Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    30/12/2024, 02:49

General

  • Target

    JaffaCakes118_d3cb3989ed3aa6cd9ee8d51a2878a697dcc4b20d574dc2a240aff2192548bf4c.exe

  • Size

    1.3MB

  • MD5

    7611c93f171fcae828a6392638eb46d2

  • SHA1

    5751f17b0e1e3963565ce4b40ae189e0eebe6420

  • SHA256

    d3cb3989ed3aa6cd9ee8d51a2878a697dcc4b20d574dc2a240aff2192548bf4c

  • SHA512

    67dd292126f7e20342ef9e91eb92d4297ef5e1ea9b69be8bf78fb21d2b85e9f6c460cf553657c5d42b734e3b19b78de1e9e6ea77cdf00911c27d9b110e12d73e

  • SSDEEP

    24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Dcrat family
  • Process spawned unexpected child process 24 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • DCRat payload 8 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 9 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Executes dropped EXE 11 IoCs
  • Loads dropped DLL 2 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 10 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 24 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 22 IoCs
  • Suspicious use of AdjustPrivilegeToken 20 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d3cb3989ed3aa6cd9ee8d51a2878a697dcc4b20d574dc2a240aff2192548bf4c.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d3cb3989ed3aa6cd9ee8d51a2878a697dcc4b20d574dc2a240aff2192548bf4c.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2532
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2580
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\providercommon\1zu9dW.bat" "
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2152
        • C:\providercommon\DllCommonsvc.exe
          "C:\providercommon\DllCommonsvc.exe"
          4⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2500
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2208
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\WMIADAP.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2280
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows NT\TableTextService\es-ES\wininit.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2200
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\lsass.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2188
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\winlogon.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:840
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\explorer.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2376
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\taskhost.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2444
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\spoolsv.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1360
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Panther\UnattendGC\taskhost.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1084
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Qh10l5BGEn.bat"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:1508
            • C:\Windows\system32\w32tm.exe
              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
              6⤵
                PID:952
              • C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\explorer.exe
                "C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\explorer.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:2928
                • C:\Windows\System32\cmd.exe
                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Q0tVgmHuxR.bat"
                  7⤵
                  • Suspicious use of WriteProcessMemory
                  PID:2988
                  • C:\Windows\system32\w32tm.exe
                    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                    8⤵
                      PID:2912
                    • C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\explorer.exe
                      "C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\explorer.exe"
                      8⤵
                      • Executes dropped EXE
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      PID:3016
                      • C:\Windows\System32\cmd.exe
                        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\xEvQv3iUx6.bat"
                        9⤵
                        • Suspicious use of WriteProcessMemory
                        PID:2592
                        • C:\Windows\system32\w32tm.exe
                          w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                          10⤵
                            PID:2332
                          • C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\explorer.exe
                            "C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\explorer.exe"
                            10⤵
                            • Executes dropped EXE
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            PID:2340
                            • C:\Windows\System32\cmd.exe
                              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\3jGxsc69Nm.bat"
                              11⤵
                                PID:2560
                                • C:\Windows\system32\w32tm.exe
                                  w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                  12⤵
                                    PID:2128
                                  • C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\explorer.exe
                                    "C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\explorer.exe"
                                    12⤵
                                    • Executes dropped EXE
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:2704
                                    • C:\Windows\System32\cmd.exe
                                      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ZES4mQr7Bk.bat"
                                      13⤵
                                        PID:2848
                                        • C:\Windows\system32\w32tm.exe
                                          w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                          14⤵
                                            PID:2036
                                          • C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\explorer.exe
                                            "C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\explorer.exe"
                                            14⤵
                                            • Executes dropped EXE
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:2976
                                            • C:\Windows\System32\cmd.exe
                                              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\q3WH03M43W.bat"
                                              15⤵
                                                PID:2396
                                                • C:\Windows\system32\w32tm.exe
                                                  w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                  16⤵
                                                    PID:2068
                                                  • C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\explorer.exe
                                                    "C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\explorer.exe"
                                                    16⤵
                                                    • Executes dropped EXE
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:3016
                                                    • C:\Windows\System32\cmd.exe
                                                      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\NDsGBfOUR3.bat"
                                                      17⤵
                                                        PID:2412
                                                        • C:\Windows\system32\w32tm.exe
                                                          w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                          18⤵
                                                            PID:1520
                                                          • C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\explorer.exe
                                                            "C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\explorer.exe"
                                                            18⤵
                                                            • Executes dropped EXE
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:1828
                                                            • C:\Windows\System32\cmd.exe
                                                              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\voEVGuhWUp.bat"
                                                              19⤵
                                                                PID:2204
                                                                • C:\Windows\system32\w32tm.exe
                                                                  w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                  20⤵
                                                                    PID:2520
                                                                  • C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\explorer.exe
                                                                    "C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\explorer.exe"
                                                                    20⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    PID:2756
                                                                    • C:\Windows\System32\cmd.exe
                                                                      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\z6HXYUNDfk.bat"
                                                                      21⤵
                                                                        PID:2724
                                                                        • C:\Windows\system32\w32tm.exe
                                                                          w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                          22⤵
                                                                            PID:2892
                                                                          • C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\explorer.exe
                                                                            "C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\explorer.exe"
                                                                            22⤵
                                                                            • Executes dropped EXE
                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:2720
                                                                            • C:\Windows\System32\cmd.exe
                                                                              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\oqEnL4f5pl.bat"
                                                                              23⤵
                                                                                PID:2896
                                                                                • C:\Windows\system32\w32tm.exe
                                                                                  w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                  24⤵
                                                                                    PID:1972
                                                                                  • C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\explorer.exe
                                                                                    "C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\explorer.exe"
                                                                                    24⤵
                                                                                    • Executes dropped EXE
                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                    PID:2320
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 8 /tr "'C:\providercommon\WMIADAP.exe'" /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:2736
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "WMIADAP" /sc ONLOGON /tr "'C:\providercommon\WMIADAP.exe'" /rl HIGHEST /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:2644
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 14 /tr "'C:\providercommon\WMIADAP.exe'" /rl HIGHEST /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:768
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows NT\TableTextService\es-ES\wininit.exe'" /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:1500
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files\Windows NT\TableTextService\es-ES\wininit.exe'" /rl HIGHEST /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:2628
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows NT\TableTextService\es-ES\wininit.exe'" /rl HIGHEST /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:2696
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\lsass.exe'" /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:2180
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\lsass.exe'" /rl HIGHEST /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:2632
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 7 /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\lsass.exe'" /rl HIGHEST /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:1092
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\winlogon.exe'" /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:1984
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\winlogon.exe'" /rl HIGHEST /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:2828
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\winlogon.exe'" /rl HIGHEST /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:1936
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "explorere" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\explorer.exe'" /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:1028
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\explorer.exe'" /rl HIGHEST /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:2156
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "explorere" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\explorer.exe'" /rl HIGHEST /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:2520
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\taskhost.exe'" /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:2848
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Users\Admin\taskhost.exe'" /rl HIGHEST /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:1988
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\taskhost.exe'" /rl HIGHEST /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:1428
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\providercommon\spoolsv.exe'" /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:2844
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\providercommon\spoolsv.exe'" /rl HIGHEST /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:1764
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\providercommon\spoolsv.exe'" /rl HIGHEST /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:2956
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 14 /tr "'C:\Windows\Panther\UnattendGC\taskhost.exe'" /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:1588
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Windows\Panther\UnattendGC\taskhost.exe'" /rl HIGHEST /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:2276
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 5 /tr "'C:\Windows\Panther\UnattendGC\taskhost.exe'" /rl HIGHEST /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:2132

                                    Network

                                          MITRE ATT&CK Enterprise v15

                                          Replay Monitor

                                          Loading Replay Monitor...

                                          Downloads

                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                            Filesize

                                            342B

                                            MD5

                                            594d060e778a7f0c90dfa2419513d07e

                                            SHA1

                                            93a977543d700ac1d65413a450942ecea473f746

                                            SHA256

                                            d24b4eb0aa564c9f3b26f60601188236927d4cc54fb1ac6cc22cab6c87bc2123

                                            SHA512

                                            6947901512d677e641482f0f87782592775eb66db796bc1ac86dac04cd81889e9816dbead5530e63c53b4c38454c9a33e5fa60c13df38026d2a66e508deb793b

                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                            Filesize

                                            342B

                                            MD5

                                            695a7593e5efc755507382a1b2f93824

                                            SHA1

                                            a969a820c25d28264e0f1691bb4b7278e227172d

                                            SHA256

                                            a948310f4d79acdd9c14d0751deeb66b7879ae711f2ee5e4a10ab3d56e3ecf15

                                            SHA512

                                            65cda4e44ca7f190d414e5ee45e1dd31c65222ee767abf07df7a1d9f33c16c1a6c8e55d3b53f2284a21a23074da004a546f68f3e1fdd7a4f25eda68ffcc62f98

                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                            Filesize

                                            342B

                                            MD5

                                            9d45425945b985147e25178c46062898

                                            SHA1

                                            e0ef0aaf4971c20b4bf137594ed2d1194aa9abeb

                                            SHA256

                                            cdb95d1db1ed126bfbee787084ace1cca35ec693bdbe52f511bcdaed6c7e387d

                                            SHA512

                                            e685af117d6f3621dcb24cb28367147de25d09c2fe263a4c9eae134a803c0349ab3aeff9f7790fa683af1856081966479cdf647f87fad364536612f79c24ccbf

                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                            Filesize

                                            342B

                                            MD5

                                            9bf3308e59addafe17c14f1895996e3d

                                            SHA1

                                            d730318f03f2a7a111517580a7a7e772fe8c1be9

                                            SHA256

                                            c5cf817b45ece5db533250582bd88a5b229cf71cc10ac0b626e63faad0ff73cb

                                            SHA512

                                            cb82ce5329cc4116e1234295aaf77c64daf70141bef2481dcb0d47fd7a73e89b5467fbcae6ff8bb98c568ebb9c938fef185be607169877f3302b62d43d247a1b

                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                            Filesize

                                            342B

                                            MD5

                                            5137ee65b798f17e913ecf79d76b0f29

                                            SHA1

                                            3562652f00a6900cc43d817758a1da69b88d0c17

                                            SHA256

                                            7156f3c798d1f1644a04b0c1d67cad5b1ba8fa16d11552cc0dc2a5fc1de553c1

                                            SHA512

                                            54a01da2539ef683982be2cc51b976c8dfa9a645dd265d85ce1f10ec46dbd4e05209a7999699f55d8fc065c0f1ae6afae4edac346eb01a49ca434301d9de04b0

                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                            Filesize

                                            342B

                                            MD5

                                            677cd6d5112de1a5fd9708490e0d2ac9

                                            SHA1

                                            9604362a40d73ca376df85ae235e3b91c030e647

                                            SHA256

                                            d48846d211736738081a19358a3d7d5a5151274b14cdb6a8f54b0952452737df

                                            SHA512

                                            b7dd9c570859f20d44970a4b7a51a4a6ab16c40390ac695aa1ab971600adb382f25fad97b80ea294f2eea7ddd482a63f7c7fca7c1354759eac739aa5c7e1293e

                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                            Filesize

                                            342B

                                            MD5

                                            c9729752d4176e42ef25bc9de7942cf1

                                            SHA1

                                            373b79579c61ba50d8531e229522b20d4ca5291d

                                            SHA256

                                            cdc0ff64e3dd64a49d8dd42ec208deaa008bf1d84f30da48bd30483246a00a8f

                                            SHA512

                                            486a7f80c3417be35e2d11cf9f6b88f18f38e527ec64fdcdd49510000ff966e6f2d282d3b02c718f340a564856371c4eb2377148ad1a2fc690941ded8d19d65a

                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                            Filesize

                                            342B

                                            MD5

                                            dd297802df9fdd4842b5f8473f2c288b

                                            SHA1

                                            e90287a913d0792a7f05fbcc946160c76a169e90

                                            SHA256

                                            7d219289e5b708ec510935909c28b61a9d2cc1d47fa5a1f3cd0fdb95d3a0bff8

                                            SHA512

                                            7af9d947d57254c7f3274d7e5e3ea691fda699d913ca33c4ae775828d50c0a508d265d63e968852d11898d495d49e48bc3c03d3f4c841f7d76fd71e6e863caf9

                                          • C:\Users\Admin\AppData\Local\Temp\3jGxsc69Nm.bat

                                            Filesize

                                            240B

                                            MD5

                                            d8a90d49582a1511556d17c72010780c

                                            SHA1

                                            00a497a15289fab6f936946d1a977a4008c30ffa

                                            SHA256

                                            321ca0e8a48a1eabb28156ad89f4cf9418ac90bd40a10a418327d9ecebe3dffe

                                            SHA512

                                            486f376e6b2422d9c231eb04bbdf8ab66f70e8d79a0971afb2d0c8188cd775f8a655533418eb2ff70e6f8e8f173650fdc31bebe4679c3a217a635b93aaa9c636

                                          • C:\Users\Admin\AppData\Local\Temp\Cab3046.tmp

                                            Filesize

                                            70KB

                                            MD5

                                            49aebf8cbd62d92ac215b2923fb1b9f5

                                            SHA1

                                            1723be06719828dda65ad804298d0431f6aff976

                                            SHA256

                                            b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

                                            SHA512

                                            bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

                                          • C:\Users\Admin\AppData\Local\Temp\NDsGBfOUR3.bat

                                            Filesize

                                            240B

                                            MD5

                                            4038575ebd201910086fd500e4bd2ffb

                                            SHA1

                                            289b4e926466ae3b1b748781174d984c95dd1d4a

                                            SHA256

                                            8b02686eed9984c55198ce5b2dca5dbb397cd7bcd742d7b1c8cbcf74c3931f4b

                                            SHA512

                                            634553fbb20d962a513c96e134c7bcb49bfab3c6cf329c0f457fc4f7eb12331b4b41156142f7c06ee8bc3051187c2faa6bcebf991b061dcbd13420c61b962242

                                          • C:\Users\Admin\AppData\Local\Temp\Q0tVgmHuxR.bat

                                            Filesize

                                            240B

                                            MD5

                                            5159e48ea840e52f3ab6094533354c3e

                                            SHA1

                                            47fc4a442a2c74b23b35fe8a7139d0cfa453484f

                                            SHA256

                                            e9734107f8817fe4b8634e043cf5a6813242e6bc339d92004a7c0c795b8a596a

                                            SHA512

                                            ec9d97e9a01bc5d98f258a02f5aba946ab4a04ffe45f2bb67424d42061ad5c2bdc07efbd4f34e4ecb7d2c094e117ce03c1d88a9a54d74b1ea146023b8c6f45d2

                                          • C:\Users\Admin\AppData\Local\Temp\Qh10l5BGEn.bat

                                            Filesize

                                            240B

                                            MD5

                                            6038330155c04bbb2cf97f5eaf0f560c

                                            SHA1

                                            b82e8943d3dabfaf359355963e6d8b18e0bc7fee

                                            SHA256

                                            e34fd359d55f80c463beebb8e932f680090711e677f2701f8dcb397a66d00041

                                            SHA512

                                            2905cbdac1aed37248f89a543580c60232ab0b6c21dee1e7b608773e97de8a9beecc6a43452a62788fcbc758e31af8b3c2aff2fbb7e73c1c46a6a93328210498

                                          • C:\Users\Admin\AppData\Local\Temp\Tar3068.tmp

                                            Filesize

                                            181KB

                                            MD5

                                            4ea6026cf93ec6338144661bf1202cd1

                                            SHA1

                                            a1dec9044f750ad887935a01430bf49322fbdcb7

                                            SHA256

                                            8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

                                            SHA512

                                            6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

                                          • C:\Users\Admin\AppData\Local\Temp\ZES4mQr7Bk.bat

                                            Filesize

                                            240B

                                            MD5

                                            480f34995aecd0496e4cdd9442a9b231

                                            SHA1

                                            b8b8348b94975f5a3840a4d40885470b53eb06a4

                                            SHA256

                                            e51d0568d6eda362d1ebd9d5ee95ff920a2d19ec5832bce9a8d17dd2a444d13c

                                            SHA512

                                            8b51a4c1c64ad5b27188e9456367e63399bfa87984260713f8da4c9ff64886eed1d622d1d643fe9ee7bcb08a381f96f03814e53d8e349297f86cbfa199b1a6c5

                                          • C:\Users\Admin\AppData\Local\Temp\oqEnL4f5pl.bat

                                            Filesize

                                            240B

                                            MD5

                                            2a37542f93a722be90cc58b8d0c3e059

                                            SHA1

                                            400c5e7cf7a59f6bac80cebbd6bc289f461e5b94

                                            SHA256

                                            9b2c998db89573cb1ce401db7c0019e476e5c862a92560014b19befd310ef512

                                            SHA512

                                            bef31c128e3af41edc95575a2758d9159329b2b820d07b0c2d97e1183ddd5cbfbd76459b357befaecd40e8dc8e79d53f9bf5d40075a79b41478e6ad8f5b35191

                                          • C:\Users\Admin\AppData\Local\Temp\q3WH03M43W.bat

                                            Filesize

                                            240B

                                            MD5

                                            502dfd9a0f6f13820f8dd0defbb8e94c

                                            SHA1

                                            7d48e83bff91754e7b28477d77bc424e8bf254d8

                                            SHA256

                                            9cbd7488657700488bbf3ba2df340179e4820266187aa1df517ad8c00ad74562

                                            SHA512

                                            f5e6625c2ada4580c2683d99fc53043e0f3e3e032955eccc502c5f1f88ff2d873abf07ed7e7cc5114a1b6abb6012cb70b536459b2ba96276bf32559e52a1d60c

                                          • C:\Users\Admin\AppData\Local\Temp\voEVGuhWUp.bat

                                            Filesize

                                            240B

                                            MD5

                                            728c0eeb5e7738c6318d2646c54ed37c

                                            SHA1

                                            05ec85a848767b57795d69ca99f6e92ba1ee81cd

                                            SHA256

                                            b5c0333cff54c9a97a80e3d0bcb9da2aff4d0988baec9bb7e98ff2589755e1a5

                                            SHA512

                                            fed3a04aa469bdc2c79bb3a8b024cba176453908c7e559f3653bcd3da88f43aeaf26bc3f3c50a040f5ca49d683cff17872ecf3f48028db01d8a4312386348c8d

                                          • C:\Users\Admin\AppData\Local\Temp\xEvQv3iUx6.bat

                                            Filesize

                                            240B

                                            MD5

                                            5bf3a216fa2ec24aaa0182dcc44b15d2

                                            SHA1

                                            a98b3884d1b5d97ac66b6d69c248ce821c8f630f

                                            SHA256

                                            38a5529fc6047d2547723e5329a4cba6753d56fa320e45ad8044e4264eb9eb7d

                                            SHA512

                                            0226758fd1f5ad0311e2fe021d0b1545b4c407a51a8009e0a6830f8b05cc13ca5c4bc406747ed67ce99567644cb271c31ae6714402c124bd968001def0b5feda

                                          • C:\Users\Admin\AppData\Local\Temp\z6HXYUNDfk.bat

                                            Filesize

                                            240B

                                            MD5

                                            7b536950882ea478fd2951b500a865f7

                                            SHA1

                                            9c92b99eb80b98d7047990f2b28708861c4d590c

                                            SHA256

                                            2620f92ee7a880c82154d18680d22773955b243bcdbcd70af4ea644edd5a2cc0

                                            SHA512

                                            b99086dabef65c357cf8ce61ea96b42f619b7d20109a2ec1a58da6ffa31ace9bde75d201b7750a091c898034761c8acc94a5ebc18c6af5637c99af78f3d6864e

                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\05AWEZOB3BT3B2VBAXOV.temp

                                            Filesize

                                            7KB

                                            MD5

                                            e685010ab8bc3e171cab517f565460db

                                            SHA1

                                            96cdada08ed8c4bc2a8e2f558d165e9fd5e86dce

                                            SHA256

                                            762ece42625624308588cf903faa30d9f24aca861c26d878717082073cbfe392

                                            SHA512

                                            bcda7545748548d01c5d9b5af5d865aa94147c0eab29201e0a24bbaa42e4f18556f2c95420ee25e4d7e47506a3be22770a06c35417f8c1bd04abcdfc89f1845e

                                          • C:\providercommon\1zu9dW.bat

                                            Filesize

                                            36B

                                            MD5

                                            6783c3ee07c7d151ceac57f1f9c8bed7

                                            SHA1

                                            17468f98f95bf504cc1f83c49e49a78526b3ea03

                                            SHA256

                                            8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

                                            SHA512

                                            c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

                                          • C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

                                            Filesize

                                            197B

                                            MD5

                                            8088241160261560a02c84025d107592

                                            SHA1

                                            083121f7027557570994c9fc211df61730455bb5

                                            SHA256

                                            2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

                                            SHA512

                                            20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

                                          • \providercommon\DllCommonsvc.exe

                                            Filesize

                                            1.0MB

                                            MD5

                                            bd31e94b4143c4ce49c17d3af46bcad0

                                            SHA1

                                            f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                            SHA256

                                            b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                            SHA512

                                            f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                          • memory/1828-444-0x0000000001030000-0x0000000001140000-memory.dmp

                                            Filesize

                                            1.1MB

                                          • memory/2208-44-0x0000000002340000-0x0000000002348000-memory.dmp

                                            Filesize

                                            32KB

                                          • memory/2208-43-0x000000001B530000-0x000000001B812000-memory.dmp

                                            Filesize

                                            2.9MB

                                          • memory/2320-624-0x00000000003D0000-0x00000000003E2000-memory.dmp

                                            Filesize

                                            72KB

                                          • memory/2320-623-0x0000000001050000-0x0000000001160000-memory.dmp

                                            Filesize

                                            1.1MB

                                          • memory/2500-15-0x0000000000300000-0x000000000030C000-memory.dmp

                                            Filesize

                                            48KB

                                          • memory/2500-17-0x0000000000310000-0x000000000031C000-memory.dmp

                                            Filesize

                                            48KB

                                          • memory/2500-16-0x00000000002E0000-0x00000000002EC000-memory.dmp

                                            Filesize

                                            48KB

                                          • memory/2500-14-0x00000000002D0000-0x00000000002E2000-memory.dmp

                                            Filesize

                                            72KB

                                          • memory/2500-13-0x00000000000F0000-0x0000000000200000-memory.dmp

                                            Filesize

                                            1.1MB

                                          • memory/2720-563-0x0000000000130000-0x0000000000240000-memory.dmp

                                            Filesize

                                            1.1MB

                                          • memory/2928-88-0x00000000001A0000-0x00000000002B0000-memory.dmp

                                            Filesize

                                            1.1MB

                                          • memory/3016-147-0x0000000001390000-0x00000000014A0000-memory.dmp

                                            Filesize

                                            1.1MB

                                          • memory/3016-384-0x0000000000230000-0x0000000000340000-memory.dmp

                                            Filesize

                                            1.1MB