Analysis

  • max time kernel
    146s
  • max time network
    144s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    30/12/2024, 17:29

General

  • Target

    JaffaCakes118_44b76170b873b45f65b0ea1e435ce6f8fa3ba8bcc2a6fbcf76b919f7845014ef.exe

  • Size

    1.3MB

  • MD5

    58b2d1bb18da04e20a7276af992a3be4

  • SHA1

    ad37f07d5ca74e0897ce214be71f69e789003354

  • SHA256

    44b76170b873b45f65b0ea1e435ce6f8fa3ba8bcc2a6fbcf76b919f7845014ef

  • SHA512

    5aeb06a974eb132285b92af0d80c71f36f35c137dd34e55428e0ce95364717bebb2a8a84c6ea8fab593cdd82010a368a00bd8b10b7725c51045c1feed11e1c18

  • SSDEEP

    24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Dcrat family
  • Process spawned unexpected child process 39 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • DCRat payload 9 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 14 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Executes dropped EXE 10 IoCs
  • Loads dropped DLL 2 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 9 IoCs
  • Drops file in Program Files directory 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 39 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Suspicious use of AdjustPrivilegeToken 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_44b76170b873b45f65b0ea1e435ce6f8fa3ba8bcc2a6fbcf76b919f7845014ef.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_44b76170b873b45f65b0ea1e435ce6f8fa3ba8bcc2a6fbcf76b919f7845014ef.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2884
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2684
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\providercommon\1zu9dW.bat" "
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2700
        • C:\providercommon\DllCommonsvc.exe
          "C:\providercommon\DllCommonsvc.exe"
          4⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2852
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2908
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\f6a14ac2-8725-11ef-a9ab-dab21757c799\wininit.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2164
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Portable Devices\dllhost.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1048
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows NT\Accessories\ja-JP\WmiPrvSE.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2044
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\f6a14ac2-8725-11ef-a9ab-dab21757c799\conhost.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1432
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Media Player\ja-JP\cmd.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2356
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\DllCommonsvc.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2396
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Libraries\audiodg.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2112
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\f6a14ac2-8725-11ef-a9ab-dab21757c799\WmiPrvSE.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2392
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Mail\wininit.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1520
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\f6a14ac2-8725-11ef-a9ab-dab21757c799\OSPPSVC.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:872
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\System.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1512
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\OSPPSVC.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1816
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Cookies\csrss.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1776
          • C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\System.exe
            "C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\System.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1044
            • C:\Windows\System32\cmd.exe
              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\fg7ffKrc0I.bat"
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:3016
              • C:\Windows\system32\w32tm.exe
                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                7⤵
                  PID:332
                • C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\System.exe
                  "C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\System.exe"
                  7⤵
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2620
                  • C:\Windows\System32\cmd.exe
                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\7ouYA2TrKB.bat"
                    8⤵
                      PID:2728
                      • C:\Windows\system32\w32tm.exe
                        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                        9⤵
                          PID:2900
                        • C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\System.exe
                          "C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\System.exe"
                          9⤵
                          • Executes dropped EXE
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:828
                          • C:\Windows\System32\cmd.exe
                            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\iqKdioc4MG.bat"
                            10⤵
                              PID:1772
                              • C:\Windows\system32\w32tm.exe
                                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                11⤵
                                  PID:2852
                                • C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\System.exe
                                  "C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\System.exe"
                                  11⤵
                                  • Executes dropped EXE
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:1520
                                  • C:\Windows\System32\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\QqrgVo7Q94.bat"
                                    12⤵
                                      PID:760
                                      • C:\Windows\system32\w32tm.exe
                                        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                        13⤵
                                          PID:1300
                                        • C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\System.exe
                                          "C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\System.exe"
                                          13⤵
                                          • Executes dropped EXE
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:3056
                                          • C:\Windows\System32\cmd.exe
                                            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ezHXLeVHih.bat"
                                            14⤵
                                              PID:1792
                                              • C:\Windows\system32\w32tm.exe
                                                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                15⤵
                                                  PID:2148
                                                • C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\System.exe
                                                  "C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\System.exe"
                                                  15⤵
                                                  • Executes dropped EXE
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:1944
                                                  • C:\Windows\System32\cmd.exe
                                                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\R5wNYqVH5b.bat"
                                                    16⤵
                                                      PID:1032
                                                      • C:\Windows\system32\w32tm.exe
                                                        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                        17⤵
                                                          PID:2240
                                                        • C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\System.exe
                                                          "C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\System.exe"
                                                          17⤵
                                                          • Executes dropped EXE
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:1676
                                                          • C:\Windows\System32\cmd.exe
                                                            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\v65NgynF79.bat"
                                                            18⤵
                                                              PID:692
                                                              • C:\Windows\system32\w32tm.exe
                                                                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                19⤵
                                                                  PID:2388
                                                                • C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\System.exe
                                                                  "C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\System.exe"
                                                                  19⤵
                                                                  • Executes dropped EXE
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  PID:2468
                                                                  • C:\Windows\System32\cmd.exe
                                                                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\00pP7nIBMq.bat"
                                                                    20⤵
                                                                      PID:3052
                                                                      • C:\Windows\system32\w32tm.exe
                                                                        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                        21⤵
                                                                          PID:1624
                                                                        • C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\System.exe
                                                                          "C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\System.exe"
                                                                          21⤵
                                                                          • Executes dropped EXE
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          PID:1820
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 11 /tr "'C:\Recovery\f6a14ac2-8725-11ef-a9ab-dab21757c799\wininit.exe'" /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:768
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Recovery\f6a14ac2-8725-11ef-a9ab-dab21757c799\wininit.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:688
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 9 /tr "'C:\Recovery\f6a14ac2-8725-11ef-a9ab-dab21757c799\wininit.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:580
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Portable Devices\dllhost.exe'" /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:1796
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\dllhost.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:2080
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Portable Devices\dllhost.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:2612
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows NT\Accessories\ja-JP\WmiPrvSE.exe'" /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:568
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\Accessories\ja-JP\WmiPrvSE.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:1112
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows NT\Accessories\ja-JP\WmiPrvSE.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:2532
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 9 /tr "'C:\Recovery\f6a14ac2-8725-11ef-a9ab-dab21757c799\conhost.exe'" /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:2764
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Recovery\f6a14ac2-8725-11ef-a9ab-dab21757c799\conhost.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:3024
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 10 /tr "'C:\Recovery\f6a14ac2-8725-11ef-a9ab-dab21757c799\conhost.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:3000
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Media Player\ja-JP\cmd.exe'" /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:2552
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Program Files\Windows Media Player\ja-JP\cmd.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:2516
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Media Player\ja-JP\cmd.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:1916
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\DllCommonsvc.exe'" /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:2404
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\DllCommonsvc.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:2144
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\DllCommonsvc.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:1428
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 8 /tr "'C:\Users\Public\Libraries\audiodg.exe'" /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:1676
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Users\Public\Libraries\audiodg.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:2484
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 5 /tr "'C:\Users\Public\Libraries\audiodg.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:2488
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 5 /tr "'C:\Recovery\f6a14ac2-8725-11ef-a9ab-dab21757c799\WmiPrvSE.exe'" /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:668
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Recovery\f6a14ac2-8725-11ef-a9ab-dab21757c799\WmiPrvSE.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:2184
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 5 /tr "'C:\Recovery\f6a14ac2-8725-11ef-a9ab-dab21757c799\WmiPrvSE.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:2420
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Mail\wininit.exe'" /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:1944
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\wininit.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:1300
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Mail\wininit.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:2492
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 7 /tr "'C:\Recovery\f6a14ac2-8725-11ef-a9ab-dab21757c799\OSPPSVC.exe'" /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:748
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Recovery\f6a14ac2-8725-11ef-a9ab-dab21757c799\OSPPSVC.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:1504
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 5 /tr "'C:\Recovery\f6a14ac2-8725-11ef-a9ab-dab21757c799\OSPPSVC.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:1128
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\System.exe'" /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:2292
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\System.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:2620
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\System.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:1272
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 5 /tr "'C:\Users\Default\OSPPSVC.exe'" /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:2380
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Users\Default\OSPPSVC.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:1860
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 9 /tr "'C:\Users\Default\OSPPSVC.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:1532
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\Cookies\csrss.exe'" /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:1684
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Admin\Cookies\csrss.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:332
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\Cookies\csrss.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:1624

                                Network

                                      MITRE ATT&CK Enterprise v15

                                      Replay Monitor

                                      Loading Replay Monitor...

                                      Downloads

                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                        Filesize

                                        342B

                                        MD5

                                        b2613e69d782ddd46dfbe29064b12a57

                                        SHA1

                                        bfb2e4d9642252815f93b942a2e81b406ba51c23

                                        SHA256

                                        81f08438215c41f5a2b09da9e475fbb81fc953ce422745380518984cab7b1cc7

                                        SHA512

                                        93c57f5e3c1cd73d2a0924b6e2541b2492a542c6f3ce2102069a0ba49495da1fe468b3df179ffda3fc51ae05df87659a9a521c71b0a9508bfebae257f3448cb3

                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                        Filesize

                                        342B

                                        MD5

                                        01b6960ddf80d59383e736cdfd4fb373

                                        SHA1

                                        aa589ce363c860d58e0020d18d88d1efad1d3d6b

                                        SHA256

                                        67a5795da382769ca9e9d733259d1a228a7bb9ddbce562f3f5e8a53fbced0a60

                                        SHA512

                                        4c3c642ca38076b96bc48cd580aa4654c401e0476c912b8463569ccf2c09b32384793e96afce73d4086292f2445d85a2d314addda3f80723ac1936b20c8eb5c3

                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                        Filesize

                                        342B

                                        MD5

                                        6d0933ea0a71c63e9952fbfed7bd5310

                                        SHA1

                                        2568eac50114741a3a55d3121c2f2c938356eeeb

                                        SHA256

                                        ce1fe9b679e99c821ff4a302d39a734134380d305ae6025c1c511bf16bcccdf3

                                        SHA512

                                        4a161dc5eb5dec72a8060a40166f6c8c3a8deee64a1f0283c72de06cfd71b252057744f90cc3e7fa4f15e134ce9102bd2db341f6d7b9eebcffbc637705eeed41

                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                        Filesize

                                        342B

                                        MD5

                                        1d24aecc4f81fa54e413b99d75756319

                                        SHA1

                                        b70864a2cca33d7d45e02c026ebeb69f8bf9be25

                                        SHA256

                                        4db7d1bb6b120d7d040028712ae6662cd5504c1c22ad15b6f95ba2e87cbe6921

                                        SHA512

                                        c38219d1ef78be21927deaca1a6e96b2043d01bb19bdc06f76cb007adcc7146e1cb63a2d9723bfb6550c7bf8f4c9272bf52a2222a7a075f154fb722f5a17bbc7

                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                        Filesize

                                        342B

                                        MD5

                                        f7b873202ee07de638d874e85de330f4

                                        SHA1

                                        a659b8f57c228ca307b07f55686935a749c2353f

                                        SHA256

                                        70babfa5e9a5186b49738d56bb7ef0c0e6dcbac3cb98a80b5358b03d6e0a7929

                                        SHA512

                                        b9092b5298783b4ac486c4feed7dd23de2b7abf05c8e2e52c3db907bb0f1576db5aa149852af4cd025f0a31484f4873fdbc29457ba8b15dfa18321d2f518b772

                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                        Filesize

                                        342B

                                        MD5

                                        251417e90e5cc9b6d691a607152b974c

                                        SHA1

                                        1a499878c9c3fae0369ce66c7459eee67c8ebd4e

                                        SHA256

                                        4a52466385ff7dc02bb0c8adeb47508251918e78bffaed98fcbf3f386c64b201

                                        SHA512

                                        3db706ae554b551b6aa409b42da6643a4d50c62190ce7c6bc09271320638993ba3cfbaabeb6872e30e307c0d8963da8ef68c09150111310ebb13e382b6a93a20

                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                        Filesize

                                        342B

                                        MD5

                                        b514929dcea8020e4e8a5acc83db88af

                                        SHA1

                                        80851821dd128b24a722de1a739c523be5ff4fc7

                                        SHA256

                                        211e84f70c988e922e863b3d81917bf873c056932cf6177751664635b62d0a24

                                        SHA512

                                        83a8a46a23a0a344deccf002c29158185c8c8e6aacde627f00e8031d2a20485c44c24529d924356a0f70f9c3c17832bacc4f4454de321af50fcfb145cd63dc7d

                                      • C:\Users\Admin\AppData\Local\Temp\00pP7nIBMq.bat

                                        Filesize

                                        238B

                                        MD5

                                        8f262c3afd07b732356a44508cc60ff7

                                        SHA1

                                        7542704dbbaccd3909a3627d9c4b808169b2be55

                                        SHA256

                                        cb37de1ea77e4e2ab1db26021d145df27c8168ecdd5127e3702eaefe2780710f

                                        SHA512

                                        70caf8c64bc9c680731f1c23b900f77e43b98c946dbd8baffd37247a6ade2dccd63c04f717da217c1e5b2a3faab3518571e21e3b3f738a98fe82ec97ee9995bd

                                      • C:\Users\Admin\AppData\Local\Temp\7ouYA2TrKB.bat

                                        Filesize

                                        238B

                                        MD5

                                        2cfda50db47f47a0d2d56809acfa3bf6

                                        SHA1

                                        f2e32f5bc3cd7e9d52a9f737c87236a8a5acec82

                                        SHA256

                                        538ecd667fe16a070936f699c62d4e13d1b379375b946bae7f7bc5e09bb21087

                                        SHA512

                                        4fa18c315c065bad0db10d32ab15258e3cf5d1957067a974fa62a67e7ea36e31e30236706142ac8e66c01b48fe434d14442613bda5930230755440c0d9a5cee1

                                      • C:\Users\Admin\AppData\Local\Temp\Cab9F8C.tmp

                                        Filesize

                                        70KB

                                        MD5

                                        49aebf8cbd62d92ac215b2923fb1b9f5

                                        SHA1

                                        1723be06719828dda65ad804298d0431f6aff976

                                        SHA256

                                        b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

                                        SHA512

                                        bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

                                      • C:\Users\Admin\AppData\Local\Temp\QqrgVo7Q94.bat

                                        Filesize

                                        238B

                                        MD5

                                        d0a78f548cea8818012c58b3ad71bf0d

                                        SHA1

                                        2a5d39c055d58f025f597d9865fb290d2b0a75f5

                                        SHA256

                                        f7a76b1fa16bc2ce8ea49e41c908281c4ed9616811b4772fc272a73b2ddbc605

                                        SHA512

                                        8bad7f5dee398de3df8fc6e4203ca162a6820ee1d90ddafe088f5d64be0e272df410ab136a0a11ba4fcfdb6ef49c620ac0b8df4f31dd3c90292d24799d1500fe

                                      • C:\Users\Admin\AppData\Local\Temp\R5wNYqVH5b.bat

                                        Filesize

                                        238B

                                        MD5

                                        149d885fb8b40642002e0a1a2a9ae978

                                        SHA1

                                        add8edb798cb6b21ade6390f9a117036eb8594ae

                                        SHA256

                                        850f1b0b007a69b4fa94423b619ceef67f14fd8eac0a6dff03e4c4a00a7463a3

                                        SHA512

                                        a2efd72cbb11ca3cd84099244cf0dc9873240b1f8e1aea495e878939047006bb9fffb5a71c7d9c31eb4ea3092d20c2957fc19351acded48ed79632031ffa5448

                                      • C:\Users\Admin\AppData\Local\Temp\Tar9FAE.tmp

                                        Filesize

                                        181KB

                                        MD5

                                        4ea6026cf93ec6338144661bf1202cd1

                                        SHA1

                                        a1dec9044f750ad887935a01430bf49322fbdcb7

                                        SHA256

                                        8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

                                        SHA512

                                        6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

                                      • C:\Users\Admin\AppData\Local\Temp\ezHXLeVHih.bat

                                        Filesize

                                        238B

                                        MD5

                                        91afc21aba9ffe93c4b0bb704a75ddce

                                        SHA1

                                        e58029158b39777d8e2e1d64dbfa414661335629

                                        SHA256

                                        0822b93070ac2603b07d9d113809969b019f3a2b0c53c1eb43df97a87f28b5c8

                                        SHA512

                                        04623831a8fa42a097aac4e74519865053a5a858624089daf0d4b7aacd7b4aa2a6a11e087c11a2d0c8724d95bf2eaa9fc0995c930d6c0a9b45d6f110a06d3cb7

                                      • C:\Users\Admin\AppData\Local\Temp\fg7ffKrc0I.bat

                                        Filesize

                                        238B

                                        MD5

                                        59f29fe13512cf56fe2da1dce7040594

                                        SHA1

                                        07c00e91c17114885e72e25afeb428c277616f30

                                        SHA256

                                        c08f26e65b3d08804029432c84f31c14ffec231bd526eb8a7e258e39c115b723

                                        SHA512

                                        bb34e5fe4643bbbcb28e46a09c25c2b869bc46ac95333d6e91bd18ab1deb1a997ce727740dfef2fe1c1d291b76df2932d411ce2a14e6954864bf662e5a89b0a6

                                      • C:\Users\Admin\AppData\Local\Temp\iqKdioc4MG.bat

                                        Filesize

                                        238B

                                        MD5

                                        e0463372cc1f37e08ac45555288df396

                                        SHA1

                                        e88d0d848bce627a946078ba28a17e5122f58521

                                        SHA256

                                        4eb74ef2fb43bd7ee365aa19623b69d2f83e2a77a397811b2b5a8e21c3260c94

                                        SHA512

                                        bd8d73999037e1af7358171c257a1a87512abb41259380a1b744d3c80a2c8b1f0cb7e43e0fc63e6ad2133c23755fce1bec1d1bd8a90ba7c104ba8b3f7e24f4ae

                                      • C:\Users\Admin\AppData\Local\Temp\v65NgynF79.bat

                                        Filesize

                                        238B

                                        MD5

                                        3453177817f5e48018e8c64235867bbb

                                        SHA1

                                        5b214bf61a0b8f7ffa5677a03b486a5671b60139

                                        SHA256

                                        6c80f65959edbbedb0ab006e09527fc00bc8aa3c4fc6348b8cf1f81ffdc8017d

                                        SHA512

                                        9ee8018b90bf622443ab99d12d61d072265d8fb97951545f9cd6f268610da33e8404fdb72d3b88a054d62b972650b96e50a9f2502cbf717dcdde3eb2018ed9f2

                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

                                        Filesize

                                        7KB

                                        MD5

                                        d9ab908dd0ea8222bf36bda08d38c06a

                                        SHA1

                                        69d54fb59cab5608d4f857d669cc2ddd3266519a

                                        SHA256

                                        9b79c6fe1f916342576574f417eec73f33888ff5db163a27ea09a069ccae4e53

                                        SHA512

                                        1392367321698029833256b214441aaa55b8a57b96d2bff541402f0d9a6bb25c4482897560989e6d0c494849ea4612523c069db3796d58d2992082d556a89e69

                                      • C:\providercommon\1zu9dW.bat

                                        Filesize

                                        36B

                                        MD5

                                        6783c3ee07c7d151ceac57f1f9c8bed7

                                        SHA1

                                        17468f98f95bf504cc1f83c49e49a78526b3ea03

                                        SHA256

                                        8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

                                        SHA512

                                        c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

                                      • C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

                                        Filesize

                                        197B

                                        MD5

                                        8088241160261560a02c84025d107592

                                        SHA1

                                        083121f7027557570994c9fc211df61730455bb5

                                        SHA256

                                        2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

                                        SHA512

                                        20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

                                      • \providercommon\DllCommonsvc.exe

                                        Filesize

                                        1.0MB

                                        MD5

                                        bd31e94b4143c4ce49c17d3af46bcad0

                                        SHA1

                                        f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                        SHA256

                                        b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                        SHA512

                                        f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                      • memory/828-243-0x0000000000340000-0x0000000000352000-memory.dmp

                                        Filesize

                                        72KB

                                      • memory/1044-97-0x00000000002C0000-0x00000000002D2000-memory.dmp

                                        Filesize

                                        72KB

                                      • memory/1044-87-0x0000000000AC0000-0x0000000000BD0000-memory.dmp

                                        Filesize

                                        1.1MB

                                      • memory/1520-303-0x0000000000B90000-0x0000000000CA0000-memory.dmp

                                        Filesize

                                        1.1MB

                                      • memory/1676-484-0x0000000000870000-0x0000000000980000-memory.dmp

                                        Filesize

                                        1.1MB

                                      • memory/1820-604-0x0000000000060000-0x0000000000170000-memory.dmp

                                        Filesize

                                        1.1MB

                                      • memory/1944-424-0x00000000004D0000-0x00000000004E2000-memory.dmp

                                        Filesize

                                        72KB

                                      • memory/1944-423-0x0000000000110000-0x0000000000220000-memory.dmp

                                        Filesize

                                        1.1MB

                                      • memory/2396-70-0x000000001B6F0000-0x000000001B9D2000-memory.dmp

                                        Filesize

                                        2.9MB

                                      • memory/2396-71-0x00000000020F0000-0x00000000020F8000-memory.dmp

                                        Filesize

                                        32KB

                                      • memory/2468-544-0x0000000000980000-0x0000000000A90000-memory.dmp

                                        Filesize

                                        1.1MB

                                      • memory/2620-183-0x0000000000340000-0x0000000000352000-memory.dmp

                                        Filesize

                                        72KB

                                      • memory/2852-17-0x000000001A700000-0x000000001A70C000-memory.dmp

                                        Filesize

                                        48KB

                                      • memory/2852-16-0x000000001A5F0000-0x000000001A5FC000-memory.dmp

                                        Filesize

                                        48KB

                                      • memory/2852-15-0x0000000000C50000-0x0000000000C5C000-memory.dmp

                                        Filesize

                                        48KB

                                      • memory/2852-14-0x0000000000BC0000-0x0000000000BD2000-memory.dmp

                                        Filesize

                                        72KB

                                      • memory/2852-13-0x0000000000C60000-0x0000000000D70000-memory.dmp

                                        Filesize

                                        1.1MB

                                      • memory/3056-363-0x0000000000DF0000-0x0000000000F00000-memory.dmp

                                        Filesize

                                        1.1MB