Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2024, 02:20
Behavioral task
behavioral1
Sample
JaffaCakes118_a31a2c723d18f5db2c5d963c5fffb6f1931384e5b24dd2da129d1a208f27322a.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
JaffaCakes118_a31a2c723d18f5db2c5d963c5fffb6f1931384e5b24dd2da129d1a208f27322a.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_a31a2c723d18f5db2c5d963c5fffb6f1931384e5b24dd2da129d1a208f27322a.exe
-
Size
1.3MB
-
MD5
fdb3dc5552dc4efe431cf601ef09e6c6
-
SHA1
edc4dbb399ae32ec287eaac6dece94ffcd40fd8a
-
SHA256
a31a2c723d18f5db2c5d963c5fffb6f1931384e5b24dd2da129d1a208f27322a
-
SHA512
a47efb1a93ce70468f49c5b850a29af30cb3bae7f1e646c084a18e99e1720390be759a617d01878602f170ae47c814e9facb041a3129170a969dfaeb517e264a
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Process spawned unexpected child process 33 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3208 1804 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2132 1804 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2972 1804 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1080 1804 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4992 1804 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1756 1804 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4964 1804 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 212 1804 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1020 1804 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4248 1804 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4596 1804 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4312 1804 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4880 1804 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2268 1804 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5036 1804 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4732 1804 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1784 1804 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1368 1804 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5044 1804 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1396 1804 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3216 1804 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3260 1804 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2436 1804 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4752 1804 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3884 1804 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4336 1804 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1456 1804 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5116 1804 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 996 1804 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 760 1804 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1200 1804 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4944 1804 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5020 1804 schtasks.exe 86 -
resource yara_rule behavioral2/files/0x000e000000023bd7-11.dat dcrat behavioral2/memory/4544-13-0x0000000000700000-0x0000000000810000-memory.dmp dcrat -
Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 208 powershell.exe 2504 powershell.exe 1084 powershell.exe 3592 powershell.exe 632 powershell.exe 668 powershell.exe 3264 powershell.exe 3116 powershell.exe 3244 powershell.exe 5040 powershell.exe 4308 powershell.exe 3472 powershell.exe -
Checks computer location settings 2 TTPs 16 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation DllCommonsvc.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation JaffaCakes118_a31a2c723d18f5db2c5d963c5fffb6f1931384e5b24dd2da129d1a208f27322a.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation DllCommonsvc.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation DllCommonsvc.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation DllCommonsvc.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation DllCommonsvc.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation DllCommonsvc.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation DllCommonsvc.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation DllCommonsvc.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation DllCommonsvc.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation DllCommonsvc.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation DllCommonsvc.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation DllCommonsvc.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation DllCommonsvc.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation DllCommonsvc.exe -
Executes dropped EXE 14 IoCs
pid Process 4544 DllCommonsvc.exe 3036 DllCommonsvc.exe 4936 DllCommonsvc.exe 2928 DllCommonsvc.exe 1672 DllCommonsvc.exe 3084 DllCommonsvc.exe 4292 DllCommonsvc.exe 3564 DllCommonsvc.exe 1820 DllCommonsvc.exe 32 DllCommonsvc.exe 4972 DllCommonsvc.exe 2576 DllCommonsvc.exe 4336 DllCommonsvc.exe 2972 DllCommonsvc.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 14 IoCs
flow ioc 24 raw.githubusercontent.com 38 raw.githubusercontent.com 39 raw.githubusercontent.com 43 raw.githubusercontent.com 51 raw.githubusercontent.com 52 raw.githubusercontent.com 47 raw.githubusercontent.com 53 raw.githubusercontent.com 54 raw.githubusercontent.com 16 raw.githubusercontent.com 17 raw.githubusercontent.com 55 raw.githubusercontent.com 40 raw.githubusercontent.com 44 raw.githubusercontent.com -
Drops file in Program Files directory 13 IoCs
description ioc Process File created C:\Program Files\Mozilla Firefox\browser\features\e6c9b481da804f DllCommonsvc.exe File created C:\Program Files\Microsoft Office\root\Integration\Addons\6ccacd8608530f DllCommonsvc.exe File created C:\Program Files\ModifiableWindowsApps\sysmon.exe DllCommonsvc.exe File created C:\Program Files\Crashpad\reports\dwm.exe DllCommonsvc.exe File opened for modification C:\Program Files\Crashpad\reports\dwm.exe DllCommonsvc.exe File created C:\Program Files\ModifiableWindowsApps\StartMenuExperienceHost.exe DllCommonsvc.exe File created C:\Program Files\Java\jre-1.8\bin\plugin2\wininit.exe DllCommonsvc.exe File created C:\Program Files\Mozilla Firefox\browser\features\OfficeClickToRun.exe DllCommonsvc.exe File created C:\Program Files\Crashpad\reports\6cb0b6c459d5d3 DllCommonsvc.exe File created C:\Program Files\Windows Mail\services.exe DllCommonsvc.exe File created C:\Program Files\Windows Mail\c5b4cb5e9653cc DllCommonsvc.exe File created C:\Program Files\Java\jre-1.8\bin\plugin2\56085415360792 DllCommonsvc.exe File created C:\Program Files\Microsoft Office\root\Integration\Addons\Idle.exe DllCommonsvc.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Panther\setup.exe\System.exe DllCommonsvc.exe File created C:\Windows\Panther\setup.exe\27d1bcfc3c54e0 DllCommonsvc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_a31a2c723d18f5db2c5d963c5fffb6f1931384e5b24dd2da129d1a208f27322a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies registry class 14 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings DllCommonsvc.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings DllCommonsvc.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings DllCommonsvc.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings DllCommonsvc.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings DllCommonsvc.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings DllCommonsvc.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings DllCommonsvc.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings DllCommonsvc.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings DllCommonsvc.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings DllCommonsvc.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings DllCommonsvc.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings DllCommonsvc.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings DllCommonsvc.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings JaffaCakes118_a31a2c723d18f5db2c5d963c5fffb6f1931384e5b24dd2da129d1a208f27322a.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 33 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3208 schtasks.exe 212 schtasks.exe 1020 schtasks.exe 1784 schtasks.exe 5044 schtasks.exe 2436 schtasks.exe 1200 schtasks.exe 2132 schtasks.exe 2972 schtasks.exe 4880 schtasks.exe 2268 schtasks.exe 1396 schtasks.exe 3884 schtasks.exe 760 schtasks.exe 5020 schtasks.exe 4992 schtasks.exe 4596 schtasks.exe 4732 schtasks.exe 5116 schtasks.exe 4964 schtasks.exe 4248 schtasks.exe 4312 schtasks.exe 1080 schtasks.exe 3260 schtasks.exe 4752 schtasks.exe 4944 schtasks.exe 1756 schtasks.exe 5036 schtasks.exe 1368 schtasks.exe 3216 schtasks.exe 4336 schtasks.exe 1456 schtasks.exe 996 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 63 IoCs
pid Process 4544 DllCommonsvc.exe 4544 DllCommonsvc.exe 4544 DllCommonsvc.exe 4544 DllCommonsvc.exe 4544 DllCommonsvc.exe 4544 DllCommonsvc.exe 4544 DllCommonsvc.exe 4544 DllCommonsvc.exe 4544 DllCommonsvc.exe 4544 DllCommonsvc.exe 4544 DllCommonsvc.exe 4544 DllCommonsvc.exe 4544 DllCommonsvc.exe 3264 powershell.exe 3264 powershell.exe 208 powershell.exe 208 powershell.exe 4308 powershell.exe 4308 powershell.exe 3472 powershell.exe 3472 powershell.exe 632 powershell.exe 632 powershell.exe 5040 powershell.exe 5040 powershell.exe 1084 powershell.exe 1084 powershell.exe 668 powershell.exe 668 powershell.exe 3116 powershell.exe 3116 powershell.exe 2504 powershell.exe 2504 powershell.exe 3592 powershell.exe 3592 powershell.exe 3116 powershell.exe 208 powershell.exe 3244 powershell.exe 3244 powershell.exe 3036 DllCommonsvc.exe 3036 DllCommonsvc.exe 3472 powershell.exe 4308 powershell.exe 1084 powershell.exe 3264 powershell.exe 2504 powershell.exe 668 powershell.exe 632 powershell.exe 5040 powershell.exe 3244 powershell.exe 3592 powershell.exe 4936 DllCommonsvc.exe 2928 DllCommonsvc.exe 1672 DllCommonsvc.exe 3084 DllCommonsvc.exe 4292 DllCommonsvc.exe 3564 DllCommonsvc.exe 1820 DllCommonsvc.exe 32 DllCommonsvc.exe 4972 DllCommonsvc.exe 2576 DllCommonsvc.exe 4336 DllCommonsvc.exe 2972 DllCommonsvc.exe -
Suspicious use of AdjustPrivilegeToken 26 IoCs
description pid Process Token: SeDebugPrivilege 4544 DllCommonsvc.exe Token: SeDebugPrivilege 3472 powershell.exe Token: SeDebugPrivilege 1084 powershell.exe Token: SeDebugPrivilege 3264 powershell.exe Token: SeDebugPrivilege 668 powershell.exe Token: SeDebugPrivilege 208 powershell.exe Token: SeDebugPrivilege 3116 powershell.exe Token: SeDebugPrivilege 4308 powershell.exe Token: SeDebugPrivilege 632 powershell.exe Token: SeDebugPrivilege 5040 powershell.exe Token: SeDebugPrivilege 2504 powershell.exe Token: SeDebugPrivilege 3592 powershell.exe Token: SeDebugPrivilege 3036 DllCommonsvc.exe Token: SeDebugPrivilege 3244 powershell.exe Token: SeDebugPrivilege 4936 DllCommonsvc.exe Token: SeDebugPrivilege 2928 DllCommonsvc.exe Token: SeDebugPrivilege 1672 DllCommonsvc.exe Token: SeDebugPrivilege 3084 DllCommonsvc.exe Token: SeDebugPrivilege 4292 DllCommonsvc.exe Token: SeDebugPrivilege 3564 DllCommonsvc.exe Token: SeDebugPrivilege 1820 DllCommonsvc.exe Token: SeDebugPrivilege 32 DllCommonsvc.exe Token: SeDebugPrivilege 4972 DllCommonsvc.exe Token: SeDebugPrivilege 2576 DllCommonsvc.exe Token: SeDebugPrivilege 4336 DllCommonsvc.exe Token: SeDebugPrivilege 2972 DllCommonsvc.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2008 wrote to memory of 2300 2008 JaffaCakes118_a31a2c723d18f5db2c5d963c5fffb6f1931384e5b24dd2da129d1a208f27322a.exe 82 PID 2008 wrote to memory of 2300 2008 JaffaCakes118_a31a2c723d18f5db2c5d963c5fffb6f1931384e5b24dd2da129d1a208f27322a.exe 82 PID 2008 wrote to memory of 2300 2008 JaffaCakes118_a31a2c723d18f5db2c5d963c5fffb6f1931384e5b24dd2da129d1a208f27322a.exe 82 PID 2300 wrote to memory of 1884 2300 WScript.exe 87 PID 2300 wrote to memory of 1884 2300 WScript.exe 87 PID 2300 wrote to memory of 1884 2300 WScript.exe 87 PID 1884 wrote to memory of 4544 1884 cmd.exe 89 PID 1884 wrote to memory of 4544 1884 cmd.exe 89 PID 4544 wrote to memory of 208 4544 DllCommonsvc.exe 123 PID 4544 wrote to memory of 208 4544 DllCommonsvc.exe 123 PID 4544 wrote to memory of 3116 4544 DllCommonsvc.exe 124 PID 4544 wrote to memory of 3116 4544 DllCommonsvc.exe 124 PID 4544 wrote to memory of 2504 4544 DllCommonsvc.exe 125 PID 4544 wrote to memory of 2504 4544 DllCommonsvc.exe 125 PID 4544 wrote to memory of 3244 4544 DllCommonsvc.exe 126 PID 4544 wrote to memory of 3244 4544 DllCommonsvc.exe 126 PID 4544 wrote to memory of 5040 4544 DllCommonsvc.exe 127 PID 4544 wrote to memory of 5040 4544 DllCommonsvc.exe 127 PID 4544 wrote to memory of 1084 4544 DllCommonsvc.exe 128 PID 4544 wrote to memory of 1084 4544 DllCommonsvc.exe 128 PID 4544 wrote to memory of 3592 4544 DllCommonsvc.exe 129 PID 4544 wrote to memory of 3592 4544 DllCommonsvc.exe 129 PID 4544 wrote to memory of 632 4544 DllCommonsvc.exe 130 PID 4544 wrote to memory of 632 4544 DllCommonsvc.exe 130 PID 4544 wrote to memory of 4308 4544 DllCommonsvc.exe 131 PID 4544 wrote to memory of 4308 4544 DllCommonsvc.exe 131 PID 4544 wrote to memory of 3472 4544 DllCommonsvc.exe 132 PID 4544 wrote to memory of 3472 4544 DllCommonsvc.exe 132 PID 4544 wrote to memory of 668 4544 DllCommonsvc.exe 133 PID 4544 wrote to memory of 668 4544 DllCommonsvc.exe 133 PID 4544 wrote to memory of 3264 4544 DllCommonsvc.exe 134 PID 4544 wrote to memory of 3264 4544 DllCommonsvc.exe 134 PID 4544 wrote to memory of 3036 4544 DllCommonsvc.exe 146 PID 4544 wrote to memory of 3036 4544 DllCommonsvc.exe 146 PID 3036 wrote to memory of 1748 3036 DllCommonsvc.exe 151 PID 3036 wrote to memory of 1748 3036 DllCommonsvc.exe 151 PID 1748 wrote to memory of 4312 1748 cmd.exe 153 PID 1748 wrote to memory of 4312 1748 cmd.exe 153 PID 1748 wrote to memory of 4936 1748 cmd.exe 154 PID 1748 wrote to memory of 4936 1748 cmd.exe 154 PID 4936 wrote to memory of 4144 4936 DllCommonsvc.exe 155 PID 4936 wrote to memory of 4144 4936 DllCommonsvc.exe 155 PID 4144 wrote to memory of 3608 4144 cmd.exe 157 PID 4144 wrote to memory of 3608 4144 cmd.exe 157 PID 4144 wrote to memory of 2928 4144 cmd.exe 159 PID 4144 wrote to memory of 2928 4144 cmd.exe 159 PID 2928 wrote to memory of 3456 2928 DllCommonsvc.exe 161 PID 2928 wrote to memory of 3456 2928 DllCommonsvc.exe 161 PID 3456 wrote to memory of 1324 3456 cmd.exe 163 PID 3456 wrote to memory of 1324 3456 cmd.exe 163 PID 3456 wrote to memory of 1672 3456 cmd.exe 164 PID 3456 wrote to memory of 1672 3456 cmd.exe 164 PID 1672 wrote to memory of 4556 1672 DllCommonsvc.exe 165 PID 1672 wrote to memory of 4556 1672 DllCommonsvc.exe 165 PID 4556 wrote to memory of 1840 4556 cmd.exe 167 PID 4556 wrote to memory of 1840 4556 cmd.exe 167 PID 4556 wrote to memory of 3084 4556 cmd.exe 168 PID 4556 wrote to memory of 3084 4556 cmd.exe 168 PID 3084 wrote to memory of 4896 3084 DllCommonsvc.exe 169 PID 3084 wrote to memory of 4896 3084 DllCommonsvc.exe 169 PID 4896 wrote to memory of 1756 4896 cmd.exe 171 PID 4896 wrote to memory of 1756 4896 cmd.exe 171 PID 4896 wrote to memory of 4292 4896 cmd.exe 172 PID 4896 wrote to memory of 4292 4896 cmd.exe 172 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a31a2c723d18f5db2c5d963c5fffb6f1931384e5b24dd2da129d1a208f27322a.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a31a2c723d18f5db2c5d963c5fffb6f1931384e5b24dd2da129d1a208f27322a.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\providercommon\DllCommonsvc.exe"C:\providercommon\DllCommonsvc.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:208
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Crashpad\reports\dwm.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3116
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Panther\setup.exe\System.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2504
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Mail\services.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3244
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\winlogon.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5040
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Java\jre-1.8\bin\plugin2\wininit.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1084
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Mozilla Firefox\browser\features\OfficeClickToRun.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3592
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Microsoft Office\root\Integration\Addons\Idle.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:632
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\RuntimeBroker.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4308
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\upfc.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3472
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\DllCommonsvc.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:668
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Searches\WmiPrvSE.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3264
-
-
C:\Users\Public\DllCommonsvc.exe"C:\Users\Public\DllCommonsvc.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\GzuRWOxc20.bat"6⤵
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:27⤵PID:4312
-
-
C:\Users\Public\DllCommonsvc.exe"C:\Users\Public\DllCommonsvc.exe"7⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\paq62miIo8.bat"8⤵
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:29⤵PID:3608
-
-
C:\Users\Public\DllCommonsvc.exe"C:\Users\Public\DllCommonsvc.exe"9⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Zj0hR7WTEZ.bat"10⤵
- Suspicious use of WriteProcessMemory
PID:3456 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:211⤵PID:1324
-
-
C:\Users\Public\DllCommonsvc.exe"C:\Users\Public\DllCommonsvc.exe"11⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\B7rL9EqqPR.bat"12⤵
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:213⤵PID:1840
-
-
C:\Users\Public\DllCommonsvc.exe"C:\Users\Public\DllCommonsvc.exe"13⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3084 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\VlbjwdcMOl.bat"14⤵
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:215⤵PID:1756
-
-
C:\Users\Public\DllCommonsvc.exe"C:\Users\Public\DllCommonsvc.exe"15⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4292 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\paq62miIo8.bat"16⤵PID:2320
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:217⤵PID:3820
-
-
C:\Users\Public\DllCommonsvc.exe"C:\Users\Public\DllCommonsvc.exe"17⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3564 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Zj0hR7WTEZ.bat"18⤵PID:4900
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:219⤵PID:4940
-
-
C:\Users\Public\DllCommonsvc.exe"C:\Users\Public\DllCommonsvc.exe"19⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1820 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\iS8tBRk2Vg.bat"20⤵PID:2012
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:221⤵PID:5000
-
-
C:\Users\Public\DllCommonsvc.exe"C:\Users\Public\DllCommonsvc.exe"21⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:32 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\M1TWCJOn7d.bat"22⤵PID:3776
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:223⤵PID:100
-
-
C:\Users\Public\DllCommonsvc.exe"C:\Users\Public\DllCommonsvc.exe"23⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4972 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\wUI7DLfHyj.bat"24⤵PID:528
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:225⤵PID:3600
-
-
C:\Users\Public\DllCommonsvc.exe"C:\Users\Public\DllCommonsvc.exe"25⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2576 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\1CE969IshF.bat"26⤵PID:2688
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:227⤵PID:1952
-
-
C:\Users\Public\DllCommonsvc.exe"C:\Users\Public\DllCommonsvc.exe"27⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4336 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\8KwMxVG80h.bat"28⤵PID:4668
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:229⤵PID:4964
-
-
C:\Users\Public\DllCommonsvc.exe"C:\Users\Public\DllCommonsvc.exe"29⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2972 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\uP802u8Cku.bat"30⤵PID:2036
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:231⤵PID:2896
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 7 /tr "'C:\Program Files\Crashpad\reports\dwm.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3208
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files\Crashpad\reports\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2132
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\Program Files\Crashpad\reports\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2972
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 13 /tr "'C:\Windows\Panther\setup.exe\System.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1080
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Windows\Panther\setup.exe\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4992
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 8 /tr "'C:\Windows\Panther\setup.exe\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1756
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Mail\services.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4964
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\services.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:212
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Mail\services.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1020
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4248
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4596
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4312
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\Program Files\Java\jre-1.8\bin\plugin2\wininit.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4880
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files\Java\jre-1.8\bin\plugin2\wininit.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2268
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\Program Files\Java\jre-1.8\bin\plugin2\wininit.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5036
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 6 /tr "'C:\Program Files\Mozilla Firefox\browser\features\OfficeClickToRun.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4732
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\browser\features\OfficeClickToRun.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1784
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 13 /tr "'C:\Program Files\Mozilla Firefox\browser\features\OfficeClickToRun.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1368
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\Program Files\Microsoft Office\root\Integration\Addons\Idle.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5044
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\root\Integration\Addons\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1396
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 10 /tr "'C:\Program Files\Microsoft Office\root\Integration\Addons\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3216
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\providercommon\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3260
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\providercommon\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2436
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\providercommon\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4752
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "upfcu" /sc MINUTE /mo 10 /tr "'C:\providercommon\upfc.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3884
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\providercommon\upfc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4336
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "upfcu" /sc MINUTE /mo 7 /tr "'C:\providercommon\upfc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1456
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 6 /tr "'C:\Users\Public\DllCommonsvc.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5116
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\Users\Public\DllCommonsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:996
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 13 /tr "'C:\Users\Public\DllCommonsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:760
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\Searches\WmiPrvSE.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1200
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Users\Admin\Searches\WmiPrvSE.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4944
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\Searches\WmiPrvSE.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5020
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD57f3c0ae41f0d9ae10a8985a2c327b8fb
SHA1d58622bf6b5071beacf3b35bb505bde2000983e3
SHA256519fceae4d0dd4d09edd1b81bcdfa8aeab4b59eee77a4cd4b6295ce8e591a900
SHA5128a8fd17eef071f86e672cba0d8fc2cfed6118aff816100b9d7c06eb96443c04c04bc5692259c8d7ecb1563e877921939c61726605af4f969e3f586f0913ed125
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD56d3e9c29fe44e90aae6ed30ccf799ca8
SHA1c7974ef72264bbdf13a2793ccf1aed11bc565dce
SHA2562360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d
SHA51260c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a
-
Filesize
944B
MD56d42b6da621e8df5674e26b799c8e2aa
SHA1ab3ce1327ea1eeedb987ec823d5e0cb146bafa48
SHA2565ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c
SHA51253faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29
-
Filesize
944B
MD5d28a889fd956d5cb3accfbaf1143eb6f
SHA1157ba54b365341f8ff06707d996b3635da8446f7
SHA25621e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45
SHA5120b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c
-
Filesize
944B
MD5cadef9abd087803c630df65264a6c81c
SHA1babbf3636c347c8727c35f3eef2ee643dbcc4bd2
SHA256cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438
SHA5127278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085
-
Filesize
944B
MD5bd5940f08d0be56e65e5f2aaf47c538e
SHA1d7e31b87866e5e383ab5499da64aba50f03e8443
SHA2562d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6
SHA512c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406
-
Filesize
944B
MD53a6bad9528f8e23fb5c77fbd81fa28e8
SHA1f127317c3bc6407f536c0f0600dcbcf1aabfba36
SHA256986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05
SHA512846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2
-
Filesize
197B
MD5eed998e9c534d5750ded966948084ca7
SHA1469d1dbd62c39adc375c5360c798631ed651dec8
SHA2567f528140023526c032a3d74cb35d0865a0cf5ba6e67dcff7e2e9d6986d5c9935
SHA512100605cdff6ad593d1b85cd80e11fbf79ba9c70631cfe4b56f6ccd76ca6be0ad3fef17d471b8d729ad84521a1e1716f73784fb5b80b733500d292201c4f81516
-
Filesize
197B
MD5de8e5b82ea98ad7ef79fe35c9d5270f6
SHA1487e51e7ef9a72b947b1fcbae85aadb99becd543
SHA2560f2907df48df11ee163a940da99b5385fbe0b4985f801e5fa916d81386013a01
SHA5120b4b3992cfe1c61457607dca68e95f28ffb1e3ff8f4e093d9ac6240531450d4346330896dfa2a2c29ebc28b0e234fdbd274bc3de2f62706f166173373ba192f4
-
Filesize
197B
MD5cc468492fae4cb494aaf44152e33b6a2
SHA1245ec7cf535e137ad7ef4f10de18be38d8e8f916
SHA2564fc568c19d1d5ebf84cd46ddaa97d9f1df447e81ab23d423b1606130e46a3149
SHA51251728659faa19b6d6cc56cc49d50c78f494bd51d5f952b43fa7215d442df64762e9152bb83192b68a20fdf8409ed21ab1bb8e639a037e7b28090b05420361395
-
Filesize
197B
MD5a9548c41e6caa6c1643e068f51d344fe
SHA12438db2e072590fcaa244d1c8459d9e51f51ede9
SHA256117589b95de4f1b97e80cedf04b1f19bfe0b5b0070fced42e0c9716976980b34
SHA512f1002cb8ca14e1b584a2c3346618bd7e7982c2f29a604438c17ba2f940f7b850787b79ac7a47be554366634c764eddacdc11b54ce2b1ad1f88b7dbefde66f98c
-
Filesize
197B
MD5a2b38dd6c03f7bd543c29c0c89ccb120
SHA101ab4a27736d40938000cba173df363a8921e811
SHA25645c5fad80ec9ebcd8cc14f9146b09155289909c4a4a17d3df9f0f7f5324db218
SHA512387cd3bb7bd606eec02b4cf6e0a83d9deb56e970703db95754375cac4f2c730278d0e6a368f02b240aa32d2d4f20daef514afb90d2953cbd29e1c6312c3c188b
-
Filesize
197B
MD511c1a08700f2c2acccb4ee59573f081d
SHA1370415ea20b10af6da0a59e96b7addef345cb291
SHA2564d63c5364cceffbbcdadef9739914e62839c907db2863af377d6a47b7313ec82
SHA512b9829313ff9a1481b8bfbcfe42454cd47629292a50328ab5976b541ed0348026fc095dcf1604cba18f447d51bb22d130acb11f7e817e26c16b26de13766a5a0f
-
Filesize
197B
MD5bc2bc74c576dc35408643c7b9db3719f
SHA1f2f7e2a5307a3e8ed17199af029a6b960c58f4c9
SHA256082d1760becb4878eac59ce7614564547960d447cda85b41b3f7895475ff1831
SHA51284a010747eea23ecadfb64eb43b569d67769bb2a6231e12d82f26ab1885eb2d960cb9d908db84ece4b0353f635d14a57a7f8f06d74da2e7aabfabf0e08bac471
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
197B
MD5974602ebe4582ceb75e189363aae73b8
SHA10c2b3e78803b64923a49642d590eeb1abdebc80a
SHA25619c087556a2ae365e3c0c581b07cf64d7f157011b40064534e38bdd31574b860
SHA5126f38201053257126ba36fbc9719c06e73a44944dd0e493ce6a168e1301e4b47aae70570bdb600cd8e8dab6192be4e3f7ce3806cc73501513e5edf05fa8ee0922
-
Filesize
197B
MD5f60534ae680673fb784339f1020aa2db
SHA1ac8163f91b43c0fcf77a229211caacc4a4703c7e
SHA256b2e1ebda22fa6a8d7a2c3539cee3f694b9f76a429fd77927f278569938ff7f07
SHA51229352cb0fc1f8f8fc2464ffcadc46ed06b0ccfd2811f5b713ea304211d87e52232fe2abd59dca0f275a4995c076a5927d84cfa3dec1d4757aaf7f224313a5f26
-
Filesize
197B
MD58b90fe24e9da76c25b52194f816ab774
SHA15cbd3b7415afd459f1ebd2f3dd8e02437fec4809
SHA256365ea0c13a129076ff309f4a9436d95f62ed0e93c5d61fe744a2eeb592de84d1
SHA512c97ea00da1f4134c9c592d3c734d5e5cb2b91e141b6686c3836cc1a2c99240514030de0a219d1f713a47df564c3dfd555536f894a963e7971cf6e472519410c4
-
Filesize
197B
MD558c37a60454a398eecba79f6de0c0a71
SHA1c414d72035f0d7897bb008b60b9055a4ef2d5fad
SHA2562e0700a4c88f5d9b125bc69433e2bb27c0f35bfda9000f3390ea6565ba87b5d6
SHA512e9acac8802efd722e8977be4f2617e2db1b705a4617edb244bfed554d577c7d8fdcb8485a9bc7c43e3592450ec2c0fb8eeaa2844ae78b346a4e1485b1fb87799
-
Filesize
36B
MD56783c3ee07c7d151ceac57f1f9c8bed7
SHA117468f98f95bf504cc1f83c49e49a78526b3ea03
SHA2568ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322
SHA512c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8
-
Filesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
Filesize
197B
MD58088241160261560a02c84025d107592
SHA1083121f7027557570994c9fc211df61730455bb5
SHA2562072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1
SHA51220d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478