Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    30/12/2024, 02:31

General

  • Target

    JaffaCakes118_71f09cd837628dea19f731b255aa669853a37c378192429d86d71bbd554bd0a3.exe

  • Size

    1.3MB

  • MD5

    10a72cdc2e7f57dd910b5033810f0d65

  • SHA1

    dc1502dadabf56e71112f3af091d65aba18bf918

  • SHA256

    71f09cd837628dea19f731b255aa669853a37c378192429d86d71bbd554bd0a3

  • SHA512

    2d9297dfe277f91cc7d6ce8afe0ae201303a5c69b5d48b43f9cc4d94c83efce48c001ef293ab3f7a6450c222219f565843a2b25eaee6bd8d79ac43a53cb37814

  • SSDEEP

    24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Dcrat family
  • Process spawned unexpected child process 27 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • DCRat payload 9 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Executes dropped EXE 11 IoCs
  • Loads dropped DLL 2 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 11 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 27 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 23 IoCs
  • Suspicious use of AdjustPrivilegeToken 21 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_71f09cd837628dea19f731b255aa669853a37c378192429d86d71bbd554bd0a3.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_71f09cd837628dea19f731b255aa669853a37c378192429d86d71bbd554bd0a3.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2168
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2060
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\providercommon\1zu9dW.bat" "
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1804
        • C:\providercommon\DllCommonsvc.exe
          "C:\providercommon\DllCommonsvc.exe"
          4⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2680
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2236
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\cmd.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2252
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\csrss.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:572
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\cmd.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1064
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\RemotePackages\RemoteApps\lsm.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:760
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\dllhost.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:616
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Vss\Writers\System\wininit.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:276
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\OSPPSVC.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:844
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\audiodg.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2952
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\explorer.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2572
          • C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\cmd.exe
            "C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\cmd.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1212
            • C:\Windows\System32\cmd.exe
              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\QO5FEA9wo1.bat"
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:2364
              • C:\Windows\system32\w32tm.exe
                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                7⤵
                  PID:1356
                • C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\cmd.exe
                  "C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\cmd.exe"
                  7⤵
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:644
                  • C:\Windows\System32\cmd.exe
                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\9avng9MHpa.bat"
                    8⤵
                    • Suspicious use of WriteProcessMemory
                    PID:1844
                    • C:\Windows\system32\w32tm.exe
                      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                      9⤵
                        PID:1048
                      • C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\cmd.exe
                        "C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\cmd.exe"
                        9⤵
                        • Executes dropped EXE
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        PID:2212
                        • C:\Windows\System32\cmd.exe
                          "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\x5nMQhEI33.bat"
                          10⤵
                            PID:1984
                            • C:\Windows\system32\w32tm.exe
                              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                              11⤵
                                PID:1580
                              • C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\cmd.exe
                                "C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\cmd.exe"
                                11⤵
                                • Executes dropped EXE
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of AdjustPrivilegeToken
                                PID:3036
                                • C:\Windows\System32\cmd.exe
                                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\VoHf0I0Wzs.bat"
                                  12⤵
                                    PID:1708
                                    • C:\Windows\system32\w32tm.exe
                                      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                      13⤵
                                        PID:2916
                                      • C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\cmd.exe
                                        "C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\cmd.exe"
                                        13⤵
                                        • Executes dropped EXE
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:2472
                                        • C:\Windows\System32\cmd.exe
                                          "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Wm5t4PlH1R.bat"
                                          14⤵
                                            PID:1428
                                            • C:\Windows\system32\w32tm.exe
                                              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                              15⤵
                                                PID:3056
                                              • C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\cmd.exe
                                                "C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\cmd.exe"
                                                15⤵
                                                • Executes dropped EXE
                                                • Suspicious behavior: EnumeratesProcesses
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:1536
                                                • C:\Windows\System32\cmd.exe
                                                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\F82V1kRox2.bat"
                                                  16⤵
                                                    PID:2176
                                                    • C:\Windows\system32\w32tm.exe
                                                      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                      17⤵
                                                        PID:484
                                                      • C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\cmd.exe
                                                        "C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\cmd.exe"
                                                        17⤵
                                                        • Executes dropped EXE
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:2404
                                                        • C:\Windows\System32\cmd.exe
                                                          "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\b3FUfZROOv.bat"
                                                          18⤵
                                                            PID:1864
                                                            • C:\Windows\system32\w32tm.exe
                                                              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                              19⤵
                                                                PID:2500
                                                              • C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\cmd.exe
                                                                "C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\cmd.exe"
                                                                19⤵
                                                                • Executes dropped EXE
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:2864
                                                                • C:\Windows\System32\cmd.exe
                                                                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\IMpAoVHioU.bat"
                                                                  20⤵
                                                                    PID:1376
                                                                    • C:\Windows\system32\w32tm.exe
                                                                      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                      21⤵
                                                                        PID:2236
                                                                      • C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\cmd.exe
                                                                        "C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\cmd.exe"
                                                                        21⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        PID:1548
                                                                        • C:\Windows\System32\cmd.exe
                                                                          "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\VDNADHaqjn.bat"
                                                                          22⤵
                                                                            PID:2664
                                                                            • C:\Windows\system32\w32tm.exe
                                                                              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                              23⤵
                                                                                PID:1352
                                                                              • C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\cmd.exe
                                                                                "C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\cmd.exe"
                                                                                23⤵
                                                                                • Executes dropped EXE
                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                PID:1584
                                                                                • C:\Windows\System32\cmd.exe
                                                                                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\epFjAgKouK.bat"
                                                                                  24⤵
                                                                                    PID:2980
                                                                                    • C:\Windows\system32\w32tm.exe
                                                                                      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                      25⤵
                                                                                        PID:1532
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 5 /tr "'C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\cmd.exe'" /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:2468
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\cmd.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:2872
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 9 /tr "'C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\cmd.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:2616
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Users\Default User\csrss.exe'" /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:2828
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Default User\csrss.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:1836
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Users\Default User\csrss.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:2620
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\AppData\Roaming\cmd.exe'" /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:3020
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Roaming\cmd.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:2292
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\AppData\Roaming\cmd.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:644
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "lsml" /sc MINUTE /mo 5 /tr "'C:\Windows\RemotePackages\RemoteApps\lsm.exe'" /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:1664
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Windows\RemotePackages\RemoteApps\lsm.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:1408
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "lsml" /sc MINUTE /mo 7 /tr "'C:\Windows\RemotePackages\RemoteApps\lsm.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:1764
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\providercommon\dllhost.exe'" /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:1924
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\providercommon\dllhost.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:1988
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\providercommon\dllhost.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:700
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 8 /tr "'C:\Windows\Vss\Writers\System\wininit.exe'" /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:2068
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Windows\Vss\Writers\System\wininit.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:2676
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 12 /tr "'C:\Windows\Vss\Writers\System\wininit.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:2648
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 7 /tr "'C:\providercommon\OSPPSVC.exe'" /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:2888
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\providercommon\OSPPSVC.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:2232
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 8 /tr "'C:\providercommon\OSPPSVC.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:1284
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 8 /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\audiodg.exe'" /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:1820
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\audiodg.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:2136
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 12 /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\audiodg.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:2280
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\providercommon\explorer.exe'" /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:2108
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\providercommon\explorer.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:1292
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\providercommon\explorer.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:784

                                      Network

                                            MITRE ATT&CK Enterprise v15

                                            Replay Monitor

                                            Loading Replay Monitor...

                                            Downloads

                                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                              Filesize

                                              342B

                                              MD5

                                              e737ec274e0fc813619f9f3f19fd487f

                                              SHA1

                                              de9dd67e2150d231694d5cc92a3f198dc400e1e7

                                              SHA256

                                              88f201c5d2a02a2e9547afcbb30aaf65ed07c152adb934f200c6d2e57daf38a0

                                              SHA512

                                              244ed3d36f49238ff3d0a822d0368d071ec66e3b07689729bf408bb354211ecda68c1b4de37bda974a8c91a10d819a6ff213ea38fcef998c7229c5d076696f4f

                                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                              Filesize

                                              342B

                                              MD5

                                              edf352b24fc01befb7cf1c1770dafcb8

                                              SHA1

                                              88556f5c31a90bff2f923d4ae3e43cd553d0ece6

                                              SHA256

                                              d1cf2c572692f84ab77511552dfc875d7fae6d16535d0d74f8dd9ff085c3f130

                                              SHA512

                                              583035626ee09a069d482f5b3066c714757b1ba9e6ee8c7d7c7861586b5528eee64d1642915adefe87a3d9a18406934155c1ea1131ef78d17cb24e19f2951802

                                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                              Filesize

                                              342B

                                              MD5

                                              78fa509f5b05dc4074668ac41bb44a2a

                                              SHA1

                                              f9aafa763f69fbf21708af5b241f6159759aad8e

                                              SHA256

                                              30a6d630f60957a268f6a12b5247e6e7ef0bd2b7b88d096731d710a51aa1a426

                                              SHA512

                                              e2d10138a7ce82c367fcebabb595743b60fee6096859f43214d466d321d10d9ca061784aa39a9222a84bedc3289798790d22a0d1e39e45e98b5d71cf07e71f20

                                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                              Filesize

                                              342B

                                              MD5

                                              4892307fdf17080bae9b068f114aff9b

                                              SHA1

                                              113b4f90f10809ad2871126c0342e1b7471c8e87

                                              SHA256

                                              d1b744869d46c7b7ae8ddaa25e7bec42eb0b53eea00bf1fcff6f76ea78075a5a

                                              SHA512

                                              37c217d11fe1fc9f1b44ed6007647326b8bd79171c57a0827128250bd6a7ec0e1a571fb94d49f5713e2eab73637ccd90a38be65071277011cbf8603949e46912

                                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                              Filesize

                                              342B

                                              MD5

                                              023563e23f7df9321cc96b2fc439f078

                                              SHA1

                                              53d247dcec079edd32151f2662c24a57a2e462bc

                                              SHA256

                                              6e02527f5ca99bcf5e20a7b1af2acfc32baa527911266aa3eb1b5c710f41d1fd

                                              SHA512

                                              9920087d26fcf3ad2c2153799cd4d6d3e9ed7f606cda82c45cd777e1e39701b5351394ba153f0f2dcbbfc37def769e5bffeb7c9053b3e83599253fbd36426912

                                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                              Filesize

                                              342B

                                              MD5

                                              ba581b11d8d1752c0a62efc728ffa5e6

                                              SHA1

                                              4475c060427cf100839579b5415260feb04e0750

                                              SHA256

                                              b0d80f0fa692d11c6c0b9c2cbd8c3934117e8a5712d14c078639977f03f75be0

                                              SHA512

                                              6ca207598329120715bc276cfe3754d043c7e8e4733ab0120d293e209632a0ea5fcaa9b410b88109cb275d29695e619a4355ef094b18c6dd3ac844890914824b

                                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                              Filesize

                                              342B

                                              MD5

                                              081990756faeee74974483c1de9d879c

                                              SHA1

                                              f2325164b304a8e9d29e5365e6a66dcd996d498c

                                              SHA256

                                              421035e96aa9d301c3481aa12d5102b7694a54af530234268e846f2f50ecc497

                                              SHA512

                                              b61f0607297eb9f2cbe0a1465a0effea6925d6b09e5d4bea471125dc9fb4ba4f23fedb61c22f1392e10615710054aa8eabb9aed35083ea3cf2d66a19d1742fba

                                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                              Filesize

                                              342B

                                              MD5

                                              dcff8de5325fefd15ab1717b3d20a74a

                                              SHA1

                                              aa9bcc53a5fcc8c306a5cf02cbab558436c79336

                                              SHA256

                                              73aa90874d3984dc15e8fdb4905635f64f3d277e994be178cc5c222b3dba2397

                                              SHA512

                                              677e65437276b5e98d5d2c2ca190759f1d2724b02f8d2b116672c8d45b17647549bf42ac89d6f22e165190a9d2ce0cc1a35c891814c72690fa368306090d61e1

                                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                              Filesize

                                              342B

                                              MD5

                                              a18fcf88d1c70bb0f7d0a78f88594a7f

                                              SHA1

                                              0c71aed1925f269c66aeb5d52c9c75550ff01436

                                              SHA256

                                              5110414b5e094d512185747680f22c1378576f89a8df39dbdb602e833ddec08e

                                              SHA512

                                              e11341ac2a675268de3df7908676f6eb2f9d0f0fffb1830cb847a88776fa1c62776b914eb9984087225bfe71754ee2f13b659e5c79defd58aa1653544e5a6391

                                            • C:\Users\Admin\AppData\Local\Temp\9avng9MHpa.bat

                                              Filesize

                                              222B

                                              MD5

                                              49876d5728cbd550e42f3d8cd31c4cc8

                                              SHA1

                                              d820ee39833d865bbabbdd3c1830111b4d29b779

                                              SHA256

                                              f79f5315d3f394e9ec86215fa38a5879329c019d1f5b0bf78140d8fdfd52336b

                                              SHA512

                                              38fb133ba2e8d832296aadc3bd9fab1c6d619c50a0111dd41a9ca2aa950f9c3438c913ca4ce4d01a25da7e8cc009153eb5c52fc09d1cee4c84f845faf90e22be

                                            • C:\Users\Admin\AppData\Local\Temp\CabC821.tmp

                                              Filesize

                                              70KB

                                              MD5

                                              49aebf8cbd62d92ac215b2923fb1b9f5

                                              SHA1

                                              1723be06719828dda65ad804298d0431f6aff976

                                              SHA256

                                              b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

                                              SHA512

                                              bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

                                            • C:\Users\Admin\AppData\Local\Temp\F82V1kRox2.bat

                                              Filesize

                                              222B

                                              MD5

                                              2ac3cf45b31a7e4d8001c0764a26c70f

                                              SHA1

                                              a3c67f6a3430a46660159edb28465a0870448263

                                              SHA256

                                              e381e7443a760822eb438cd56e255b33f974f5a8deecbbc1a861aaeae77abe00

                                              SHA512

                                              d1f71d681aa0bd175fe96d4a7e8a5311375b374dfbfbff70df593db963a5b541d3156dfbb4e65c9d0cde1f4c8a0d9476ca4939d6cc26926c41fdd383f7f57db7

                                            • C:\Users\Admin\AppData\Local\Temp\IMpAoVHioU.bat

                                              Filesize

                                              222B

                                              MD5

                                              99a5585668d66283836a468a5568cd73

                                              SHA1

                                              2240f79fd8e681f710cf747c181024dfef9032ac

                                              SHA256

                                              a892817e78d703b71a0a9fcfaaecc2c51e6ea7c8f50bbf078ae705f3a7409833

                                              SHA512

                                              96333d84f83f66a46304c1b8446c271328baae20b3ae11e37dca4f105d1958deb0bef994680f984a0802d24861dc91f7a55d18ec60c0d9da9cfd1a935a66beba

                                            • C:\Users\Admin\AppData\Local\Temp\QO5FEA9wo1.bat

                                              Filesize

                                              222B

                                              MD5

                                              170a82a5bb39adbe1ac2764c30651f63

                                              SHA1

                                              db01d4c649c27fe55a7eaab6af694d42a47d384b

                                              SHA256

                                              099af29f60b6032649cf46f58dfa57b801cfa3a3f49a3f1f7a91147ea4e06080

                                              SHA512

                                              56d6e931c15e00957b4105ef3363cd8b76bc688761c81178aa515b3d46f2b13e3244098c320d6bfd23079e5dfd19e897a0de8e0e057d3acfacd98b65b5207aa9

                                            • C:\Users\Admin\AppData\Local\Temp\TarC844.tmp

                                              Filesize

                                              181KB

                                              MD5

                                              4ea6026cf93ec6338144661bf1202cd1

                                              SHA1

                                              a1dec9044f750ad887935a01430bf49322fbdcb7

                                              SHA256

                                              8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

                                              SHA512

                                              6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

                                            • C:\Users\Admin\AppData\Local\Temp\VDNADHaqjn.bat

                                              Filesize

                                              222B

                                              MD5

                                              fdd7362939aa4c354630b675f573d4f3

                                              SHA1

                                              d772af70dbadc0487b7ab229c1350acd23372b60

                                              SHA256

                                              eafea70d4c95fcdbb54b737fb7d7bb71526e4b65d2e38e251108390373bac56d

                                              SHA512

                                              39254543b2b0eeef7ad906722b8da8dd2cf530acf5f63e964770b6275809a9d8a2a650ca2a46079730afcc21c15693ceaee38afe06433a2664f65774421c91f6

                                            • C:\Users\Admin\AppData\Local\Temp\VoHf0I0Wzs.bat

                                              Filesize

                                              222B

                                              MD5

                                              bf3b043f63b78ea6510a4900a97cf2b7

                                              SHA1

                                              6fafa889f889d4e4491930419159dfd460899e2f

                                              SHA256

                                              cabf7da8725f484fee4adab4534d92a94c8dbe623ff0883123969ef724ebe40c

                                              SHA512

                                              c5422045413fede9efca4356ead5fa5014fbad0aa084fdaa89fe096d316af1967efc9dd42819fac0d1858c6ace6499901dcbee35796bb379fda60a068e4c073b

                                            • C:\Users\Admin\AppData\Local\Temp\Wm5t4PlH1R.bat

                                              Filesize

                                              222B

                                              MD5

                                              71bc2ae5a5fb7319f3e35d20207d4590

                                              SHA1

                                              f73b5bdb1f7e6346cf1f84e443bf64ceb0c1509b

                                              SHA256

                                              749c471ca39ccb7c7f6ce1f05255298f66df0ed98972b711842b62d863722ae9

                                              SHA512

                                              331665613a671d24babe57bd61a89d985f275559ddcc86334a0d48090304b0e6d8edd89ad4d589ccac03acf6b7b54456ba4db74719b24f119fbbbd3614d19033

                                            • C:\Users\Admin\AppData\Local\Temp\b3FUfZROOv.bat

                                              Filesize

                                              222B

                                              MD5

                                              30798499ffa0574f56c11f3244c455d7

                                              SHA1

                                              1b97406987886ccd11f817b7acb2536186365136

                                              SHA256

                                              25027e55acde40d4d928eec9feba1c644e005208abc720703561d151f9feaf3c

                                              SHA512

                                              40918b925644f529a15145fa272147405112ca465343367e7db8c25dc8807addb3e631ecdfc81827c975be1e1a4a8bd0abb3d791a8a5e510d64a40b6b3a48968

                                            • C:\Users\Admin\AppData\Local\Temp\epFjAgKouK.bat

                                              Filesize

                                              222B

                                              MD5

                                              47259aaf2a5ba9e6d6a05ef242f7c7d0

                                              SHA1

                                              67a6b1b84853538cd15a8a4105797302a6893ade

                                              SHA256

                                              a4cea47b640ef2a328c4457dc3a169d132ead3aa38a52fdb911017fda684b375

                                              SHA512

                                              e37964f0e2f2b410e1f126d00240b6b512f3262487031303089afcef7bef148e3cc6a80e32dac6a56155cf4a28364ef79dfcf7a155aa863e6a4e23119e0f0f88

                                            • C:\Users\Admin\AppData\Local\Temp\x5nMQhEI33.bat

                                              Filesize

                                              222B

                                              MD5

                                              c21eab64699bc7ec0a70f7851786034e

                                              SHA1

                                              c73b733794767b8086b69a648026bb54ff5782c4

                                              SHA256

                                              56e1f2fe3b40d018491b55236cb0a00b0d8a05af3aac1a9d3e6422cce70fb42b

                                              SHA512

                                              cc687fa10d8d72f921f94282e6fe5b56f7a56a102f42adfe2c70d4155acc3663925f0bb521008b325a0b302cc5e0719b4b678f519bd5fbd6543b9d565efbecd5

                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\QO5QXC5CPF025TPBDVUZ.temp

                                              Filesize

                                              7KB

                                              MD5

                                              d06d1cb298244f9755c8a9f0e49488b3

                                              SHA1

                                              b1ba4336cdd9c19b267ea474f9f8044be4770b83

                                              SHA256

                                              ed9fa0eaa3490a6c79c1154b9506226537d55f3a96dd2c74d259a207a0a7e5c3

                                              SHA512

                                              c5ea5de462f28e1b1a012cc3e504bb555e66fbc3b1d9910e97738a62d7accafec526dc8cab0abfeece73935ba15aa4746544300cd01015f9be680491062d93c9

                                            • C:\providercommon\1zu9dW.bat

                                              Filesize

                                              36B

                                              MD5

                                              6783c3ee07c7d151ceac57f1f9c8bed7

                                              SHA1

                                              17468f98f95bf504cc1f83c49e49a78526b3ea03

                                              SHA256

                                              8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

                                              SHA512

                                              c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

                                            • C:\providercommon\DllCommonsvc.exe

                                              Filesize

                                              1.0MB

                                              MD5

                                              bd31e94b4143c4ce49c17d3af46bcad0

                                              SHA1

                                              f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                              SHA256

                                              b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                              SHA512

                                              f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                            • C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

                                              Filesize

                                              197B

                                              MD5

                                              8088241160261560a02c84025d107592

                                              SHA1

                                              083121f7027557570994c9fc211df61730455bb5

                                              SHA256

                                              2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

                                              SHA512

                                              20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

                                            • memory/644-153-0x00000000004D0000-0x00000000004E2000-memory.dmp

                                              Filesize

                                              72KB

                                            • memory/644-152-0x0000000000240000-0x0000000000350000-memory.dmp

                                              Filesize

                                              1.1MB

                                            • memory/1212-42-0x0000000000080000-0x0000000000190000-memory.dmp

                                              Filesize

                                              1.1MB

                                            • memory/1548-571-0x0000000001390000-0x00000000014A0000-memory.dmp

                                              Filesize

                                              1.1MB

                                            • memory/2212-213-0x00000000003C0000-0x00000000004D0000-memory.dmp

                                              Filesize

                                              1.1MB

                                            • memory/2404-451-0x0000000001250000-0x0000000001360000-memory.dmp

                                              Filesize

                                              1.1MB

                                            • memory/2680-16-0x00000000002D0000-0x00000000002DC000-memory.dmp

                                              Filesize

                                              48KB

                                            • memory/2680-17-0x0000000000480000-0x000000000048C000-memory.dmp

                                              Filesize

                                              48KB

                                            • memory/2680-13-0x0000000000FA0000-0x00000000010B0000-memory.dmp

                                              Filesize

                                              1.1MB

                                            • memory/2680-14-0x00000000002C0000-0x00000000002D2000-memory.dmp

                                              Filesize

                                              72KB

                                            • memory/2680-15-0x00000000002E0000-0x00000000002EC000-memory.dmp

                                              Filesize

                                              48KB

                                            • memory/2864-511-0x0000000001280000-0x0000000001390000-memory.dmp

                                              Filesize

                                              1.1MB

                                            • memory/2952-53-0x000000001B630000-0x000000001B912000-memory.dmp

                                              Filesize

                                              2.9MB

                                            • memory/2952-54-0x0000000001C10000-0x0000000001C18000-memory.dmp

                                              Filesize

                                              32KB

                                            • memory/3036-273-0x0000000001100000-0x0000000001210000-memory.dmp

                                              Filesize

                                              1.1MB