Malware Analysis Report

2025-08-05 09:04

Sample ID 241230-v2pjhatlgw
Target JaffaCakes118_c507802eede7343e1b5f44f4a3e52b479f454b621b0803cf953aae1d972ebccb
SHA256 c507802eede7343e1b5f44f4a3e52b479f454b621b0803cf953aae1d972ebccb
Tags
rat dcrat discovery execution infostealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

c507802eede7343e1b5f44f4a3e52b479f454b621b0803cf953aae1d972ebccb

Threat Level: Known bad

The file JaffaCakes118_c507802eede7343e1b5f44f4a3e52b479f454b621b0803cf953aae1d972ebccb was found to be: Known bad.

Malicious Activity Summary

rat dcrat discovery execution infostealer

Process spawned unexpected child process

DCRat payload

Dcrat family

DcRat

DCRat payload

Command and Scripting Interpreter: PowerShell

Loads dropped DLL

Executes dropped EXE

Checks computer location settings

Legitimate hosting services abused for malware hosting/C2

Drops file in Windows directory

Drops file in Program Files directory

System Location Discovery: System Language Discovery

Unsigned PE

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Modifies registry class

Uses Task Scheduler COM API

Suspicious use of WriteProcessMemory

Scheduled Task/Job: Scheduled Task

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-12-30 17:29

Signatures

DCRat payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

Dcrat family

dcrat

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-12-30 17:29

Reported

2024-12-30 17:31

Platform

win7-20240903-en

Max time kernel

149s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c507802eede7343e1b5f44f4a3e52b479f454b621b0803cf953aae1d972ebccb.exe"

Signatures

DcRat

rat infostealer dcrat

Dcrat family

dcrat

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe

DCRat payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Panther\UnattendGC\winlogon.exe C:\providercommon\DllCommonsvc.exe N/A
File created C:\Windows\Panther\UnattendGC\cc11b995f2a76d C:\providercommon\DllCommonsvc.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c507802eede7343e1b5f44f4a3e52b479f454b621b0803cf953aae1d972ebccb.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WScript.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\providercommon\DllCommonsvc.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Panther\UnattendGC\winlogon.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Panther\UnattendGC\winlogon.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Panther\UnattendGC\winlogon.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Panther\UnattendGC\winlogon.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Panther\UnattendGC\winlogon.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Panther\UnattendGC\winlogon.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Panther\UnattendGC\winlogon.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Panther\UnattendGC\winlogon.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Panther\UnattendGC\winlogon.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2080 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c507802eede7343e1b5f44f4a3e52b479f454b621b0803cf953aae1d972ebccb.exe C:\Windows\SysWOW64\WScript.exe
PID 2080 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c507802eede7343e1b5f44f4a3e52b479f454b621b0803cf953aae1d972ebccb.exe C:\Windows\SysWOW64\WScript.exe
PID 2080 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c507802eede7343e1b5f44f4a3e52b479f454b621b0803cf953aae1d972ebccb.exe C:\Windows\SysWOW64\WScript.exe
PID 2080 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c507802eede7343e1b5f44f4a3e52b479f454b621b0803cf953aae1d972ebccb.exe C:\Windows\SysWOW64\WScript.exe
PID 2536 wrote to memory of 2668 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2536 wrote to memory of 2668 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2536 wrote to memory of 2668 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2536 wrote to memory of 2668 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2668 wrote to memory of 2956 N/A C:\Windows\SysWOW64\cmd.exe C:\providercommon\DllCommonsvc.exe
PID 2668 wrote to memory of 2956 N/A C:\Windows\SysWOW64\cmd.exe C:\providercommon\DllCommonsvc.exe
PID 2668 wrote to memory of 2956 N/A C:\Windows\SysWOW64\cmd.exe C:\providercommon\DllCommonsvc.exe
PID 2668 wrote to memory of 2956 N/A C:\Windows\SysWOW64\cmd.exe C:\providercommon\DllCommonsvc.exe
PID 2956 wrote to memory of 2908 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2956 wrote to memory of 2908 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2956 wrote to memory of 2908 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2956 wrote to memory of 2888 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2956 wrote to memory of 2888 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2956 wrote to memory of 2888 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2956 wrote to memory of 2932 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2956 wrote to memory of 2932 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2956 wrote to memory of 2932 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2956 wrote to memory of 1672 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2956 wrote to memory of 1672 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2956 wrote to memory of 1672 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2956 wrote to memory of 2912 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\cmd.exe
PID 2956 wrote to memory of 2912 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\cmd.exe
PID 2956 wrote to memory of 2912 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\cmd.exe
PID 2912 wrote to memory of 1948 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 2912 wrote to memory of 1948 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 2912 wrote to memory of 1948 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 2912 wrote to memory of 1564 N/A C:\Windows\System32\cmd.exe C:\Windows\Panther\UnattendGC\winlogon.exe
PID 2912 wrote to memory of 1564 N/A C:\Windows\System32\cmd.exe C:\Windows\Panther\UnattendGC\winlogon.exe
PID 2912 wrote to memory of 1564 N/A C:\Windows\System32\cmd.exe C:\Windows\Panther\UnattendGC\winlogon.exe
PID 1564 wrote to memory of 604 N/A C:\Windows\Panther\UnattendGC\winlogon.exe C:\Windows\System32\cmd.exe
PID 1564 wrote to memory of 604 N/A C:\Windows\Panther\UnattendGC\winlogon.exe C:\Windows\System32\cmd.exe
PID 1564 wrote to memory of 604 N/A C:\Windows\Panther\UnattendGC\winlogon.exe C:\Windows\System32\cmd.exe
PID 604 wrote to memory of 3016 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 604 wrote to memory of 3016 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 604 wrote to memory of 3016 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 604 wrote to memory of 1472 N/A C:\Windows\System32\cmd.exe C:\Windows\Panther\UnattendGC\winlogon.exe
PID 604 wrote to memory of 1472 N/A C:\Windows\System32\cmd.exe C:\Windows\Panther\UnattendGC\winlogon.exe
PID 604 wrote to memory of 1472 N/A C:\Windows\System32\cmd.exe C:\Windows\Panther\UnattendGC\winlogon.exe
PID 1472 wrote to memory of 1716 N/A C:\Windows\Panther\UnattendGC\winlogon.exe C:\Windows\System32\cmd.exe
PID 1472 wrote to memory of 1716 N/A C:\Windows\Panther\UnattendGC\winlogon.exe C:\Windows\System32\cmd.exe
PID 1472 wrote to memory of 1716 N/A C:\Windows\Panther\UnattendGC\winlogon.exe C:\Windows\System32\cmd.exe
PID 1716 wrote to memory of 3036 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 1716 wrote to memory of 3036 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 1716 wrote to memory of 3036 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 1716 wrote to memory of 2628 N/A C:\Windows\System32\cmd.exe C:\Windows\Panther\UnattendGC\winlogon.exe
PID 1716 wrote to memory of 2628 N/A C:\Windows\System32\cmd.exe C:\Windows\Panther\UnattendGC\winlogon.exe
PID 1716 wrote to memory of 2628 N/A C:\Windows\System32\cmd.exe C:\Windows\Panther\UnattendGC\winlogon.exe
PID 2628 wrote to memory of 1984 N/A C:\Windows\Panther\UnattendGC\winlogon.exe C:\Windows\System32\cmd.exe
PID 2628 wrote to memory of 1984 N/A C:\Windows\Panther\UnattendGC\winlogon.exe C:\Windows\System32\cmd.exe
PID 2628 wrote to memory of 1984 N/A C:\Windows\Panther\UnattendGC\winlogon.exe C:\Windows\System32\cmd.exe
PID 1984 wrote to memory of 2384 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 1984 wrote to memory of 2384 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 1984 wrote to memory of 2384 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 1984 wrote to memory of 2804 N/A C:\Windows\System32\cmd.exe C:\Windows\Panther\UnattendGC\winlogon.exe
PID 1984 wrote to memory of 2804 N/A C:\Windows\System32\cmd.exe C:\Windows\Panther\UnattendGC\winlogon.exe
PID 1984 wrote to memory of 2804 N/A C:\Windows\System32\cmd.exe C:\Windows\Panther\UnattendGC\winlogon.exe
PID 2804 wrote to memory of 1544 N/A C:\Windows\Panther\UnattendGC\winlogon.exe C:\Windows\System32\cmd.exe
PID 2804 wrote to memory of 1544 N/A C:\Windows\Panther\UnattendGC\winlogon.exe C:\Windows\System32\cmd.exe
PID 2804 wrote to memory of 1544 N/A C:\Windows\Panther\UnattendGC\winlogon.exe C:\Windows\System32\cmd.exe
PID 1544 wrote to memory of 1444 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c507802eede7343e1b5f44f4a3e52b479f454b621b0803cf953aae1d972ebccb.exe

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c507802eede7343e1b5f44f4a3e52b479f454b621b0803cf953aae1d972ebccb.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\providercommon\1zu9dW.bat" "

C:\providercommon\DllCommonsvc.exe

"C:\providercommon\DllCommonsvc.exe"

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 10 /tr "'C:\Users\Public\Documents\My Videos\sppsvc.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Users\Public\Documents\My Videos\sppsvc.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 11 /tr "'C:\Users\Public\Documents\My Videos\sppsvc.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 8 /tr "'C:\Windows\Panther\UnattendGC\winlogon.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\Panther\UnattendGC\winlogon.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 6 /tr "'C:\Windows\Panther\UnattendGC\winlogon.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 9 /tr "'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\winlogon.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\winlogon.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\winlogon.exe'" /rl HIGHEST /f

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Documents\My Videos\sppsvc.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Panther\UnattendGC\winlogon.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\winlogon.exe'

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\MAmhIIylHr.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Windows\Panther\UnattendGC\winlogon.exe

"C:\Windows\Panther\UnattendGC\winlogon.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\5cWoBfSAzl.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Windows\Panther\UnattendGC\winlogon.exe

"C:\Windows\Panther\UnattendGC\winlogon.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\wNwF62sylT.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Windows\Panther\UnattendGC\winlogon.exe

"C:\Windows\Panther\UnattendGC\winlogon.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\lE88gYdR15.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Windows\Panther\UnattendGC\winlogon.exe

"C:\Windows\Panther\UnattendGC\winlogon.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\o09MCfWrWU.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Windows\Panther\UnattendGC\winlogon.exe

"C:\Windows\Panther\UnattendGC\winlogon.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\b7oBPqXqtO.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Windows\Panther\UnattendGC\winlogon.exe

"C:\Windows\Panther\UnattendGC\winlogon.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\2mwtwHUJyt.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Windows\Panther\UnattendGC\winlogon.exe

"C:\Windows\Panther\UnattendGC\winlogon.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\JhFjyqSsxH.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Windows\Panther\UnattendGC\winlogon.exe

"C:\Windows\Panther\UnattendGC\winlogon.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\2mwtwHUJyt.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Windows\Panther\UnattendGC\winlogon.exe

"C:\Windows\Panther\UnattendGC\winlogon.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\RaUzDWAd8R.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 raw.githubusercontent.com udp
US 185.199.111.133:443 raw.githubusercontent.com tcp
US 185.199.111.133:443 raw.githubusercontent.com tcp
US 185.199.111.133:443 raw.githubusercontent.com tcp
US 185.199.111.133:443 raw.githubusercontent.com tcp
US 185.199.111.133:443 raw.githubusercontent.com tcp
US 185.199.111.133:443 raw.githubusercontent.com tcp
US 185.199.111.133:443 raw.githubusercontent.com tcp
US 185.199.111.133:443 raw.githubusercontent.com tcp
US 185.199.111.133:443 raw.githubusercontent.com tcp

Files

C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

MD5 8088241160261560a02c84025d107592
SHA1 083121f7027557570994c9fc211df61730455bb5
SHA256 2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1
SHA512 20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

C:\providercommon\1zu9dW.bat

MD5 6783c3ee07c7d151ceac57f1f9c8bed7
SHA1 17468f98f95bf504cc1f83c49e49a78526b3ea03
SHA256 8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322
SHA512 c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

\providercommon\DllCommonsvc.exe

MD5 bd31e94b4143c4ce49c17d3af46bcad0
SHA1 f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256 b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512 f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

memory/2956-13-0x0000000000190000-0x00000000002A0000-memory.dmp

memory/2956-14-0x0000000000140000-0x0000000000152000-memory.dmp

memory/2956-15-0x0000000000150000-0x000000000015C000-memory.dmp

memory/2956-16-0x0000000000160000-0x000000000016C000-memory.dmp

memory/2956-17-0x0000000000170000-0x000000000017C000-memory.dmp

memory/2888-47-0x000000001B790000-0x000000001BA72000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

MD5 54b5e4b9b8d1c548ebccb21fba1cbe29
SHA1 8f4ce9d2063c3f9b78bc96d87f7e95377e275d94
SHA256 5b0c050cd76d3e4acadad81832dfac11088aeda80b412e8717aa0276352514b7
SHA512 fc4a2fce81e92a088dbc864b3e9dc32f794482a18b3970cb254a3b081d3ae6e66b4c49f204dc55eff4a595f858e897f9cc164ec69425b13107af37d41f040873

memory/2888-48-0x0000000000670000-0x0000000000678000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\MAmhIIylHr.bat

MD5 24c974ec785ffac29c65712a95171054
SHA1 4fd858229ce058c4d4eb0393ed3c007b1ff1b63a
SHA256 15c7ab5eafc268a664889fc698f14a5ae2c74d1f5f0c356b90d56627b0e22be8
SHA512 6edd6e316fda4b2230b44be67c7b76b78418468cd82b690c07a7fe238a4128ddf4e1a54c25dea12f15d304dab64f1e1cfd87298ad22bf392a058837143241630

memory/1564-52-0x00000000000D0000-0x00000000001E0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Cab7F11.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\Tar7F24.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\Local\Temp\5cWoBfSAzl.bat

MD5 bbfaac79f714c1e88f42fc386d7cdde0
SHA1 d5df596719d5e19b578cc10f8b0c15f78ab50b16
SHA256 8033574e6f67910db0df7fbae177142dc658ce0e578f8a490e0fb8230a98ef27
SHA512 13af8cd775af7013c1f7618d203dabe51f0b8cf64d050d18995e59c3b14c3bfacaa85d1792b7d766e0b5673280518b2c718c6bbbf2b861ef9699b1dd2cd0f36e

memory/1472-80-0x0000000000A60000-0x0000000000B70000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\wNwF62sylT.bat

MD5 5b1bd8490df80f438b4a973e15db2dcb
SHA1 02220d10b24d9288c2241f7baf5e05264106f129
SHA256 42e40144f61c3baf133cfb30e5c56ed0850d005776df01b429db8f126a4c79f8
SHA512 ea5d0085918d19a06aae13fbafa3edca5b8ea0dd703eea18c54116270b2c48d65b2dca2d7bcb066c13b9c44586ff8edbfb1239875b086eb94e528c75a668bda2

memory/2628-139-0x0000000000F70000-0x0000000001080000-memory.dmp

memory/2628-140-0x0000000000140000-0x0000000000152000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 29d39ce3d85b450c16d13caf74ad139e
SHA1 01d076e6cd993d531709585a932ddac9e37d6206
SHA256 30119d47fab01e73a3f048dd445018a4d7ae3068e8f2e5ee7967d070bd246173
SHA512 3a2f05108b4a35946fd48849d31c102b26869091a75e4d18765e37d1ff8efe10b7095730d27d68f3f7b7ab6ee4ecc358f236bc460db7cf7095b1de9448a2f107

C:\Users\Admin\AppData\Local\Temp\lE88gYdR15.bat

MD5 68b3043db1e268ee4859c1d29fb94f3a
SHA1 2b95569e5f7a1a049536747785f6ace64786b8e8
SHA256 272a1585091c9852e7858516af415e1ecbc985c603b3d9e38187a5d4c3ebc53d
SHA512 161c97a1cc39f79386f546bfa48a04cf3804d27af866dc553541989c1cc93fe1d192bb652e98d312b9db56680cfdb40957902b3a70f33400ccfe1e58083de1ec

memory/2804-200-0x00000000002D0000-0x00000000002E2000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ec823c47fe39d7a8c4be244fb42af8e9
SHA1 40275602659b05a234009f0e8dbfdf915993a8e5
SHA256 1c9a3bd3fa6434e088024f31af95183e1ad67f2cbd57447764f3c1dd7019ac77
SHA512 8d907f53c142ec3530c58a2faf6debd531395a8d8a7159bdd5b79c008fb1121f6c75a3e8916531a93a7662ba5c0df1b0aca944c940638f62e0bc9d857fbacf53

C:\Users\Admin\AppData\Local\Temp\o09MCfWrWU.bat

MD5 878582fd4cbd1f9d5a90a0f7a1d01a07
SHA1 aef41ffbd4433fef7b97fb4ba3442427e6c7901e
SHA256 34f75b071e9af8eb9e865352fe5ec8a60b3a6dc7ed3c1dc7a5d4b04652312034
SHA512 662bb4398e4c91b1c5044a0413b13f685107266d703fedd058d623fc8372217d00bf545dd8234e0291bb3f70370703e92a38b4bd7116df29c78f043c50b3049f

memory/1680-260-0x0000000001380000-0x0000000001490000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0390fbd5f247edc965b99d043ea69218
SHA1 1d910f8635cf80ec19198f53b4484c0b67114b69
SHA256 6ebcd4220fce552627a8464857f19d8ff128b12997b0a0209e120e95b777004a
SHA512 46d20fba54197eb078aad000891699fecf6ca377c512b6c937c08e82842da514e355e953eef501358f9a55bc0259777f57d69895d7f3078a67c5c82eb491a31b

C:\Users\Admin\AppData\Local\Temp\b7oBPqXqtO.bat

MD5 b12cdbddcffef334a20f9efd3a6538db
SHA1 f20240d9f618697150e54eef991475dde554b35b
SHA256 980652b6eb52d36024bf4a262053641e8cff8a00110267765842fb5d2febca73
SHA512 69df1ec0c8dcc19b34a35500137647c75b0148249dd93213a094f4c0903fc3fa84792e29e10385fb5ddbdbd7dff20d4eb0dfd33355d14dec280a4f885f6a1be9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 34c74f80af17c3cb2809d818e051e6ac
SHA1 da7c36e555c0349671519d1e39d0f4e0567659bd
SHA256 18137fb3d4579b5f2bec606ceead8dcdf9d3f4e5f1b91ede164fd3f040d24d20
SHA512 13ac991e3c52b39be522583f1800ea7785795cc059ca400fe4294c8638c8d10512cf4f45e6f51e45280521c7d3e0e1ecb5a244790909e6c808a3406687858f51

C:\Users\Admin\AppData\Local\Temp\2mwtwHUJyt.bat

MD5 20de5ec2386f15f50ddd5ac764948e2c
SHA1 8bf350f4af5780d1cc7bb259e861d58e19582770
SHA256 cb67354fdcb3a2fcf4b78a916fb088510e4966247d2a21de8d2802301fcace98
SHA512 f5aa6e2ef871463dc606023de38fdea8677900b2687fa0b00d701dc872bf7126447c4d3d0bacfa8906da5049e1b063b81b6f4b75508613dd898a733398bb38bb

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 70bcae008d8a5294e747eb087d327eaf
SHA1 9d784aeca7ae8d75c5f19e9e0ecb26cb6adb6fd5
SHA256 58dcabf1306f9263b787870449bf0729c1956b36b0878fe6ccdc63b379fc4917
SHA512 548483956297930162d58e4b589c1e9a28a23b6a209691ddb60aa8b7af44f6153b5694efc9fe1f4555a77d263d5a2356944c75f89830d842a4ffda630acd1f62

C:\Users\Admin\AppData\Local\Temp\JhFjyqSsxH.bat

MD5 9ad26b56e0d5f0b9d1e59fdfe6fcc1f3
SHA1 1d6ca0ab410d20dc65384feec62480abbbbdec46
SHA256 1a01a2437ce661956783ca4679495cd0a2ac621db4e63df2b33c8b4cf5fbbb51
SHA512 6d6edcbbb24a3cde09ce10845626997ef009a85ea74a8f56fa0c2a0fe10a5607a4e7bab9a8b1c2566c5e52f862887b9c560c76eab64d1c5cef0e465d61a1904a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 50db1bc2826740ba33e61de880f73fcf
SHA1 1e1642eff10bbf52321290b5539755808ec58379
SHA256 c131b6472d9b7cdce9da9e06643fc0a32e8dbf18fde31bfd0db0b713082936ce
SHA512 c7e05d492d216ea790a7d6e2c85a263552bd43b8c98dad1035a51fee2121750429ba64aeea5153c01e90479321453eacbe4be6f51d6f4412860910956478efc9

memory/2900-497-0x0000000000240000-0x0000000000252000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e47d5fb8f07c0a57dbe888f76bc49e21
SHA1 800c332477f05c1d26ebba6d00f2552d121d3791
SHA256 dbbf8a10c87affb771a2603c46a285e02ff04268f288fe6be0438433b83d497e
SHA512 0f9a29599d12318702e7d10622f392a8825dcbb31c237abf286cd9038903d6f894cc0ac1a09c4753127c5b7b2a2540a3f2c790024cb0fbcccdbcaa439c726887

C:\Users\Admin\AppData\Local\Temp\RaUzDWAd8R.bat

MD5 50bfab2cc05de4ac92fe30e42c581352
SHA1 0aa88263c565c3eb3a8646a2bd15336b9d579306
SHA256 d7d0800223a9d3fe66586f47f4793f5c1616523d7e6bb65286fde9eca0c51014
SHA512 d21907cf891183ec16e41cf0626dfeed19f2fe96b261fec99ceb3a1754b38d515c3ac4ee771ec3a69b1bc5e1848093b8b52bcd7ffbe601410da49ee434dcb2df

Analysis: behavioral2

Detonation Overview

Submitted

2024-12-30 17:29

Reported

2024-12-30 17:31

Platform

win10v2004-20241007-en

Max time kernel

149s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c507802eede7343e1b5f44f4a3e52b479f454b621b0803cf953aae1d972ebccb.exe"

Signatures

DcRat

rat infostealer dcrat

Dcrat family

dcrat

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe

DCRat payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c507802eede7343e1b5f44f4a3e52b479f454b621b0803cf953aae1d972ebccb.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation C:\providercommon\wininit.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation C:\providercommon\wininit.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation C:\providercommon\wininit.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation C:\providercommon\wininit.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation C:\providercommon\wininit.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation C:\providercommon\wininit.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation C:\providercommon\DllCommonsvc.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation C:\providercommon\wininit.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation C:\providercommon\wininit.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation C:\providercommon\wininit.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\WScript.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation C:\providercommon\wininit.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation C:\providercommon\wininit.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation C:\providercommon\wininit.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation C:\providercommon\wininit.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\886983d96e3d3e C:\providercommon\DllCommonsvc.exe N/A
File created C:\Program Files\Microsoft Office\Office16\0a1fd5f707cd16 C:\providercommon\DllCommonsvc.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\unsecapp.exe C:\providercommon\DllCommonsvc.exe N/A
File created C:\Program Files (x86)\Windows Media Player\en-US\RuntimeBroker.exe C:\providercommon\DllCommonsvc.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\csrss.exe C:\providercommon\DllCommonsvc.exe N/A
File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\sysmon.exe C:\providercommon\DllCommonsvc.exe N/A
File created C:\Program Files\MSBuild\ebf1f9fa8afd6d C:\providercommon\DllCommonsvc.exe N/A
File created C:\Program Files (x86)\Internet Explorer\it-IT\upfc.exe C:\providercommon\DllCommonsvc.exe N/A
File created C:\Program Files (x86)\Internet Explorer\it-IT\ea1d8f6d871115 C:\providercommon\DllCommonsvc.exe N/A
File created C:\Program Files (x86)\Windows Media Player\en-US\9e8d7a4ca61bd9 C:\providercommon\DllCommonsvc.exe N/A
File created C:\Program Files (x86)\Windows NT\Accessories\en-US\886983d96e3d3e C:\providercommon\DllCommonsvc.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\unsecapp.exe C:\providercommon\DllCommonsvc.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\29c1c3cc0f7685 C:\providercommon\DllCommonsvc.exe N/A
File created C:\Program Files\MSBuild\cmd.exe C:\providercommon\DllCommonsvc.exe N/A
File created C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe C:\providercommon\DllCommonsvc.exe N/A
File created C:\Program Files\Microsoft Office\Office16\sppsvc.exe C:\providercommon\DllCommonsvc.exe N/A
File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\121e5b5079f7c0 C:\providercommon\DllCommonsvc.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\fr-FR\fontdrvhost.exe C:\providercommon\DllCommonsvc.exe N/A
File created C:\Windows\fr-FR\5b884080fd4f94 C:\providercommon\DllCommonsvc.exe N/A
File created C:\Windows\LiveKernelReports\spoolsv.exe C:\providercommon\DllCommonsvc.exe N/A
File created C:\Windows\LiveKernelReports\f3b6ecef712a24 C:\providercommon\DllCommonsvc.exe N/A
File created C:\Windows\Microsoft.NET\Registry.exe C:\providercommon\DllCommonsvc.exe N/A
File created C:\Windows\Microsoft.NET\ee2ad38f3d4382 C:\providercommon\DllCommonsvc.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c507802eede7343e1b5f44f4a3e52b479f454b621b0803cf953aae1d972ebccb.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WScript.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c507802eede7343e1b5f44f4a3e52b479f454b621b0803cf953aae1d972ebccb.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings C:\providercommon\wininit.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings C:\providercommon\wininit.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings C:\providercommon\wininit.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings C:\providercommon\wininit.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings C:\providercommon\wininit.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings C:\providercommon\wininit.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings C:\providercommon\wininit.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings C:\providercommon\wininit.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings C:\providercommon\wininit.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings C:\providercommon\wininit.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings C:\providercommon\wininit.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings C:\providercommon\wininit.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings C:\providercommon\wininit.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\providercommon\DllCommonsvc.exe N/A
N/A N/A C:\providercommon\DllCommonsvc.exe N/A
N/A N/A C:\providercommon\DllCommonsvc.exe N/A
N/A N/A C:\providercommon\DllCommonsvc.exe N/A
N/A N/A C:\providercommon\DllCommonsvc.exe N/A
N/A N/A C:\providercommon\DllCommonsvc.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\providercommon\wininit.exe N/A
N/A N/A C:\providercommon\wininit.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\providercommon\wininit.exe N/A
N/A N/A C:\providercommon\wininit.exe N/A
N/A N/A C:\providercommon\wininit.exe N/A
N/A N/A C:\providercommon\wininit.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\providercommon\DllCommonsvc.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\providercommon\wininit.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\providercommon\wininit.exe N/A
Token: SeDebugPrivilege N/A C:\providercommon\wininit.exe N/A
Token: SeDebugPrivilege N/A C:\providercommon\wininit.exe N/A
Token: SeDebugPrivilege N/A C:\providercommon\wininit.exe N/A
Token: SeDebugPrivilege N/A C:\providercommon\wininit.exe N/A
Token: SeDebugPrivilege N/A C:\providercommon\wininit.exe N/A
Token: SeDebugPrivilege N/A C:\providercommon\wininit.exe N/A
Token: SeDebugPrivilege N/A C:\providercommon\wininit.exe N/A
Token: SeDebugPrivilege N/A C:\providercommon\wininit.exe N/A
Token: SeDebugPrivilege N/A C:\providercommon\wininit.exe N/A
Token: SeDebugPrivilege N/A C:\providercommon\wininit.exe N/A
Token: SeDebugPrivilege N/A C:\providercommon\wininit.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4732 wrote to memory of 2396 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c507802eede7343e1b5f44f4a3e52b479f454b621b0803cf953aae1d972ebccb.exe C:\Windows\SysWOW64\WScript.exe
PID 4732 wrote to memory of 2396 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c507802eede7343e1b5f44f4a3e52b479f454b621b0803cf953aae1d972ebccb.exe C:\Windows\SysWOW64\WScript.exe
PID 4732 wrote to memory of 2396 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c507802eede7343e1b5f44f4a3e52b479f454b621b0803cf953aae1d972ebccb.exe C:\Windows\SysWOW64\WScript.exe
PID 2396 wrote to memory of 4428 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2396 wrote to memory of 4428 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2396 wrote to memory of 4428 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 4428 wrote to memory of 4812 N/A C:\Windows\SysWOW64\cmd.exe C:\providercommon\DllCommonsvc.exe
PID 4428 wrote to memory of 4812 N/A C:\Windows\SysWOW64\cmd.exe C:\providercommon\DllCommonsvc.exe
PID 4812 wrote to memory of 3612 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4812 wrote to memory of 3612 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4812 wrote to memory of 1496 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4812 wrote to memory of 1496 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4812 wrote to memory of 4800 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4812 wrote to memory of 4800 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4812 wrote to memory of 2124 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4812 wrote to memory of 2124 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4812 wrote to memory of 4224 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4812 wrote to memory of 4224 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4812 wrote to memory of 1544 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4812 wrote to memory of 1544 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4812 wrote to memory of 1960 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4812 wrote to memory of 1960 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4812 wrote to memory of 3928 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4812 wrote to memory of 3928 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4812 wrote to memory of 3524 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4812 wrote to memory of 3524 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4812 wrote to memory of 1504 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4812 wrote to memory of 1504 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4812 wrote to memory of 1192 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4812 wrote to memory of 1192 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4812 wrote to memory of 1772 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4812 wrote to memory of 1772 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4812 wrote to memory of 1344 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4812 wrote to memory of 1344 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4812 wrote to memory of 1124 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4812 wrote to memory of 1124 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4812 wrote to memory of 1440 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4812 wrote to memory of 1440 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4812 wrote to memory of 1072 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4812 wrote to memory of 1072 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4812 wrote to memory of 4460 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4812 wrote to memory of 4460 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4812 wrote to memory of 4228 N/A C:\providercommon\DllCommonsvc.exe C:\providercommon\wininit.exe
PID 4812 wrote to memory of 4228 N/A C:\providercommon\DllCommonsvc.exe C:\providercommon\wininit.exe
PID 4228 wrote to memory of 3980 N/A C:\providercommon\wininit.exe C:\Windows\System32\cmd.exe
PID 4228 wrote to memory of 3980 N/A C:\providercommon\wininit.exe C:\Windows\System32\cmd.exe
PID 3980 wrote to memory of 2272 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 3980 wrote to memory of 2272 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 3980 wrote to memory of 3616 N/A C:\Windows\System32\cmd.exe C:\providercommon\wininit.exe
PID 3980 wrote to memory of 3616 N/A C:\Windows\System32\cmd.exe C:\providercommon\wininit.exe
PID 3616 wrote to memory of 3268 N/A C:\providercommon\wininit.exe C:\Windows\System32\cmd.exe
PID 3616 wrote to memory of 3268 N/A C:\providercommon\wininit.exe C:\Windows\System32\cmd.exe
PID 3268 wrote to memory of 4276 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 3268 wrote to memory of 4276 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 3268 wrote to memory of 4056 N/A C:\Windows\System32\cmd.exe C:\providercommon\wininit.exe
PID 3268 wrote to memory of 4056 N/A C:\Windows\System32\cmd.exe C:\providercommon\wininit.exe
PID 4056 wrote to memory of 2016 N/A C:\providercommon\wininit.exe C:\Windows\System32\cmd.exe
PID 4056 wrote to memory of 2016 N/A C:\providercommon\wininit.exe C:\Windows\System32\cmd.exe
PID 2016 wrote to memory of 2148 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 2016 wrote to memory of 2148 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 2016 wrote to memory of 2028 N/A C:\Windows\System32\cmd.exe C:\providercommon\wininit.exe
PID 2016 wrote to memory of 2028 N/A C:\Windows\System32\cmd.exe C:\providercommon\wininit.exe
PID 2028 wrote to memory of 4424 N/A C:\providercommon\wininit.exe C:\Windows\System32\cmd.exe
PID 2028 wrote to memory of 4424 N/A C:\providercommon\wininit.exe C:\Windows\System32\cmd.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c507802eede7343e1b5f44f4a3e52b479f454b621b0803cf953aae1d972ebccb.exe

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c507802eede7343e1b5f44f4a3e52b479f454b621b0803cf953aae1d972ebccb.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "

C:\providercommon\DllCommonsvc.exe

"C:\providercommon\DllCommonsvc.exe"

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 6 /tr "'C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\unsecapp.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\unsecapp.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 14 /tr "'C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\unsecapp.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 7 /tr "'C:\Program Files\MSBuild\cmd.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Program Files\MSBuild\cmd.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 7 /tr "'C:\Program Files\MSBuild\cmd.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 11 /tr "'C:\Users\Default User\StartMenuExperienceHost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Users\Default User\StartMenuExperienceHost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 10 /tr "'C:\Users\Default User\StartMenuExperienceHost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Internet Explorer\it-IT\upfc.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\it-IT\upfc.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Internet Explorer\it-IT\upfc.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Media Player\en-US\RuntimeBroker.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\en-US\RuntimeBroker.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Media Player\en-US\RuntimeBroker.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\csrss.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\csrss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\csrss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 5 /tr "'C:\Windows\Microsoft.NET\Registry.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Windows\Microsoft.NET\Registry.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 14 /tr "'C:\Windows\Microsoft.NET\Registry.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\Windows\fr-FR\fontdrvhost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\fr-FR\fontdrvhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\Windows\fr-FR\fontdrvhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 14 /tr "'C:\Windows\LiveKernelReports\spoolsv.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\LiveKernelReports\spoolsv.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\Windows\LiveKernelReports\spoolsv.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 14 /tr "'C:\providercommon\wininit.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\providercommon\wininit.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 6 /tr "'C:\providercommon\wininit.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 10 /tr "'C:\providercommon\StartMenuExperienceHost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\providercommon\StartMenuExperienceHost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 11 /tr "'C:\providercommon\StartMenuExperienceHost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 8 /tr "'C:\Program Files\Microsoft Office\Office16\sppsvc.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\Office16\sppsvc.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 9 /tr "'C:\Program Files\Microsoft Office\Office16\sppsvc.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\explorer.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Users\All Users\explorer.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "explorere" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\explorer.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\sysmon.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\sysmon.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\sysmon.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\providercommon\sppsvc.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\providercommon\sppsvc.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 9 /tr "'C:\providercommon\sppsvc.exe'" /rl HIGHEST /f

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\unsecapp.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\MSBuild\cmd.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\StartMenuExperienceHost.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Internet Explorer\it-IT\upfc.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Media Player\en-US\RuntimeBroker.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\csrss.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Registry.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\fr-FR\fontdrvhost.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\LiveKernelReports\spoolsv.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\wininit.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\StartMenuExperienceHost.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Microsoft Office\Office16\sppsvc.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\explorer.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Mozilla Maintenance Service\logs\sysmon.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\sppsvc.exe'

C:\providercommon\wininit.exe

"C:\providercommon\wininit.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\aJcBxrOCPY.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\providercommon\wininit.exe

"C:\providercommon\wininit.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\p5ITN63wlJ.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\providercommon\wininit.exe

"C:\providercommon\wininit.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ZES4mQr7Bk.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\providercommon\wininit.exe

"C:\providercommon\wininit.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Gozseo6rLH.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\providercommon\wininit.exe

"C:\providercommon\wininit.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\4yKdveU0JJ.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\providercommon\wininit.exe

"C:\providercommon\wininit.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\gMBHdlpNUB.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\providercommon\wininit.exe

"C:\providercommon\wininit.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\XIQ15LoDrx.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\providercommon\wininit.exe

"C:\providercommon\wininit.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\JbtrqXgYk1.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\providercommon\wininit.exe

"C:\providercommon\wininit.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\0rnbwo7iYS.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\providercommon\wininit.exe

"C:\providercommon\wininit.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Jk1vLt9ke4.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\providercommon\wininit.exe

"C:\providercommon\wininit.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Gozseo6rLH.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\providercommon\wininit.exe

"C:\providercommon\wininit.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\12JaEZR6zX.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\providercommon\wininit.exe

"C:\providercommon\wininit.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\qwBPskakqG.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 136.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 raw.githubusercontent.com udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 185.199.109.133:443 raw.githubusercontent.com tcp
US 8.8.8.8:53 133.109.199.185.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 212.20.149.52.in-addr.arpa udp
US 185.199.109.133:443 raw.githubusercontent.com tcp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 133.130.81.91.in-addr.arpa udp
US 185.199.109.133:443 raw.githubusercontent.com tcp
US 185.199.109.133:443 raw.githubusercontent.com tcp
US 185.199.109.133:443 raw.githubusercontent.com tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 185.199.109.133:443 raw.githubusercontent.com tcp
US 185.199.109.133:443 raw.githubusercontent.com tcp
US 185.199.109.133:443 raw.githubusercontent.com tcp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 185.199.109.133:443 raw.githubusercontent.com tcp
US 185.199.109.133:443 raw.githubusercontent.com tcp
US 185.199.109.133:443 raw.githubusercontent.com tcp
US 185.199.109.133:443 raw.githubusercontent.com tcp
US 185.199.109.133:443 raw.githubusercontent.com tcp

Files

C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

MD5 8088241160261560a02c84025d107592
SHA1 083121f7027557570994c9fc211df61730455bb5
SHA256 2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1
SHA512 20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

C:\providercommon\1zu9dW.bat

MD5 6783c3ee07c7d151ceac57f1f9c8bed7
SHA1 17468f98f95bf504cc1f83c49e49a78526b3ea03
SHA256 8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322
SHA512 c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

C:\providercommon\DllCommonsvc.exe

MD5 bd31e94b4143c4ce49c17d3af46bcad0
SHA1 f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256 b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512 f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

memory/4812-12-0x00007FFD77D13000-0x00007FFD77D15000-memory.dmp

memory/4812-13-0x0000000000EE0000-0x0000000000FF0000-memory.dmp

memory/4812-14-0x0000000001840000-0x0000000001852000-memory.dmp

memory/4812-15-0x0000000003120000-0x000000000312C000-memory.dmp

memory/4812-16-0x0000000003100000-0x000000000310C000-memory.dmp

memory/4812-17-0x0000000003110000-0x000000000311C000-memory.dmp

memory/1544-70-0x00000168C6C00000-0x00000168C6C22000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_31iytmef.1ih.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/4228-80-0x0000000000DB0000-0x0000000000DC2000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 62623d22bd9e037191765d5083ce16a3
SHA1 4a07da6872672f715a4780513d95ed8ddeefd259
SHA256 95d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010
SHA512 9a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 77d622bb1a5b250869a3238b9bc1402b
SHA1 d47f4003c2554b9dfc4c16f22460b331886b191b
SHA256 f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb
SHA512 d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 a8e8360d573a4ff072dcc6f09d992c88
SHA1 3446774433ceaf0b400073914facab11b98b6807
SHA256 bf5e284e8f95122bf75ead61c7e2b40f55c96742b05330b5b1cb7915991df13b
SHA512 4ee5167643d82082f57c42616007ef9be57f43f9731921bdf7bca611a914724ad94072d3c8f5b130fa54129e5328ccdebf37ba74339c37deb53e79df5cdf0dbe

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 3a6bad9528f8e23fb5c77fbd81fa28e8
SHA1 f127317c3bc6407f536c0f0600dcbcf1aabfba36
SHA256 986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05
SHA512 846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 bd5940f08d0be56e65e5f2aaf47c538e
SHA1 d7e31b87866e5e383ab5499da64aba50f03e8443
SHA256 2d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6
SHA512 c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 59d97011e091004eaffb9816aa0b9abd
SHA1 1602a56b01dd4b7c577ca27d3117e4bcc1aa657b
SHA256 18f381e0db020a763b8c515c346ef58679ab9c403267eacfef5359e272f7e71d
SHA512 d9ca49c1a17580981e2c1a50d73c0eecaa7a62f8514741512172e395af2a3d80aeb0f71c58bc7f52c18246d57ba67af09b6bff4776877d6cc6f0245c30e092d6

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 5f0ddc7f3691c81ee14d17b419ba220d
SHA1 f0ef5fde8bab9d17c0b47137e014c91be888ee53
SHA256 a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5
SHA512 2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

C:\Users\Admin\AppData\Local\Temp\aJcBxrOCPY.bat

MD5 f700db4d55f4ea865841097b89868bc0
SHA1 954f84c0dda836211868a348cf09298f451fa0a8
SHA256 8e62861e5271bae7b81f0fec0a28e5e6f628cdcfebc0077f2a2ff7c761dbac6d
SHA512 ef3afb55ef760de86ff64fba4390792555ce10f604b21004fbb4f90f13e8d35f9a5cd2709ef721698404e9ac49f3432cd255476946858b8e2b67efd78ab982f0

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\wininit.exe.log

MD5 baf55b95da4a601229647f25dad12878
SHA1 abc16954ebfd213733c4493fc1910164d825cac8
SHA256 ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
SHA512 24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

memory/3616-257-0x000000001AEB0000-0x000000001AEC2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\p5ITN63wlJ.bat

MD5 2f2217f8e2016217ef4ac792a503caaa
SHA1 c3849f7f3f8d9cbed150947bb64f56fe474daac1
SHA256 490f22dfd2e963c32736341f87ceb289c91d947ca8a1ee404c35090d2d418b6f
SHA512 23a7383c0f7c693af9f6b2a6e4dcabaf23e79a5ebffcd96667c8903d3fe7ddc5d365b1f6a733925b7b610a3ad27c96537e755d1f6ffec353c130183657f30d28

memory/4056-264-0x000000001B400000-0x000000001B412000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ZES4mQr7Bk.bat

MD5 90237db909bbed7648288c362c92eee2
SHA1 0e3b8b97aa9afaf351a061967939183a639ede41
SHA256 9c0ab80f41f52df8b57d317645d1cd35f6ede64b1c5dc5f7cb547349f28ff587
SHA512 0687b83f47544aa9e325a62b9c7c481abfb67e0173960fecc4baf02ad1e01bf862a019e0a3a0bf86b78d3d01d511210534cbc9496d555b2660de544c375aa3fd

C:\Users\Admin\AppData\Local\Temp\Gozseo6rLH.bat

MD5 0a0be8595e7f677f187fcd565d11017c
SHA1 89df83231dac5f28aa632ef35a34a552bc521072
SHA256 e9e8325b2a949d51d97a64d0e21ae095771150db8ad83355445994f53b896c30
SHA512 7e26783b29e8e689ab3393329401e64be3499efd5750915907064e554996af332eccf0e678388be41f46a5f180bfa186c82d693912112b4b5d617934f8233a42

memory/1968-277-0x00000000013E0000-0x00000000013F2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\4yKdveU0JJ.bat

MD5 06c49d90abb466787487347f4cdbc25c
SHA1 7809bac3afb77e1e09043993c78a76183c1428ad
SHA256 211ebd96f1fadb6027d6da7d8d6e48a77d70745f69a68bc20ca3d7f892d9a2e1
SHA512 19a9666890c0161e1c2977f0b7ecf8bd4765410b2020d356282e15cf5138e46e5347189c41aeea91ba83526403fbfa18f439023f9170e6659316bece950107f4

memory/2564-284-0x0000000003120000-0x0000000003132000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\gMBHdlpNUB.bat

MD5 cf67aba28560ddf0d9a378eb2c4e3db7
SHA1 d82a478e64e1d4d1e6f458163d32ddcab7f6c483
SHA256 4bb4813694e9e3a10327154d578be2615c990f983d33970a5fc1a681ea4eb0b6
SHA512 b3bdd42412f33996ccc8e2e29cf37207fbf2a0a268be0d63235e1c9ede55a7461050986f45385467773f7ad1799044945af09c915dcf69a97978b327aa7600f7

C:\Users\Admin\AppData\Local\Temp\XIQ15LoDrx.bat

MD5 cda53cc391882e4e715e80ec4ee337b5
SHA1 fb535c9853ffaff9049575490aa0d2b1cd0c85dc
SHA256 d6f688609050e2c8ab5db97d501bea06c26f43eff910db6a0d7f8652d098034a
SHA512 975cc32b65352f0fa373b4e43da0ea6f7e8a7fcafd37c4cce37688dd2ffc854bc8c08ddb44dfa30a5d041cb8eabee271efd11a4ed8ad5144c2595e8a9669be8b

C:\Users\Admin\AppData\Local\Temp\JbtrqXgYk1.bat

MD5 6ab84b01a3e286e0e7b7dec16971ac34
SHA1 58da3a0d70cc8ffc51bdeaf6b2c74f15ae599247
SHA256 c3a6d39b34d2ee4cc9c613ca675524993a2d90f671c0402ef945c8195444bb43
SHA512 e1654e7ebb4d4333d5218bf94df4afd0f9b566be767d6c21d6ed84fb0443ff2e654c61eb95bb2f58dbb0095422d5cc608e5b39605379c508613c874a94d754a9

memory/4776-303-0x0000000002FE0000-0x0000000002FF2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\0rnbwo7iYS.bat

MD5 30398b1d2eb2f75b81859679eb1fcb08
SHA1 99986b47f57b16c1c94f4c44cb480137505c33d1
SHA256 63ddb68fef365b0d6220769ebb49a04e28948f57700eaa14a1aa33e35287e210
SHA512 b265f762403dabe559ae145120ca652910025be509d135091a7ea1c674810e7cc9c795ca17a29181c21ba3623f650f3d2d237f5424503a9b7ea4e44d146041e3

C:\Users\Admin\AppData\Local\Temp\Jk1vLt9ke4.bat

MD5 f479a2dd5f7532ab56c103070f142f79
SHA1 e67c5dcaa459c7365f0d8588634e671ab70a788d
SHA256 056b6a17195ee132de10217f2cd8ff24f8ef6e9d74ff6b6fdb75e36cc4178d4f
SHA512 78c2b48856e859a989e518b14ec03e6de870cd7414b9493f75d1021875c60d47ed4706dcf7b6ad97a4601341faf1d9f8a1b86d071ffe648ae96a3be497693491

memory/4008-316-0x00000000024D0000-0x00000000024E2000-memory.dmp

memory/1032-323-0x0000000000E70000-0x0000000000E82000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\12JaEZR6zX.bat

MD5 a39c049131a4f4f60d356b239490e19a
SHA1 7f4bb3a79d5de0e2efab9b7e7a8a45353253497e
SHA256 6be3510e4a82c5f3cb6d7f4177c8dca573d996b6cfd57e2cf327f2cc0a204e52
SHA512 31126515c19b495cc9e62b467e6467af41e1a86d4fc73219a887615c7e30bd397036db13d0d13a47e7b3f888846e08fb70c80242d6c3ab388242623996322489

C:\Users\Admin\AppData\Local\Temp\qwBPskakqG.bat

MD5 c03135d38182691bb4ca05586a74c9af
SHA1 9594ff54ce3187c728979d6df3de8d95fcfb9a9a
SHA256 38cd1c62c25c106236b3f19f10f4a1e8ef910657f7022c447e4c77a814ab6ea1
SHA512 cb58dbc883525528a96e7badcd29879d0974c1971f63eb9267f6405c5d8a8fe15af9ca5ff40f0ebedd48230f79176ffe309b06bbee237f73760b04819671022f