Malware Analysis Report

2025-08-10 11:53

Sample ID 241230-cs49gsvkfx
Target JaffaCakes118_7c1c6e0abfdbf0fd7abf694a77b34c85be16b5b40f6a65565a52495e5caf509f
SHA256 7c1c6e0abfdbf0fd7abf694a77b34c85be16b5b40f6a65565a52495e5caf509f
Tags
rat dcrat discovery execution infostealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

7c1c6e0abfdbf0fd7abf694a77b34c85be16b5b40f6a65565a52495e5caf509f

Threat Level: Known bad

The file JaffaCakes118_7c1c6e0abfdbf0fd7abf694a77b34c85be16b5b40f6a65565a52495e5caf509f was found to be: Known bad.

Malicious Activity Summary

rat dcrat discovery execution infostealer

Process spawned unexpected child process

DCRat payload

Dcrat family

DcRat

DCRat payload

Command and Scripting Interpreter: PowerShell

Loads dropped DLL

Executes dropped EXE

Checks computer location settings

Legitimate hosting services abused for malware hosting/C2

Drops file in Windows directory

Drops file in Program Files directory

Unsigned PE

System Location Discovery: System Language Discovery

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Modifies registry class

Suspicious use of AdjustPrivilegeToken

Scheduled Task/Job: Scheduled Task

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-12-30 02:21

Signatures

DCRat payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

Dcrat family

dcrat

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-12-30 02:21

Reported

2024-12-30 02:23

Platform

win7-20240903-en

Max time kernel

146s

Max time network

141s

Command Line

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7c1c6e0abfdbf0fd7abf694a77b34c85be16b5b40f6a65565a52495e5caf509f.exe"

Signatures

DcRat

rat infostealer dcrat

Dcrat family

dcrat

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe

DCRat payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\Microsoft Analysis Services\c5b4cb5e9653cc C:\providercommon\DllCommonsvc.exe N/A
File created C:\Program Files\Windows Sidebar\fr-FR\b75386f1303e64 C:\providercommon\DllCommonsvc.exe N/A
File created C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\1033\License Agreements\088424020bedd6 C:\providercommon\DllCommonsvc.exe N/A
File created C:\Program Files (x86)\Windows Mail\it-IT\Idle.exe C:\providercommon\DllCommonsvc.exe N/A
File created C:\Program Files (x86)\Windows Mail\it-IT\6ccacd8608530f C:\providercommon\DllCommonsvc.exe N/A
File created C:\Program Files\VideoLAN\VLC\skins\fonts\System.exe C:\providercommon\DllCommonsvc.exe N/A
File created C:\Program Files (x86)\Microsoft Analysis Services\services.exe C:\providercommon\DllCommonsvc.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\fr-FR\a76d7bf15d8370 C:\providercommon\DllCommonsvc.exe N/A
File created C:\Program Files\Java\jre7\lib\ext\wininit.exe C:\providercommon\DllCommonsvc.exe N/A
File created C:\Program Files\Java\jre7\lib\ext\56085415360792 C:\providercommon\DllCommonsvc.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\fr-FR\DllCommonsvc.exe C:\providercommon\DllCommonsvc.exe N/A
File created C:\Program Files\VideoLAN\VLC\skins\fonts\27d1bcfc3c54e0 C:\providercommon\DllCommonsvc.exe N/A
File created C:\Program Files\Windows Sidebar\fr-FR\taskhost.exe C:\providercommon\DllCommonsvc.exe N/A
File created C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\1033\License Agreements\conhost.exe C:\providercommon\DllCommonsvc.exe N/A
File opened for modification C:\Program Files (x86)\Windows Mail\it-IT\Idle.exe C:\providercommon\DllCommonsvc.exe N/A
File created C:\Program Files (x86)\Windows Portable Devices\sppsvc.exe C:\providercommon\DllCommonsvc.exe N/A
File created C:\Program Files (x86)\Windows Portable Devices\0a1fd5f707cd16 C:\providercommon\DllCommonsvc.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\assembly\NativeImages_v2.0.50727_64\winlogon.exe C:\providercommon\DllCommonsvc.exe N/A
File created C:\Windows\assembly\NativeImages_v2.0.50727_64\cc11b995f2a76d C:\providercommon\DllCommonsvc.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7c1c6e0abfdbf0fd7abf694a77b34c85be16b5b40f6a65565a52495e5caf509f.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WScript.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\providercommon\DllCommonsvc.exe N/A
N/A N/A C:\providercommon\DllCommonsvc.exe N/A
N/A N/A C:\providercommon\DllCommonsvc.exe N/A
N/A N/A C:\providercommon\DllCommonsvc.exe N/A
N/A N/A C:\providercommon\DllCommonsvc.exe N/A
N/A N/A C:\providercommon\DllCommonsvc.exe N/A
N/A N/A C:\providercommon\DllCommonsvc.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\winlogon.exe N/A
N/A N/A C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\winlogon.exe N/A
N/A N/A C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\winlogon.exe N/A
N/A N/A C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\winlogon.exe N/A
N/A N/A C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\winlogon.exe N/A
N/A N/A C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\winlogon.exe N/A
N/A N/A C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\winlogon.exe N/A
N/A N/A C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\winlogon.exe N/A
N/A N/A C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\winlogon.exe N/A
N/A N/A C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\winlogon.exe N/A
N/A N/A C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\winlogon.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\providercommon\DllCommonsvc.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\winlogon.exe N/A
Token: SeDebugPrivilege N/A C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\winlogon.exe N/A
Token: SeDebugPrivilege N/A C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\winlogon.exe N/A
Token: SeDebugPrivilege N/A C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\winlogon.exe N/A
Token: SeDebugPrivilege N/A C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\winlogon.exe N/A
Token: SeDebugPrivilege N/A C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\winlogon.exe N/A
Token: SeDebugPrivilege N/A C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\winlogon.exe N/A
Token: SeDebugPrivilege N/A C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\winlogon.exe N/A
Token: SeDebugPrivilege N/A C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\winlogon.exe N/A
Token: SeDebugPrivilege N/A C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\winlogon.exe N/A
Token: SeDebugPrivilege N/A C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\winlogon.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1868 wrote to memory of 2260 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7c1c6e0abfdbf0fd7abf694a77b34c85be16b5b40f6a65565a52495e5caf509f.exe C:\Windows\SysWOW64\WScript.exe
PID 1868 wrote to memory of 2260 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7c1c6e0abfdbf0fd7abf694a77b34c85be16b5b40f6a65565a52495e5caf509f.exe C:\Windows\SysWOW64\WScript.exe
PID 1868 wrote to memory of 2260 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7c1c6e0abfdbf0fd7abf694a77b34c85be16b5b40f6a65565a52495e5caf509f.exe C:\Windows\SysWOW64\WScript.exe
PID 1868 wrote to memory of 2260 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7c1c6e0abfdbf0fd7abf694a77b34c85be16b5b40f6a65565a52495e5caf509f.exe C:\Windows\SysWOW64\WScript.exe
PID 2260 wrote to memory of 2212 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2260 wrote to memory of 2212 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2260 wrote to memory of 2212 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2260 wrote to memory of 2212 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2212 wrote to memory of 2596 N/A C:\Windows\SysWOW64\cmd.exe C:\providercommon\DllCommonsvc.exe
PID 2212 wrote to memory of 2596 N/A C:\Windows\SysWOW64\cmd.exe C:\providercommon\DllCommonsvc.exe
PID 2212 wrote to memory of 2596 N/A C:\Windows\SysWOW64\cmd.exe C:\providercommon\DllCommonsvc.exe
PID 2212 wrote to memory of 2596 N/A C:\Windows\SysWOW64\cmd.exe C:\providercommon\DllCommonsvc.exe
PID 2596 wrote to memory of 2856 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2596 wrote to memory of 2856 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2596 wrote to memory of 2856 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2596 wrote to memory of 2308 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2596 wrote to memory of 2308 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2596 wrote to memory of 2308 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2596 wrote to memory of 1748 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2596 wrote to memory of 1748 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2596 wrote to memory of 1748 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2596 wrote to memory of 1308 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2596 wrote to memory of 1308 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2596 wrote to memory of 1308 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2596 wrote to memory of 2124 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2596 wrote to memory of 2124 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2596 wrote to memory of 2124 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2596 wrote to memory of 2924 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2596 wrote to memory of 2924 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2596 wrote to memory of 2924 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2596 wrote to memory of 2912 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2596 wrote to memory of 2912 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2596 wrote to memory of 2912 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2596 wrote to memory of 2928 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2596 wrote to memory of 2928 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2596 wrote to memory of 2928 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2596 wrote to memory of 1548 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2596 wrote to memory of 1548 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2596 wrote to memory of 1548 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2596 wrote to memory of 1692 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2596 wrote to memory of 1692 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2596 wrote to memory of 1692 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2596 wrote to memory of 1588 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2596 wrote to memory of 1588 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2596 wrote to memory of 1588 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2596 wrote to memory of 2416 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2596 wrote to memory of 2416 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2596 wrote to memory of 2416 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2596 wrote to memory of 2420 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2596 wrote to memory of 2420 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2596 wrote to memory of 2420 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2596 wrote to memory of 2296 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2596 wrote to memory of 2296 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2596 wrote to memory of 2296 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2596 wrote to memory of 1676 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2596 wrote to memory of 1676 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2596 wrote to memory of 1676 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2596 wrote to memory of 1048 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2596 wrote to memory of 1048 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2596 wrote to memory of 1048 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2596 wrote to memory of 1292 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2596 wrote to memory of 1292 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2596 wrote to memory of 1292 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2596 wrote to memory of 2640 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\cmd.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7c1c6e0abfdbf0fd7abf694a77b34c85be16b5b40f6a65565a52495e5caf509f.exe

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7c1c6e0abfdbf0fd7abf694a77b34c85be16b5b40f6a65565a52495e5caf509f.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\providercommon\1zu9dW.bat" "

C:\providercommon\DllCommonsvc.exe

"C:\providercommon\DllCommonsvc.exe"

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Mail\it-IT\Idle.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\it-IT\Idle.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Mail\it-IT\Idle.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Sidebar\fr-FR\DllCommonsvc.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\fr-FR\DllCommonsvc.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Sidebar\fr-FR\DllCommonsvc.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'C:\Program Files\VideoLAN\VLC\skins\fonts\System.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\VLC\skins\fonts\System.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 6 /tr "'C:\Program Files\VideoLAN\VLC\skins\fonts\System.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "servicess" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Microsoft Analysis Services\services.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Analysis Services\services.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "servicess" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Microsoft Analysis Services\services.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 7 /tr "'C:\Users\Default User\cmd.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Users\Default User\cmd.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 7 /tr "'C:\Users\Default User\cmd.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Sidebar\fr-FR\taskhost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\fr-FR\taskhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Sidebar\fr-FR\taskhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\audiodg.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\audiodg.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\audiodg.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\1033\License Agreements\conhost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\1033\License Agreements\conhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\1033\License Agreements\conhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Portable Devices\sppsvc.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\sppsvc.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Portable Devices\sppsvc.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\taskhost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\taskhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\taskhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'C:\Windows\assembly\NativeImages_v2.0.50727_64\winlogon.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\assembly\NativeImages_v2.0.50727_64\winlogon.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 6 /tr "'C:\Windows\assembly\NativeImages_v2.0.50727_64\winlogon.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "servicess" /sc MINUTE /mo 11 /tr "'C:\providercommon\services.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\providercommon\services.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "servicess" /sc MINUTE /mo 13 /tr "'C:\providercommon\services.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 11 /tr "'C:\Program Files\Java\jre7\lib\ext\wininit.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files\Java\jre7\lib\ext\wininit.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\Program Files\Java\jre7\lib\ext\wininit.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\smss.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\smss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "smsss" /sc MINUTE /mo 8 /tr "'C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\smss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 11 /tr "'C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\winlogon.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\winlogon.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\winlogon.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Users\Default User\dllhost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Default User\dllhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Users\Default User\dllhost.exe'" /rl HIGHEST /f

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Mail\it-IT\Idle.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Sidebar\fr-FR\DllCommonsvc.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\VideoLAN\VLC\skins\fonts\System.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft Analysis Services\services.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\cmd.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Sidebar\fr-FR\taskhost.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\audiodg.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\1033\License Agreements\conhost.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Portable Devices\sppsvc.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\taskhost.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\assembly\NativeImages_v2.0.50727_64\winlogon.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\services.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Java\jre7\lib\ext\wininit.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\smss.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\winlogon.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\dllhost.exe'

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\YnfmNXYe8z.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\winlogon.exe

"C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\winlogon.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\D2zd9hDRps.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\winlogon.exe

"C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\winlogon.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\0VN2lTwXPf.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\winlogon.exe

"C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\winlogon.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\BAdWWGXi7E.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\winlogon.exe

"C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\winlogon.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\l4DYpxlgJN.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\winlogon.exe

"C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\winlogon.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\zfOrxS71E3.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\winlogon.exe

"C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\winlogon.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\USq6qxpMr5.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\winlogon.exe

"C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\winlogon.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\hibqn60Xcy.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\winlogon.exe

"C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\winlogon.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\gSW9k5bhgR.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\winlogon.exe

"C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\winlogon.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\GRgsn2v6O3.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\winlogon.exe

"C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\winlogon.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\WSSqGJyhfL.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\winlogon.exe

"C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\winlogon.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 raw.githubusercontent.com udp
US 185.199.110.133:443 raw.githubusercontent.com tcp
US 185.199.110.133:443 raw.githubusercontent.com tcp
US 185.199.110.133:443 raw.githubusercontent.com tcp
US 185.199.110.133:443 raw.githubusercontent.com tcp
US 185.199.110.133:443 raw.githubusercontent.com tcp
US 185.199.110.133:443 raw.githubusercontent.com tcp
US 185.199.110.133:443 raw.githubusercontent.com tcp
US 185.199.110.133:443 raw.githubusercontent.com tcp
US 185.199.110.133:443 raw.githubusercontent.com tcp
US 185.199.110.133:443 raw.githubusercontent.com tcp

Files

C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

MD5 8088241160261560a02c84025d107592
SHA1 083121f7027557570994c9fc211df61730455bb5
SHA256 2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1
SHA512 20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

C:\providercommon\1zu9dW.bat

MD5 6783c3ee07c7d151ceac57f1f9c8bed7
SHA1 17468f98f95bf504cc1f83c49e49a78526b3ea03
SHA256 8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322
SHA512 c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

\providercommon\DllCommonsvc.exe

MD5 bd31e94b4143c4ce49c17d3af46bcad0
SHA1 f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256 b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512 f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

memory/2596-13-0x0000000001290000-0x00000000013A0000-memory.dmp

memory/2596-14-0x00000000002C0000-0x00000000002D2000-memory.dmp

memory/2596-15-0x0000000000360000-0x000000000036C000-memory.dmp

memory/2596-16-0x0000000000350000-0x000000000035C000-memory.dmp

memory/2596-17-0x0000000000370000-0x000000000037C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\YnfmNXYe8z.bat

MD5 881e01eaa96e5318c12eefbaafc4f702
SHA1 f23044de806b9e5a28256909ae1413336ca2274a
SHA256 cca8db74ce99c42634e6e5f15cf8d621eb3431f34a7397e7de23c81715b72189
SHA512 8ac750bb0a3ac254d9651b4f31ddc4375a88a6171609f7c03056f133ff1e1a8c625fa79cd8302f95a7ad87a62d5711504e9a99076031c599027e775acc182988

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

MD5 9281f7f2acc7abf8a821944183dbd857
SHA1 c43c64eccc8ecdbf022ecd7841e48ead2ce6bad1
SHA256 5207ffb44e84d7b9a08da0529a2d2fdb5bc7aef17283b6bc28b2e0374676b4c3
SHA512 e8e987b98a3cde5f66cb07209868506bca6be7123a30c6fe493f8f780ca631cbd80d0db0235a9574c1b61562a5030bf1eec46ab466046317fcaf0b53aa699a14

memory/2296-86-0x00000000028E0000-0x00000000028E8000-memory.dmp

memory/1048-75-0x000000001B630000-0x000000001B912000-memory.dmp

memory/2676-143-0x0000000001370000-0x0000000001480000-memory.dmp

memory/2676-144-0x0000000000240000-0x0000000000252000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\CabD3D5.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\TarD3E7.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\Local\Temp\D2zd9hDRps.bat

MD5 92b55ca66892ea27da3bcafbbcc79d58
SHA1 d1126ffec3dcacaaa029d9028a08b04d2fc96ebd
SHA256 b32414d70eb31ac90a77adc93656e2f30b340d371656ac0a8dbcb949030ffcba
SHA512 c3fef13fcdf566818493de46a8f92f1c166f48933a576acd2cf01568a38d02fc1dc9bac17f97a30af48e84ef5c4fe21bf830bdc6a0b6059804e51bb0bbf6ed7d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 fc8de0cd5bd2411cf1d0eef89247c9db
SHA1 96e557932e2d7532e1c27c0b5c7bfd965164cb6f
SHA256 3d05766fb2a3718c67aeb1e3ee6b0738182f3d1a3070e3a7a7d05f37d35c2922
SHA512 f16d1076a5d858f959106979ae33a9d50e123297f7935c9028afa7561d3f1027cf326a10b1b18b630630812347269d06fc18e688e223fc42901485b77d64b288

C:\Users\Admin\AppData\Local\Temp\0VN2lTwXPf.bat

MD5 43fba72874c2fda09edb338ea0ba75a5
SHA1 5408daaf76b98d86ab5dbfad29065620ad84b0b0
SHA256 7d3307ca697d8d62187da711f1323bfde12436bf8dc2415a4e9097525ad4782e
SHA512 a4bc2bb4f12c6779e7cb1be6c33ff6f2fda6bc7fcc4abbc0a1de9c5932a2ab23fe7917ed98465da9e6f9b174e7452a5913561f1795f0d7264637161791684472

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 408bbee80298f187eb53b28b1f3baf7e
SHA1 3e4be68705e6667c09c4b0302a51f0e0821c81c0
SHA256 c1079d3606cebd566db52d1f59483dac891b3b50a071a08d5b7baead9f02b1f3
SHA512 23dbe102222f2dceba386964b4651573c3c3faa5f03380beca0890f27844ab4543b9373376b0e001ebc53261ec6faf60a2186246bcdc8a3d0ca85ad0602e797b

C:\Users\Admin\AppData\Local\Temp\BAdWWGXi7E.bat

MD5 d0dc49b6d28702cec1a219bc2ee9191e
SHA1 7aedbbc5fcea29e7a778df417d5022eb22d31262
SHA256 17186c20c4b96317dd7613504797cb1e5b6deab85b31f9cd45e46ab0f63e02e8
SHA512 2615d683c04d9ff194774f691228063ffd4081be96a2380e3dabc2fd8cffc7b017e49c19444bbab79f2ca1bd9d05ebd0eb9966f20ca0ac81ad75b42205eac522

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 8fb4a3279a44cf7f8d7681740a659071
SHA1 fe374c293dc9d69a11bcd41ec4ebdf19e54575d5
SHA256 4b8fe9960d0459017d0d609d9a876645300e3e9aa40089c5463bc25e4bbc7045
SHA512 4b691230e3271726ddf7f88076402a31ef1687be0a78eb69ef9fff93a94a3335df3c3637e2d45d158e0f4e276299cf27ca1fd0ff582e58f055f53c23823a5898

C:\Users\Admin\AppData\Local\Temp\l4DYpxlgJN.bat

MD5 7d470fb59a8bd4621b3b074d40548236
SHA1 c2bfca214a9ff984be2c605db19effedb8041409
SHA256 d33c160937034f242f662c4d2a2d4355f560fb6c43881822519afa9d3cd1a12e
SHA512 50ea9d9deda48a98d4a326ff2055b389b5c7da1f66eaa3adc8a45fda4f4a1c94e032bbb92f40a61c6a2af256b7b5dd004a46e697f1d25ee8ab63524fe98f2942

memory/1380-380-0x00000000013C0000-0x00000000014D0000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1f2e01bc910a0579c20e00fcf7acefe8
SHA1 248ec8b4d1beb4df4c68c5d0454f4059d4dea6a7
SHA256 f0dcddadccb2b42c5c21498ddb0df87dce8bb8c1881902fb717d335a52fcbaa4
SHA512 9e76559d2195c4d1f6040e6f76db71b17ffcdfdad194db80ef349e27d6dd25ba3193c5064e971ae865c7414dcd17c01a9e97d5aa32ca889290094da0ff9f7d8d

C:\Users\Admin\AppData\Local\Temp\zfOrxS71E3.bat

MD5 4e83ae09a79c135af15f0e42b825487d
SHA1 b15039ff5020d5d95b5fadd47ef66cfb3efbe7a2
SHA256 327410108c618c9aa81e250f224dcce91b4d4c783ace51682400f7cf06a64da3
SHA512 51f7d39f4d8a6f53b81a51ee6e6bdaa935a6fb0a47c13c29aba09da74edfd026627af8e5ae88f769935db9dfd00fad352c12be83c29e77017a2ce30cf514191c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 08ac9065765c1f1f38902b6030159658
SHA1 596b4e7f253b7018a2e7113f869a3221e9645e58
SHA256 22adcfd8e184a930643d3a971f1292c181f8acc34c2f58e55f6901104c68ed89
SHA512 64f36f4dd49fe01bc081ab9decc5b070177e3dd7a9a61550bfc24d0a23ec3314a1512c898bfb20b5e30325af4031dc117d73550a14dc34dbd2d08b26b1393046

C:\Users\Admin\AppData\Local\Temp\USq6qxpMr5.bat

MD5 289133a2d0de4c74d98c751f89f6192a
SHA1 32bc90db4a839c09601ee3a19ec3d743577c129e
SHA256 253907f8854321028311552b983bff0202ba3b942d280dce6a6ef4faece86bdf
SHA512 d9d72b7bcbdc656d8afa0ff6e826798c4768008a4eb029770d9b794b0595e9aae0603c3b692b7ccc3368e9b4cd6b0fbf961073733b9fec469a85fd7307c5cdbc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 81ee24d5ee5aaba1b5a9820daa59320e
SHA1 b29d144711a7c82adedeefc1bec1c6ade97077f0
SHA256 d764b750d9a65614f8d3c7a426e89d8dd1f99a52d8bc5e68f368722adf3cea4c
SHA512 083a56ab7182d0439ae0802810d165b9d42c188514f9acff8fcc1b86e031febc332af611a626e3544bd9d4792e484f2d70c1714c0ea3a4c7154628fa54d3ce3a

C:\Users\Admin\AppData\Local\Temp\hibqn60Xcy.bat

MD5 ee0c5f396d8e1d7c095f88d082b23eed
SHA1 f2a88c8dc9f7734a0a9e65d948b86a334e68dd04
SHA256 6caf653def286fba53b5d4f17b48d5e1700345c14338019c1e7b93d95e509900
SHA512 51cdf07f31459a3e3cd4fba285ed836afe5c4e0bd2e2c14b3c384f0fae7f5fd7410ba6e60bf9f6cfcb0fdef08ca6246f329dac956599a93ef4663f5df57ec9db

memory/2864-558-0x00000000000C0000-0x00000000001D0000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 dc3fd91c8ecb4ca1c1ff2870956df076
SHA1 735731aaf240f70805a800a1bb14a8c4b9530549
SHA256 213be80d52bfba53b37eab81cd8334b355fc7478d72bd81295e9687f3f0a9984
SHA512 e28929db358efd8dddd545f0c59fdb863722c104ef44bfa5cd7dca43dcb749c7c5c944a14204e87e5b5eab44d4dcf96d9e458267580a72d8d37377efbf99e9bf

C:\Users\Admin\AppData\Local\Temp\gSW9k5bhgR.bat

MD5 45917ca464c3209deb982fe41b9939ed
SHA1 44f922d8c3124491ba0a4369097d84b6aa6371b4
SHA256 95cae5ec7f40aa7b345c41fd9cc1d1ff69c3faba2af84381fcad9deb3788ce47
SHA512 623cc82a921c3a400c154b2715e77950e961cb2b2064bce434ca4328875da20d7e03a7b2ba9d30962fbafcde2918c093432ce69db6fab1f23c86603504febf5d

memory/984-618-0x0000000000E30000-0x0000000000F40000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ed589f77e5b115407eca6aadb3c6f4ec
SHA1 bf5d4b4c9413df9ba8e74430344c6e47d2732522
SHA256 9f2675814a8c6d9a8b732dad36358b8b5d70c5f4b58bcdfe6ac6a7a4d139253a
SHA512 6e4be01e108b91596c77f3a3cec0052a2daabc74c6aa3da844922d44a89dd8e66f846e04c8be09e634acd1f8e1da9c942b70d88268e68fa3e58956e27e6732ad

C:\Users\Admin\AppData\Local\Temp\GRgsn2v6O3.bat

MD5 b0928987c2301fe523128299c0235eb1
SHA1 fe8ef93e5551100a5052423e40a4ed54cf71c302
SHA256 673076dc832c8c790bed2e95e95892cf7b8def6b9743ec8a3b8c3843d21b787b
SHA512 49aafeb30613454cc4d7e4a347d3ac420d360249bd9038341694a2184b0932b0708cd27d0b2ed1807def0d3776c4f068373d4aed25854d6bc8cfd213c6b95537

memory/2964-678-0x00000000002F0000-0x0000000000302000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 dfe04d31cf3c79016aa8bc5bdd04b737
SHA1 dbe3856eca97f37f5fcaad43f5f63395c8fcad3d
SHA256 c4f66becca5aa9e9a2156198b63fcf201f9ddc2621e4ec1aa845a3d9ef84c6ae
SHA512 43e15bb4b58d9e5884979cf96eccbca5d1e2205c264a754e238408cf128da44061d3c4df60a1ff5898db8b6199e21c59f02169a4540b764c86652965775103cd

C:\Users\Admin\AppData\Local\Temp\WSSqGJyhfL.bat

MD5 095a78761621465465f13158150ac75c
SHA1 3dd880bc6e4be51bf9f1d3a86529ace069f47c6a
SHA256 8295c3057c6569ea55ac4ddb201f46883142e61ea32f710d49fdcc85ca0457f2
SHA512 b39b624cfc5cee73e28c59ac115b4c48471e34f879fb15fab49b11b09303768b16f6d05135c86402e8e6beb279faae0075b8bd6571944558032f95529bb12534

memory/2368-738-0x0000000000020000-0x0000000000130000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-12-30 02:21

Reported

2024-12-30 02:23

Platform

win10v2004-20241007-en

Max time kernel

149s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7c1c6e0abfdbf0fd7abf694a77b34c85be16b5b40f6a65565a52495e5caf509f.exe"

Signatures

DcRat

rat infostealer dcrat

Dcrat family

dcrat

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe

DCRat payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation C:\providercommon\dllhost.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation C:\providercommon\dllhost.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation C:\providercommon\dllhost.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation C:\providercommon\dllhost.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation C:\providercommon\dllhost.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7c1c6e0abfdbf0fd7abf694a77b34c85be16b5b40f6a65565a52495e5caf509f.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\WScript.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation C:\providercommon\dllhost.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation C:\providercommon\dllhost.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation C:\providercommon\dllhost.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation C:\providercommon\dllhost.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation C:\providercommon\dllhost.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation C:\providercommon\dllhost.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation C:\providercommon\dllhost.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation C:\providercommon\DllCommonsvc.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation C:\providercommon\dllhost.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\schemas\CodeIntegrity\ExamplePolicies\SearchApp.exe C:\providercommon\DllCommonsvc.exe N/A
File created C:\Windows\schemas\CodeIntegrity\ExamplePolicies\38384e6a620884 C:\providercommon\DllCommonsvc.exe N/A
File created C:\Windows\schemas\CodeIntegrity\ExamplePolicies\SearchApp.exe C:\providercommon\DllCommonsvc.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WScript.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7c1c6e0abfdbf0fd7abf694a77b34c85be16b5b40f6a65565a52495e5caf509f.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings C:\providercommon\dllhost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings C:\providercommon\dllhost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings C:\providercommon\dllhost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7c1c6e0abfdbf0fd7abf694a77b34c85be16b5b40f6a65565a52495e5caf509f.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings C:\providercommon\dllhost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings C:\providercommon\dllhost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings C:\providercommon\dllhost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings C:\providercommon\dllhost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings C:\providercommon\dllhost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings C:\providercommon\dllhost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings C:\providercommon\dllhost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings C:\providercommon\dllhost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings C:\providercommon\dllhost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings C:\providercommon\dllhost.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\providercommon\DllCommonsvc.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\providercommon\dllhost.exe N/A
Token: SeDebugPrivilege N/A C:\providercommon\dllhost.exe N/A
Token: SeDebugPrivilege N/A C:\providercommon\dllhost.exe N/A
Token: SeDebugPrivilege N/A C:\providercommon\dllhost.exe N/A
Token: SeDebugPrivilege N/A C:\providercommon\dllhost.exe N/A
Token: SeDebugPrivilege N/A C:\providercommon\dllhost.exe N/A
Token: SeDebugPrivilege N/A C:\providercommon\dllhost.exe N/A
Token: SeDebugPrivilege N/A C:\providercommon\dllhost.exe N/A
Token: SeDebugPrivilege N/A C:\providercommon\dllhost.exe N/A
Token: SeDebugPrivilege N/A C:\providercommon\dllhost.exe N/A
Token: SeDebugPrivilege N/A C:\providercommon\dllhost.exe N/A
Token: SeDebugPrivilege N/A C:\providercommon\dllhost.exe N/A
Token: SeDebugPrivilege N/A C:\providercommon\dllhost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1716 wrote to memory of 2996 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7c1c6e0abfdbf0fd7abf694a77b34c85be16b5b40f6a65565a52495e5caf509f.exe C:\Windows\SysWOW64\WScript.exe
PID 1716 wrote to memory of 2996 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7c1c6e0abfdbf0fd7abf694a77b34c85be16b5b40f6a65565a52495e5caf509f.exe C:\Windows\SysWOW64\WScript.exe
PID 1716 wrote to memory of 2996 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7c1c6e0abfdbf0fd7abf694a77b34c85be16b5b40f6a65565a52495e5caf509f.exe C:\Windows\SysWOW64\WScript.exe
PID 2996 wrote to memory of 2192 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2996 wrote to memory of 2192 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2996 wrote to memory of 2192 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2192 wrote to memory of 1056 N/A C:\Windows\SysWOW64\cmd.exe C:\providercommon\DllCommonsvc.exe
PID 2192 wrote to memory of 1056 N/A C:\Windows\SysWOW64\cmd.exe C:\providercommon\DllCommonsvc.exe
PID 1056 wrote to memory of 2060 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1056 wrote to memory of 2060 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1056 wrote to memory of 3052 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1056 wrote to memory of 3052 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1056 wrote to memory of 1772 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1056 wrote to memory of 1772 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1056 wrote to memory of 1620 N/A C:\providercommon\DllCommonsvc.exe C:\providercommon\dllhost.exe
PID 1056 wrote to memory of 1620 N/A C:\providercommon\DllCommonsvc.exe C:\providercommon\dllhost.exe
PID 1620 wrote to memory of 4948 N/A C:\providercommon\dllhost.exe C:\Windows\System32\cmd.exe
PID 1620 wrote to memory of 4948 N/A C:\providercommon\dllhost.exe C:\Windows\System32\cmd.exe
PID 4948 wrote to memory of 2920 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 4948 wrote to memory of 2920 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 4948 wrote to memory of 4340 N/A C:\Windows\System32\cmd.exe C:\providercommon\dllhost.exe
PID 4948 wrote to memory of 4340 N/A C:\Windows\System32\cmd.exe C:\providercommon\dllhost.exe
PID 4340 wrote to memory of 3980 N/A C:\providercommon\dllhost.exe C:\Windows\System32\cmd.exe
PID 4340 wrote to memory of 3980 N/A C:\providercommon\dllhost.exe C:\Windows\System32\cmd.exe
PID 3980 wrote to memory of 3416 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 3980 wrote to memory of 3416 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 3980 wrote to memory of 2412 N/A C:\Windows\System32\cmd.exe C:\providercommon\dllhost.exe
PID 3980 wrote to memory of 2412 N/A C:\Windows\System32\cmd.exe C:\providercommon\dllhost.exe
PID 2412 wrote to memory of 1004 N/A C:\providercommon\dllhost.exe C:\Windows\System32\cmd.exe
PID 2412 wrote to memory of 1004 N/A C:\providercommon\dllhost.exe C:\Windows\System32\cmd.exe
PID 1004 wrote to memory of 4236 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 1004 wrote to memory of 4236 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 1004 wrote to memory of 2584 N/A C:\Windows\System32\cmd.exe C:\providercommon\dllhost.exe
PID 1004 wrote to memory of 2584 N/A C:\Windows\System32\cmd.exe C:\providercommon\dllhost.exe
PID 2584 wrote to memory of 4168 N/A C:\providercommon\dllhost.exe C:\Windows\System32\cmd.exe
PID 2584 wrote to memory of 4168 N/A C:\providercommon\dllhost.exe C:\Windows\System32\cmd.exe
PID 4168 wrote to memory of 1624 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 4168 wrote to memory of 1624 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 4168 wrote to memory of 1144 N/A C:\Windows\System32\cmd.exe C:\providercommon\dllhost.exe
PID 4168 wrote to memory of 1144 N/A C:\Windows\System32\cmd.exe C:\providercommon\dllhost.exe
PID 1144 wrote to memory of 4644 N/A C:\providercommon\dllhost.exe C:\Windows\System32\cmd.exe
PID 1144 wrote to memory of 4644 N/A C:\providercommon\dllhost.exe C:\Windows\System32\cmd.exe
PID 4644 wrote to memory of 1944 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 4644 wrote to memory of 1944 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 4644 wrote to memory of 4292 N/A C:\Windows\System32\cmd.exe C:\providercommon\dllhost.exe
PID 4644 wrote to memory of 4292 N/A C:\Windows\System32\cmd.exe C:\providercommon\dllhost.exe
PID 4292 wrote to memory of 2556 N/A C:\providercommon\dllhost.exe C:\Windows\System32\cmd.exe
PID 4292 wrote to memory of 2556 N/A C:\providercommon\dllhost.exe C:\Windows\System32\cmd.exe
PID 2556 wrote to memory of 3636 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 2556 wrote to memory of 3636 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 2556 wrote to memory of 4340 N/A C:\Windows\System32\cmd.exe C:\providercommon\dllhost.exe
PID 2556 wrote to memory of 4340 N/A C:\Windows\System32\cmd.exe C:\providercommon\dllhost.exe
PID 4340 wrote to memory of 2752 N/A C:\providercommon\dllhost.exe C:\Windows\System32\cmd.exe
PID 4340 wrote to memory of 2752 N/A C:\providercommon\dllhost.exe C:\Windows\System32\cmd.exe
PID 2752 wrote to memory of 1784 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 2752 wrote to memory of 1784 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 2752 wrote to memory of 2360 N/A C:\Windows\System32\cmd.exe C:\providercommon\dllhost.exe
PID 2752 wrote to memory of 2360 N/A C:\Windows\System32\cmd.exe C:\providercommon\dllhost.exe
PID 2360 wrote to memory of 4856 N/A C:\providercommon\dllhost.exe C:\Windows\System32\cmd.exe
PID 2360 wrote to memory of 4856 N/A C:\providercommon\dllhost.exe C:\Windows\System32\cmd.exe
PID 4856 wrote to memory of 5072 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 4856 wrote to memory of 5072 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 4856 wrote to memory of 404 N/A C:\Windows\System32\cmd.exe C:\providercommon\dllhost.exe
PID 4856 wrote to memory of 404 N/A C:\Windows\System32\cmd.exe C:\providercommon\dllhost.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7c1c6e0abfdbf0fd7abf694a77b34c85be16b5b40f6a65565a52495e5caf509f.exe

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7c1c6e0abfdbf0fd7abf694a77b34c85be16b5b40f6a65565a52495e5caf509f.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "

C:\providercommon\DllCommonsvc.exe

"C:\providercommon\DllCommonsvc.exe"

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 11 /tr "'C:\Windows\schemas\CodeIntegrity\ExamplePolicies\SearchApp.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Windows\schemas\CodeIntegrity\ExamplePolicies\SearchApp.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 12 /tr "'C:\Windows\schemas\CodeIntegrity\ExamplePolicies\SearchApp.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\providercommon\dllhost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\providercommon\dllhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\providercommon\dllhost.exe'" /rl HIGHEST /f

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\schemas\CodeIntegrity\ExamplePolicies\SearchApp.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\dllhost.exe'

C:\providercommon\dllhost.exe

"C:\providercommon\dllhost.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\tcplHXgq9Q.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\providercommon\dllhost.exe

"C:\providercommon\dllhost.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\3fa1oyizme.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\providercommon\dllhost.exe

"C:\providercommon\dllhost.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\qpvm5o68kg.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\providercommon\dllhost.exe

"C:\providercommon\dllhost.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\0PvuKmrV6l.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\providercommon\dllhost.exe

"C:\providercommon\dllhost.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\NADK710Kqv.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\providercommon\dllhost.exe

"C:\providercommon\dllhost.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\wYroxckjTC.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\providercommon\dllhost.exe

"C:\providercommon\dllhost.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\fjnbjzFmbP.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\providercommon\dllhost.exe

"C:\providercommon\dllhost.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\kbrh69MYEy.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\providercommon\dllhost.exe

"C:\providercommon\dllhost.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\xc1v93Hoh1.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\providercommon\dllhost.exe

"C:\providercommon\dllhost.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\QHkN6qNcbm.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\providercommon\dllhost.exe

"C:\providercommon\dllhost.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\uVUt9EuWwA.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\providercommon\dllhost.exe

"C:\providercommon\dllhost.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\GN7B3lpeta.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\providercommon\dllhost.exe

"C:\providercommon\dllhost.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\RBOUzXbIOW.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 20.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 raw.githubusercontent.com udp
US 185.199.111.133:443 raw.githubusercontent.com tcp
US 8.8.8.8:53 133.111.199.185.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 185.199.111.133:443 raw.githubusercontent.com tcp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 185.199.111.133:443 raw.githubusercontent.com tcp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 133.130.81.91.in-addr.arpa udp
US 185.199.111.133:443 raw.githubusercontent.com tcp
US 185.199.111.133:443 raw.githubusercontent.com tcp
US 185.199.111.133:443 raw.githubusercontent.com tcp
US 185.199.111.133:443 raw.githubusercontent.com tcp
US 185.199.111.133:443 raw.githubusercontent.com tcp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 185.199.111.133:443 raw.githubusercontent.com tcp
US 185.199.111.133:443 raw.githubusercontent.com tcp
US 185.199.111.133:443 raw.githubusercontent.com tcp
US 185.199.111.133:443 raw.githubusercontent.com tcp
US 185.199.111.133:443 raw.githubusercontent.com tcp

Files

C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

MD5 8088241160261560a02c84025d107592
SHA1 083121f7027557570994c9fc211df61730455bb5
SHA256 2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1
SHA512 20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

C:\providercommon\1zu9dW.bat

MD5 6783c3ee07c7d151ceac57f1f9c8bed7
SHA1 17468f98f95bf504cc1f83c49e49a78526b3ea03
SHA256 8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322
SHA512 c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

C:\providercommon\DllCommonsvc.exe

MD5 bd31e94b4143c4ce49c17d3af46bcad0
SHA1 f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256 b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512 f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

memory/1056-12-0x00007FFD8CC83000-0x00007FFD8CC85000-memory.dmp

memory/1056-13-0x0000000000A40000-0x0000000000B50000-memory.dmp

memory/1056-14-0x000000001B640000-0x000000001B652000-memory.dmp

memory/1056-15-0x000000001B650000-0x000000001B65C000-memory.dmp

memory/1056-17-0x000000001B780000-0x000000001B78C000-memory.dmp

memory/1056-16-0x000000001B770000-0x000000001B77C000-memory.dmp

memory/3052-33-0x000001DDB6AB0000-0x000001DDB6AD2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_14vhkf0d.i0c.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 77d622bb1a5b250869a3238b9bc1402b
SHA1 d47f4003c2554b9dfc4c16f22460b331886b191b
SHA256 f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb
SHA512 d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 6d3e9c29fe44e90aae6ed30ccf799ca8
SHA1 c7974ef72264bbdf13a2793ccf1aed11bc565dce
SHA256 2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d
SHA512 60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

C:\Users\Admin\AppData\Local\Temp\tcplHXgq9Q.bat

MD5 34763d5ca7494863d4fc228e1ea049a5
SHA1 68ba83d0d5220b627a944dff9a8661368398d321
SHA256 a41abff7f4e401e59be74704e269d561cae82c8a8d3dd10435e3dc6f2e2529ce
SHA512 656bde42b0cd5ac57e926767b0e4764934f6def221b78a882ff90d15cbcc837e031ad2acc1c1223c09fd64a49a897c7c6afc89bb706df17fe3ea48bc9318731c

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\dllhost.exe.log

MD5 baf55b95da4a601229647f25dad12878
SHA1 abc16954ebfd213733c4493fc1910164d825cac8
SHA256 ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
SHA512 24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

memory/4340-76-0x0000000003120000-0x0000000003132000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\3fa1oyizme.bat

MD5 e8051efe42984321f50f520c0a7e192e
SHA1 baab5176350441c956f40a6149d66a71c95ccf67
SHA256 70ec59f8fbb203cc8cbe2ac036c7883586fba8507ec6b0b6750d12c6ca8b45d1
SHA512 dc67211bae7b3c583b343116220667d2f9e824abd54cf96a44e59230a3d82a7aa0e9bfa44ea7ca2d8d6da4207341ef0a8a37dde48834106dab1be4972f4418a0

memory/4340-82-0x000000001C380000-0x000000001C482000-memory.dmp

memory/2412-84-0x00000000017E0000-0x00000000017F2000-memory.dmp

memory/2412-89-0x000000001C290000-0x000000001C392000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\qpvm5o68kg.bat

MD5 f2b028788b1dbdd99b21e4ca1dea82bb
SHA1 07677434733c14b261dd2e95b627882616f62d34
SHA256 9521a0e2e8e72c37286cfa8e8956270f88f454ccc124eb31d108d25de3f3c965
SHA512 d60458a0603037c97490580ca76f64f6ced15ea37a3c98bfdf30708e8b7173fbf9761dae8a385e3553c49b5fdd34b9769799f3f6b7b8000948f6e64ba2cd147a

memory/2584-96-0x000000001BC70000-0x000000001BCC6000-memory.dmp

memory/2584-97-0x000000001CA30000-0x000000001CAD1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\0PvuKmrV6l.bat

MD5 cde009c98223ca14992400e3a83af4a6
SHA1 b5f337922134873a9c96b0356f55e1833c548d2a
SHA256 4620e6a48ebfe209d90a4b0a845e834fb8989ee182b856586e5a3673bf7d34d7
SHA512 efc4f26a42c55e04efd3865104dd1ccc4dac12495a52168706adb93c4d1c7b98fcbdbe9806a80a232230c8e15c4e341953f325aa4fcdaa468977906bbf5b7fa2

memory/1144-104-0x000000001BDE0000-0x000000001BE36000-memory.dmp

memory/1144-105-0x000000001BE40000-0x000000001BEE1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\NADK710Kqv.bat

MD5 9b8b75788421ea79c13c845d95f8c2d9
SHA1 fb0c6f4916acc95e960b62f2b12c0e0be5131754
SHA256 0948343fe4429ecab5cd5d82c943416398a21e99063862c8fe930e91754ea963
SHA512 cb1d5eab45ae45a0f2642f3be7d55b3eafa4bfa35a5cb152be1ac944ef7bb7c325778469fca538692653cd038709239feefd9e86ba622fb90f798fbb38f924a4

memory/4292-112-0x000000001C1F0000-0x000000001C246000-memory.dmp

memory/4292-113-0x000000001C250000-0x000000001C2F1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\wYroxckjTC.bat

MD5 29d1d67ae328e7aa296f8474a39e8f3d
SHA1 09e5054c2bd02d9ca9dab2f6949ba142e8391c9a
SHA256 d6ea6b73990b67fbc3d4bd46e1bfa5f2f306a287d50b7f7e0d2c3c56d13dba2e
SHA512 ab511ab76b043f10c3ccf0e5145963b82b7dce8720e5341629e8ffca39061731ba9376dad5be0ca491b9bdefc7ebc78050d80bec677f132d1fc26cbc3c47ed79

memory/4340-121-0x000000001BBF0000-0x000000001BC91000-memory.dmp

memory/4340-120-0x000000001BB90000-0x000000001BBE6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\fjnbjzFmbP.bat

MD5 16797dd5923988899c51d193f840c209
SHA1 5a26cad62a707570b56c26bb68973f46b65e1147
SHA256 80a506bbb3daa88fffdd021f2136b543a2dc58c1e64dd50278ad4e8393dfd452
SHA512 075f1189e81cb35bcbd3fea02d8611f49500aa92d76b2442a8dfb1a32732e198e7a12ac46fed19bcb69e688b1d4abfbe4c4049842bd2c0247d893d9d73f76982

C:\Users\Admin\AppData\Local\Temp\kbrh69MYEy.bat

MD5 bef3799d77800687a817eafcf78f9047
SHA1 0fcdbf417df1490ee8681ce79f31e3c474630daf
SHA256 ec6015dc4c0addf74af4a3028301ebd032fd91459c30cbb24441075cf42038fd
SHA512 cf683de0c9e4df90b6d5c9c88924c76b3f6ecec7362ec863b6f18544cf273c442c5998d66fdef0b42dcef773fda28db47b848356524bb7956e0b91326869c07b

C:\Users\Admin\AppData\Local\Temp\xc1v93Hoh1.bat

MD5 363cfdb3747f13a74ab6b4e542e37c87
SHA1 47fae0b84e21f33cc10ef65341764c942714470f
SHA256 d290c43f0d80dda7468c0d91deb623d86c01bc84afa0f8a227e1dda89260c068
SHA512 2e71b7b46934edfedc4b9932c897fd3af0b5a52c48bbdfe461a3125f2579c41a75860729f2ba3104389599d91ef197d1ee5e0776240cdf4bbeba8b4c23979c3f

memory/404-135-0x000000001C950000-0x000000001CABA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\QHkN6qNcbm.bat

MD5 921eb09689ddad27942e560e008237d7
SHA1 fd62665c78204d8ae55cd27a10b7b87e0c1ba8c2
SHA256 2aface0421f4ea6ba80526bb7bf9b8854d6c31109ce524c38a3927d33bb1e85b
SHA512 b1f431ef038d9c48e9142dd06620512327267f1b0c41eff29643a04ace32607d4ea9694a522caccebe32e347baec98ffe8c3439d80477d3a9918b3de884b2450

C:\Users\Admin\AppData\Local\Temp\uVUt9EuWwA.bat

MD5 03c01eb1908beee2d26773dde58d34c3
SHA1 c28be3877d8f1eda4a6fb61204c871f6c431d629
SHA256 4c66b0fb76dfb9df60917715b646a209ebe46a681b48b48ac5780f72d075fa03
SHA512 cf5d2c6b722f89e7566b6b5d37405411b0d9db833db832ff9f38504e08a2ea23ffebbe964d1d5d4d21b0fcf3d31e7fcd97f65ae264eba6974aa009dcb17afba5

memory/1600-149-0x0000000002520000-0x0000000002532000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\GN7B3lpeta.bat

MD5 79ecf85eb6166ff4686ac008f88269da
SHA1 945fbe59aa056e745c3d040790f334b51afc54db
SHA256 28cc0f1d36e333bbfd3566acdab0ae00c580df949c0326d209717baca9545969
SHA512 4f743b4afbe7bb60c21b8ee24fcc569110c14ee8b618c57226488d8b591145a7f9e57db6df15a93346ddf7f751b0e96b45f19bd65401628e88875286d2f1d320

C:\Users\Admin\AppData\Local\Temp\RBOUzXbIOW.bat

MD5 96df8905e447a24e286a1beeed5a826a
SHA1 b73163466dc8d9eaef12f27ce1c4668b2e949ae8
SHA256 728206dfcbe91a82ca89545dde0fab694ee8d20e7a84d08afc5026daa52ee42b
SHA512 b92948d0c42d901dd8a2630bbcdaf47275550befc437315ff1cc8d64b5d31607708c69f2cdc0277e71126e0cec114157641e2570f53ef084a5c365dffa43cc66