Analysis

  • max time kernel
    148s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    30/12/2024, 17:31

General

  • Target

    JaffaCakes118_d8b45a0c6bbd494449eacaf19a4f958ebedd37d4b5f5fef8c2da0177ea025c3c.exe

  • Size

    1.3MB

  • MD5

    54de6db97b6c682feee9765103b272c9

  • SHA1

    a0cb252a6323f97663cd3b1eec75db2c3ab8d319

  • SHA256

    d8b45a0c6bbd494449eacaf19a4f958ebedd37d4b5f5fef8c2da0177ea025c3c

  • SHA512

    c71dd8e04faf10ffdce681f970529e47551e31eb29d639a275f4654e7bb4f0fe29f9a6a402ca9a2e18e957ad1fe4b467b7e13af38ae32cec52f83efdcdb1fe02

  • SSDEEP

    24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Dcrat family
  • Process spawned unexpected child process 30 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • DCRat payload 10 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Executes dropped EXE 12 IoCs
  • Loads dropped DLL 2 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 11 IoCs
  • Drops file in Program Files directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 30 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 23 IoCs
  • Suspicious use of AdjustPrivilegeToken 23 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d8b45a0c6bbd494449eacaf19a4f958ebedd37d4b5f5fef8c2da0177ea025c3c.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d8b45a0c6bbd494449eacaf19a4f958ebedd37d4b5f5fef8c2da0177ea025c3c.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2236
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2760
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\providercommon\1zu9dW.bat" "
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2792
        • C:\providercommon\DllCommonsvc.exe
          "C:\providercommon\DllCommonsvc.exe"
          4⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2852
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1276
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\System.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2120
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\sppsvc.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:408
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Java\services.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1112
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Documents\WmiPrvSE.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2260
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Photo Viewer\ja-JP\smss.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3052
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\Idle.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3016
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\DllCommonsvc.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2264
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\cmd.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2272
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\explorer.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1832
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1544
          • C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\DllCommonsvc.exe
            "C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\DllCommonsvc.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2020
            • C:\Windows\System32\cmd.exe
              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\svzewrKVsp.bat"
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:2692
              • C:\Windows\system32\w32tm.exe
                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                7⤵
                  PID:2528
                • C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\DllCommonsvc.exe
                  "C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\DllCommonsvc.exe"
                  7⤵
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:1696
                  • C:\Windows\System32\cmd.exe
                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\InhrPXXuGB.bat"
                    8⤵
                    • Suspicious use of WriteProcessMemory
                    PID:1100
                    • C:\Windows\system32\w32tm.exe
                      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                      9⤵
                        PID:2472
                      • C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\DllCommonsvc.exe
                        "C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\DllCommonsvc.exe"
                        9⤵
                        • Executes dropped EXE
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1612
                        • C:\Windows\System32\cmd.exe
                          "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Lg3y2yDdyq.bat"
                          10⤵
                            PID:536
                            • C:\Windows\system32\w32tm.exe
                              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                              11⤵
                                PID:2548
                              • C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\DllCommonsvc.exe
                                "C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\DllCommonsvc.exe"
                                11⤵
                                • Executes dropped EXE
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of AdjustPrivilegeToken
                                PID:2436
                                • C:\Windows\System32\cmd.exe
                                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\EqBdbgL5Ji.bat"
                                  12⤵
                                    PID:1088
                                    • C:\Windows\system32\w32tm.exe
                                      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                      13⤵
                                        PID:2612
                                      • C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\DllCommonsvc.exe
                                        "C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\DllCommonsvc.exe"
                                        13⤵
                                        • Executes dropped EXE
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:2668
                                        • C:\Windows\System32\cmd.exe
                                          "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\cV1vwDPsky.bat"
                                          14⤵
                                            PID:2588
                                            • C:\Windows\system32\w32tm.exe
                                              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                              15⤵
                                                PID:556
                                              • C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\DllCommonsvc.exe
                                                "C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\DllCommonsvc.exe"
                                                15⤵
                                                • Executes dropped EXE
                                                • Suspicious behavior: EnumeratesProcesses
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:984
                                                • C:\Windows\System32\cmd.exe
                                                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\k2jNhBdkgg.bat"
                                                  16⤵
                                                    PID:2648
                                                    • C:\Windows\system32\w32tm.exe
                                                      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                      17⤵
                                                        PID:2820
                                                      • C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\DllCommonsvc.exe
                                                        "C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\DllCommonsvc.exe"
                                                        17⤵
                                                        • Executes dropped EXE
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:1256
                                                        • C:\Windows\System32\cmd.exe
                                                          "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\V9nTU0UPEK.bat"
                                                          18⤵
                                                            PID:1344
                                                            • C:\Windows\system32\w32tm.exe
                                                              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                              19⤵
                                                                PID:2400
                                                              • C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\DllCommonsvc.exe
                                                                "C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\DllCommonsvc.exe"
                                                                19⤵
                                                                • Executes dropped EXE
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:2436
                                                                • C:\Windows\System32\cmd.exe
                                                                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\CTHuJZ10YE.bat"
                                                                  20⤵
                                                                    PID:2100
                                                                    • C:\Windows\system32\w32tm.exe
                                                                      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                      21⤵
                                                                        PID:2004
                                                                      • C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\DllCommonsvc.exe
                                                                        "C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\DllCommonsvc.exe"
                                                                        21⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        PID:2736
                                                                        • C:\Windows\System32\cmd.exe
                                                                          "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\DXR1U0Y5m3.bat"
                                                                          22⤵
                                                                            PID:2080
                                                                            • C:\Windows\system32\w32tm.exe
                                                                              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                              23⤵
                                                                                PID:1860
                                                                              • C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\DllCommonsvc.exe
                                                                                "C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\DllCommonsvc.exe"
                                                                                23⤵
                                                                                • Executes dropped EXE
                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                PID:2880
                                                                                • C:\Windows\System32\cmd.exe
                                                                                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\DXR1U0Y5m3.bat"
                                                                                  24⤵
                                                                                    PID:1312
                                                                                    • C:\Windows\system32\w32tm.exe
                                                                                      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                      25⤵
                                                                                        PID:1676
                                                                                      • C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\DllCommonsvc.exe
                                                                                        "C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\DllCommonsvc.exe"
                                                                                        25⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        PID:928
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 6 /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\System.exe'" /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:2208
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\System.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:1680
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\System.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:332
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 7 /tr "'C:\providercommon\sppsvc.exe'" /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:984
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\providercommon\sppsvc.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:1120
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 11 /tr "'C:\providercommon\sppsvc.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:1856
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "servicess" /sc MINUTE /mo 8 /tr "'C:\Program Files\Java\services.exe'" /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:2828
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files\Java\services.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:2840
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "servicess" /sc MINUTE /mo 10 /tr "'C:\Program Files\Java\services.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:2384
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\Documents\WmiPrvSE.exe'" /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:2620
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Users\All Users\Documents\WmiPrvSE.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:1624
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\Documents\WmiPrvSE.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:760
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "smsss" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Photo Viewer\ja-JP\smss.exe'" /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:800
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\ja-JP\smss.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:1788
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "smsss" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Photo Viewer\ja-JP\smss.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:2460
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\Idle.exe'" /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:1424
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\Idle.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:632
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\Idle.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:1648
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 5 /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\DllCommonsvc.exe'" /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:1628
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\DllCommonsvc.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:1772
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 5 /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\DllCommonsvc.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:1760
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\cmd.exe'" /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:2164
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\cmd.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:2876
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\cmd.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:2096
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\explorer.exe'" /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:2396
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\explorer.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:1096
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "explorere" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\explorer.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:2180
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe'" /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:2008
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:2040
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:1396

                                      Network

                                            MITRE ATT&CK Enterprise v15

                                            Replay Monitor

                                            Loading Replay Monitor...

                                            Downloads

                                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                              Filesize

                                              342B

                                              MD5

                                              355372563624e5935b68136d11b945c3

                                              SHA1

                                              a7ba500d2fb8bf1ec66ab806b242ee1ba42e3aae

                                              SHA256

                                              b442dabce3b3bc25b7ef68af92612b67ddade9769388f9d58c18c87e344c0c12

                                              SHA512

                                              94c707bb27b1138e6972d925115ccffecc17857fbe9eee2517b45d2b6a4b296bff0b32d67391a18ee02e2c609b172027bbf647a5414e545678c57eb5b64bfdce

                                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                              Filesize

                                              342B

                                              MD5

                                              796b9eab030b7e4c74af01de75c44e37

                                              SHA1

                                              645e3fc91cfe513796ab55e1215afb93289fd422

                                              SHA256

                                              9d04d9eab50489e0eb6ed8ad0d2abaef10f71213bb34798ed18a5eaca4014955

                                              SHA512

                                              e1def66cc7ebd2d8e6dbb038d2844679f491b13f8ca8c4062d4b6072b6df869dc75fe1f737f795879d01869fefd7e4d10aed91e864cee12c8c03e5a94f264261

                                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                              Filesize

                                              342B

                                              MD5

                                              e375507704762c8d99dbe82f4857268f

                                              SHA1

                                              d44f11a43f75ce07c656858e33e0bf5ab8c62ce4

                                              SHA256

                                              a8ac21b2ff7468b609ef1dbb584b6acd9043c75eb635b6d19bea4527835a1694

                                              SHA512

                                              a411a93e98df3107ce59cca89ac76e617bcdd7c1792e31ddb27d203b9f435a4f5a70be659c7a98189dd98803a945b6451bf142ba4539e7fbb3e6d191430e05fd

                                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                              Filesize

                                              342B

                                              MD5

                                              77f8ee1ecd8bca1ce502550e769393a3

                                              SHA1

                                              3c5542401d8745f493b2207209f7e72dc3976e11

                                              SHA256

                                              1091e5da60a68d125413e99572b98b2f8ee148c05381d5a92c3bc448a35c98ef

                                              SHA512

                                              18abdf8c744674d4ca01258c38b5538842949bdf2943ccec04b3571bf5d8c296e5aae6a11da6d0bb877abbc94650287fdc9fbb13e15da0ee47546f1478fad28d

                                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                              Filesize

                                              342B

                                              MD5

                                              c65a31a9d15b4ae1397d39010fb3b3d2

                                              SHA1

                                              c49d6e1ecc0294c5833b7ab9e58a8188ccd209c1

                                              SHA256

                                              2825400c1ddc1dbe4a4557d6c24817abd3e5ff38f9636022b35d872db1ab170d

                                              SHA512

                                              6bf505c8c43f82d10e68e055b5aaae644689b7505cb92a5d88f032c1f469297e69b0f8d13c1e5f62127f3ce6a52f13ac39a26bae7db24f140d13b7ed45b997a1

                                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                              Filesize

                                              342B

                                              MD5

                                              05b1ced15ff1047bfa8c67563d97a549

                                              SHA1

                                              54eb8a8ceca0721da33637bb8f63f0f222a66557

                                              SHA256

                                              cb90b21cc93fd2687aeb49883b3080f4e60172c21d290d7e6341375501752009

                                              SHA512

                                              7fa595e16d43002a3d9783128bf9410d8dad4ff0b2a70155f2bf1b4bfd539d433f20250761f1bd10544a1b76a4def4c25d7e4dd2c490f3af19f597d6b8e20d86

                                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                              Filesize

                                              342B

                                              MD5

                                              be9e9cef00fa18fb4c5f7bf7d7593560

                                              SHA1

                                              f7a5bd4e86215c81ff09d43bbc8ec142311bfe62

                                              SHA256

                                              6ee896260aadfc4e7b840302c580f4ff4f77aee9f16dcf5f37b1555e4f61a489

                                              SHA512

                                              727aa7ccbca4f476c29b1eb02d6bbaf757d68eaf86e085e5dfed522c94de3e5f762169f32ed018328ba31bbe208d652e4a61987d4694bc37537c32b78d1df2b4

                                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                              Filesize

                                              342B

                                              MD5

                                              4d702894028b49d2c8766bbf41b71c4c

                                              SHA1

                                              bf926ed878e07383392fcc97998da9f7ce152f31

                                              SHA256

                                              b91d317eef60089b97e9640e3d4726e23a740b5b54ffbbee2913543017908d87

                                              SHA512

                                              5b8f2e0b314a5bbc043d00b283027e8aa9af3ea82a2373a9c714667426c965827a1ca5db8c53d6b66b1c941b9caf93c7d2a6d1c1b7c3dbc58636470c51c61fbe

                                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                              Filesize

                                              342B

                                              MD5

                                              7edb34e5b41ddddc00b05fda8cdf4163

                                              SHA1

                                              c25d461a020f5d9a273ae94d4c4ad3cdb9561c97

                                              SHA256

                                              5083421bb39d32aac2f0d1fcdf56afac74ff2f79071db2b938b12004330ed0d8

                                              SHA512

                                              4ea7d063fe9a04bf15df63ea799adbf9da18d3b41acadc016f5f5426f27cdd60b71c3ae0a0fd167b2f1a4f91af2b0d8fe97e641fb987d079be92b29dd98cf4fa

                                            • C:\Users\Admin\AppData\Local\Temp\CTHuJZ10YE.bat

                                              Filesize

                                              230B

                                              MD5

                                              5ef55f77658f025c538a566fe3a9015a

                                              SHA1

                                              a504e5975cd7318dfce234c710235a72085452e4

                                              SHA256

                                              190d70652a3e59721617be16b7c9e0b46a471516ee6fce83fc33a94ccc2263d7

                                              SHA512

                                              2d98f27c9d2caee67aad7671ba56422b0cdbc390d39180327c111078f772c1bd96da2c0d240316cf8af3ce6fb71730d8f8334d225ffc5e20505a46135d889cb9

                                            • C:\Users\Admin\AppData\Local\Temp\Cab7CEF.tmp

                                              Filesize

                                              70KB

                                              MD5

                                              49aebf8cbd62d92ac215b2923fb1b9f5

                                              SHA1

                                              1723be06719828dda65ad804298d0431f6aff976

                                              SHA256

                                              b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

                                              SHA512

                                              bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

                                            • C:\Users\Admin\AppData\Local\Temp\DXR1U0Y5m3.bat

                                              Filesize

                                              230B

                                              MD5

                                              dee48fbcfdd714076fa5aacc88f6aaf5

                                              SHA1

                                              f2c0c695a9631e66b8ec9f8b6d992d2686c5f3cd

                                              SHA256

                                              556ec725c176b15b0593526080e4dc1fee7e485a4205cf5999fc533d0978ef87

                                              SHA512

                                              90463c36f5e87e7f40f9f699bb4669b6fb3a7cbd3911ecc865daa38f68eb4f04d2b99078c63f52824d6dc5409b8aff10ab62eb70359b321f87dc79cbaa26a469

                                            • C:\Users\Admin\AppData\Local\Temp\EqBdbgL5Ji.bat

                                              Filesize

                                              230B

                                              MD5

                                              fcfa0fd725046879e35acb070c7c9273

                                              SHA1

                                              609a8d04147b00e29742d8c8af9ab046eb1783f0

                                              SHA256

                                              3db7442595a05a154c853fc58249cc1d98b981e5ddd1eb29c7dd524958205ce6

                                              SHA512

                                              96bcb5d34f33615aaa332acf20b837179143531d6f8f5d165437829372c8b7b84d4935f76988d260f7392b0619bf6c309bf6a24994fc7c8f11096ac2127f03e3

                                            • C:\Users\Admin\AppData\Local\Temp\InhrPXXuGB.bat

                                              Filesize

                                              230B

                                              MD5

                                              043e05d2f8b823bf2ce075e619a30e23

                                              SHA1

                                              b19033663308eb4559d2f5261eb4e0bba17e00b1

                                              SHA256

                                              f4c021732470f517fe162e05a61b300af916bf94a7018a72c1934ba48022af83

                                              SHA512

                                              8f5af1c6fba4bc3c5cbb88b65779204a7a39acbfbfc820bb0b3ed670b122c2dd2caee078aff74c4d5fd3a7bd0996af2b39190cc71225cae40721e33c71bd60de

                                            • C:\Users\Admin\AppData\Local\Temp\Lg3y2yDdyq.bat

                                              Filesize

                                              230B

                                              MD5

                                              5f4687d557fc2ea992d676e4fb55c46b

                                              SHA1

                                              ace30c6debd9f757494e7c677c0416c211b55c9c

                                              SHA256

                                              0d90bfb327277f5cd7380bdd7b2795819e9e7f4c5dcda82a0a5df22f0c69b757

                                              SHA512

                                              9a6ad306dbc83d2f1680938ccda7e2cd1da099f3539993cda61f56bf2653f6cbe97dafee8f1997fb14b9bd3113fd5eceb8ac5daaf1007cec0d0c0ea2f0ea40c8

                                            • C:\Users\Admin\AppData\Local\Temp\Tar7D02.tmp

                                              Filesize

                                              181KB

                                              MD5

                                              4ea6026cf93ec6338144661bf1202cd1

                                              SHA1

                                              a1dec9044f750ad887935a01430bf49322fbdcb7

                                              SHA256

                                              8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

                                              SHA512

                                              6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

                                            • C:\Users\Admin\AppData\Local\Temp\V9nTU0UPEK.bat

                                              Filesize

                                              230B

                                              MD5

                                              bd19c323dd5aa1dc0a7a4aae55a2e8dc

                                              SHA1

                                              8e0236039b29fd6d6026b17be1437392a67412eb

                                              SHA256

                                              668595a9e1edbb4542ac0e32bf28d1fd2c6939407dd0196392d279dee20ba742

                                              SHA512

                                              0bf3449e004c596305be54da0534e154814875f83855271d24fd50bcb3b42211312b2569c820b06706e6cc9c227c7797283098225f2b187a700bf708c5f3ded4

                                            • C:\Users\Admin\AppData\Local\Temp\cV1vwDPsky.bat

                                              Filesize

                                              230B

                                              MD5

                                              3934d87f04dd90c97d13a9114ca74c38

                                              SHA1

                                              f4c21805502456ae845af1024c9528b3190bb86f

                                              SHA256

                                              d30b7ccd565ee9cd26949b7195d4f0c5fbdeef4fb160448938c48516a31d155a

                                              SHA512

                                              cab342c9f7c6e8db865ac1de4d4db6f3905ee382d5ee0735650d9cad273aab2c3ecb614c84b70d174a502a5cad1788470ed75ee1078494cc7b1a315d14154d8a

                                            • C:\Users\Admin\AppData\Local\Temp\k2jNhBdkgg.bat

                                              Filesize

                                              230B

                                              MD5

                                              d1746b74f606af0e5209e3206f5a7471

                                              SHA1

                                              7bb92917e177ee03391232df97a5bcc49d576684

                                              SHA256

                                              b70a174839148190540adde05a77b4e1178ff7fa63e7044d4cc0f1e750e97f11

                                              SHA512

                                              8709ddd43d8ae8eb2249288c7c30104f8afab6a0576d270f7accc86fd1fdecb5f4f9d000b0d09828291b7eb2a1e461a83bb5b434ec04b711271c6536dc66b163

                                            • C:\Users\Admin\AppData\Local\Temp\svzewrKVsp.bat

                                              Filesize

                                              230B

                                              MD5

                                              e19cd53954ebdb3b904742940408ba34

                                              SHA1

                                              c7364288c69a8e9a929af6fcb090f11b2246fabf

                                              SHA256

                                              f8e3d893a5e5cd88ebb981b53fe55e8f345b469fea9210ab21d49f1066617395

                                              SHA512

                                              091646cd2c23d746f066cd602f722660588ef3ed67dfffb3e49d481a8ad958e27fe64782a62af0e387306a55d65f6ac4241fb0c1ff5c226871bdffb49b6cd26a

                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5BHT4U34GQ1WS0QUPUMW.temp

                                              Filesize

                                              7KB

                                              MD5

                                              9dac7d46707068806e69f760ef8ddb13

                                              SHA1

                                              c4d4c3c476ad2380cce57d259d214c562f7d813b

                                              SHA256

                                              538e10af1afab0d8483b59cd034d645f279c1c8fc071c7e7e1e05ebd4051f212

                                              SHA512

                                              59f33c42a566f2d14e4119ee892e4dac7918273460c7c612a34656eca7e6f1346c417740224e37d7aae026b0ff103734e54fd685e1bddff2f3b1768994aa4f70

                                            • C:\providercommon\1zu9dW.bat

                                              Filesize

                                              36B

                                              MD5

                                              6783c3ee07c7d151ceac57f1f9c8bed7

                                              SHA1

                                              17468f98f95bf504cc1f83c49e49a78526b3ea03

                                              SHA256

                                              8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

                                              SHA512

                                              c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

                                            • C:\providercommon\DllCommonsvc.exe

                                              Filesize

                                              1.0MB

                                              MD5

                                              bd31e94b4143c4ce49c17d3af46bcad0

                                              SHA1

                                              f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                              SHA256

                                              b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                              SHA512

                                              f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                            • C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

                                              Filesize

                                              197B

                                              MD5

                                              8088241160261560a02c84025d107592

                                              SHA1

                                              083121f7027557570994c9fc211df61730455bb5

                                              SHA256

                                              2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

                                              SHA512

                                              20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

                                            • memory/928-699-0x00000000000D0000-0x00000000001E0000-memory.dmp

                                              Filesize

                                              1.1MB

                                            • memory/984-400-0x0000000000340000-0x0000000000352000-memory.dmp

                                              Filesize

                                              72KB

                                            • memory/984-399-0x0000000000E30000-0x0000000000F40000-memory.dmp

                                              Filesize

                                              1.1MB

                                            • memory/1276-68-0x000000001B5A0000-0x000000001B882000-memory.dmp

                                              Filesize

                                              2.9MB

                                            • memory/1276-85-0x0000000001F00000-0x0000000001F08000-memory.dmp

                                              Filesize

                                              32KB

                                            • memory/1612-219-0x0000000000060000-0x0000000000170000-memory.dmp

                                              Filesize

                                              1.1MB

                                            • memory/1696-159-0x0000000000180000-0x0000000000192000-memory.dmp

                                              Filesize

                                              72KB

                                            • memory/2020-44-0x0000000001330000-0x0000000001440000-memory.dmp

                                              Filesize

                                              1.1MB

                                            • memory/2436-279-0x00000000008A0000-0x00000000009B0000-memory.dmp

                                              Filesize

                                              1.1MB

                                            • memory/2436-519-0x0000000000EC0000-0x0000000000FD0000-memory.dmp

                                              Filesize

                                              1.1MB

                                            • memory/2668-339-0x0000000000B00000-0x0000000000C10000-memory.dmp

                                              Filesize

                                              1.1MB

                                            • memory/2736-579-0x0000000001120000-0x0000000001230000-memory.dmp

                                              Filesize

                                              1.1MB

                                            • memory/2852-14-0x00000000001C0000-0x00000000001D2000-memory.dmp

                                              Filesize

                                              72KB

                                            • memory/2852-13-0x0000000000CF0000-0x0000000000E00000-memory.dmp

                                              Filesize

                                              1.1MB

                                            • memory/2852-15-0x00000000001E0000-0x00000000001EC000-memory.dmp

                                              Filesize

                                              48KB

                                            • memory/2852-16-0x00000000001D0000-0x00000000001DC000-memory.dmp

                                              Filesize

                                              48KB

                                            • memory/2852-17-0x0000000000370000-0x000000000037C000-memory.dmp

                                              Filesize

                                              48KB

                                            • memory/2880-639-0x0000000000240000-0x0000000000252000-memory.dmp

                                              Filesize

                                              72KB