3a6308028cd2a5c9cbf85ec9d1a28b09c778

memory/2520-198-0x0000000002AF0000-0x0000000002B02000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\R8cJcUuQgj.bat

MD5 6c753934349efb7c49abe539b7726946
SHA1 8b812c6eecd2607a6156aea9832c9fa3950b25c0
SHA256 115c46ffc1a93556a139ebea6d15c99f18177a4ece0ff39fce6ae647efd74fbe
SHA512 79aee241ee182b01dd8f001a87e60d7173bcd76b6a529fd1bcfbf9b7e16aa6942260ad559b4faab7efbd0927b8e336b0db26444e3c62d541d815b2155948eb87

C:\Users\Admin\AppData\Local\Temp\fjnbjzFmbP.bat

MD5 bdd3a5e33d55da88e9790e3e0ba06344
SHA1 3e15cc9f717c6f90a134b57f6e576e511d047be8
SHA256 ab7eca72de0b32bb65289a9e94d4cc84ffca33d5592ef8c6e9d5c98a399b3048
SHA512 381585e4093b73270ff9f29668b25332680f53bd0f69ebe76e9ad380bef218c4a4842ff00ed5c9055167a2d57b8099ef09419f2938e5d31a13fff35fdf0431a5

memory/924-211-0x0000000000C40000-0x0000000000C52000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\dnlY2uCtHd.bat

MD5 5f3865e5c8f59b9e23a184cdeb365bab
SHA1 d1f413fa5e92245a81b2f838fe736f2e01de2bd9
SHA256 87de02fbf459a01044ec77b331ba8e48bc5f1b70b1c5f870bb9b32ab5f265cdb
SHA512 e70ddae6d32b4fc34bbc532bf21549ba26b143d91bb3e47ef9ecdcee6673173b00b1f3687a84905b2678c9cc5b73270bb26c881d70fbce24983ff51a7a8ad0f4

C:\Users\Admin\AppData\Local\Temp\a1rZrAbBst.bat

MD5 4a38ed142c5efd903e5e7cface511803
SHA1 35fa75e41685ee8e0a9662081dac0d1bf7973f52
SHA256 ea32da0ae8f2f6f45d13408224b9d06f6320cb0d3f8a006f324e853ad6f07bd5
SHA512 f0e7bf9f208171d5f2092438546f2f6cdc954a55f7bcff79eaf750831a525c1c7317b6fc11dec91f2d67e9243fd48059db322e474d92fedb9aec191c3f13b7b5

memory/2940-224-0x000000001BB60000-0x000000001BB72000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\M53DwaTFc6.bat

MD5 77f39594be5ace1d6e2c7401e0722296
SHA1 19f89739b5a180a7b3edbf8f7e8227b57402a1fd
SHA256 6f50d332acb5b81c75e0171b28c10a1a3993a8fadc955f79ba63c6eeb4bbd9f6
SHA512 5c270bcb7ab0dd10df0df34918a4304029c3598ce7adaa723461b58d16ca6f2d4dba9b0ff9c3c805e987158178b9b1fb06252189e84ce7fe7cc77472ca1cd5e4

C:\Users\Admin\AppData\Local\Temp\ER58NgmlZn.bat

MD5 824156f02abe0ada676fc52739d617f9
SHA1 a701625ed96e58649e01ddcbccd40a611351984b
SHA256 0ebcf8445f18d0994bac0179f04de85407277e8fbdcf8c8af3c9547f7547d52f
SHA512 591b9ddfc0dddfc5ef6db478c69044881cd8eb9f6199f9630abca74b8c90eaae7ba391276d8dff32b1b81db0da5e8d9035d68deb93d665db5beb845b75190011

C:\Users\Admin\AppData\Local\Temp\4WSxKcEorb.bat

MD5 d41e83e7ec7857bc3e7aafd00ebc6238
SHA1 4f6808b8330b467e28d9168a82a77ee077d5abc5
SHA256 20c668e7ed5c3777cbccacbdeefef2da2efb410469154ed1b8ff2c06426b80d6
SHA512 25210bad7ffc39ef1ed446905ce8d16b027203cd7a78621188f56f04059e8336c6faaff13a364a7180f9f7162e842cfd4646812499541ac16eca6563298474dc

C:\Users\Admin\AppData\Local\Temp\7Xe7C8pmPD.bat

MD5 1c4f3f82982570445701a98d9ced1a8c
SHA1 91f2dba5c157315bd3346fd50ee1f2150afdc54e
SHA256 70fc5e601b109bd0f1e165eace59344cd5d2b105bfda0b872b3796c4eeac6e3a
SHA512 cea46c854e2017f6122d2d0ec8e1a2278a7ba3ca7833db599e7a7f43d7b43161c2fdb46de35c0bc1f6c2aa2847ffdf0e3583cf1577f2b7848c6ac833f56bfe1c