Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2024, 17:41
Behavioral task
behavioral1
Sample
JaffaCakes118_b864648c3665b63ba4a6fdab253dd9b87f5e242314a6c5998d56af54b2b3b37a.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
JaffaCakes118_b864648c3665b63ba4a6fdab253dd9b87f5e242314a6c5998d56af54b2b3b37a.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_b864648c3665b63ba4a6fdab253dd9b87f5e242314a6c5998d56af54b2b3b37a.exe
-
Size
1.3MB
-
MD5
f53dfacb6b320a39657fa0b75dfdcf0a
-
SHA1
4e92bc0af0f3d647744fef41c7b2c73e404c384e
-
SHA256
b864648c3665b63ba4a6fdab253dd9b87f5e242314a6c5998d56af54b2b3b37a
-
SHA512
25a9aa92f83dec0f6ac71dba96027a20c82419a6d6da323582906b6803a5164b5529f3770936f91ff5b11d7b912c02d231d0e315af9d09fef12082907c7ab442
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Process spawned unexpected child process 54 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4460 404 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1684 404 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3048 404 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1780 404 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3444 404 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3136 404 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2388 404 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2164 404 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 868 404 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1448 404 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4640 404 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4560 404 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2360 404 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1828 404 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4240 404 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3816 404 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5048 404 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 232 404 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 820 404 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 824 404 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2256 404 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4556 404 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2072 404 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3356 404 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4432 404 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2960 404 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2456 404 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1280 404 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3220 404 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3976 404 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2124 404 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2520 404 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4032 404 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3152 404 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3092 404 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3216 404 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4532 404 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3952 404 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1140 404 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3248 404 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5092 404 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3900 404 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1312 404 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 980 404 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1396 404 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5084 404 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4736 404 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4980 404 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4812 404 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3748 404 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1032 404 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4348 404 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5080 404 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2020 404 schtasks.exe 88 -
resource yara_rule behavioral2/files/0x0008000000023be2-10.dat dcrat behavioral2/memory/2996-13-0x0000000000E30000-0x0000000000F40000-memory.dmp dcrat -
Command and Scripting Interpreter: PowerShell 1 TTPs 19 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2204 powershell.exe 4400 powershell.exe 892 powershell.exe 4952 powershell.exe 2508 powershell.exe 1776 powershell.exe 3984 powershell.exe 4680 powershell.exe 4464 powershell.exe 412 powershell.exe 5088 powershell.exe 4972 powershell.exe 4840 powershell.exe 2024 powershell.exe 2140 powershell.exe 1988 powershell.exe 3064 powershell.exe 2316 powershell.exe 448 powershell.exe -
Checks computer location settings 2 TTPs 14 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation lsass.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation lsass.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation lsass.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation lsass.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation lsass.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation lsass.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation lsass.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation lsass.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation lsass.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation DllCommonsvc.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation lsass.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation lsass.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation JaffaCakes118_b864648c3665b63ba4a6fdab253dd9b87f5e242314a6c5998d56af54b2b3b37a.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation WScript.exe -
Executes dropped EXE 13 IoCs
pid Process 2996 DllCommonsvc.exe 1152 lsass.exe 2520 lsass.exe 2264 lsass.exe 3092 lsass.exe 3112 lsass.exe 2224 lsass.exe 3356 lsass.exe 4712 lsass.exe 1716 lsass.exe 940 lsass.exe 5116 lsass.exe 4116 lsass.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 12 IoCs
flow ioc 45 raw.githubusercontent.com 46 raw.githubusercontent.com 52 raw.githubusercontent.com 18 raw.githubusercontent.com 39 raw.githubusercontent.com 40 raw.githubusercontent.com 51 raw.githubusercontent.com 53 raw.githubusercontent.com 54 raw.githubusercontent.com 17 raw.githubusercontent.com 25 raw.githubusercontent.com 41 raw.githubusercontent.com -
Drops file in Program Files directory 10 IoCs
description ioc Process File created C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\886983d96e3d3e DllCommonsvc.exe File created C:\Program Files (x86)\Google\RuntimeBroker.exe DllCommonsvc.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\taskhostw.exe DllCommonsvc.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\ea9f0e6c9e2dcd DllCommonsvc.exe File created C:\Program Files\Windows Mail\a76d7bf15d8370 DllCommonsvc.exe File created C:\Program Files (x86)\Windows Mail\dllhost.exe DllCommonsvc.exe File created C:\Program Files (x86)\Windows Mail\5940a34987c991 DllCommonsvc.exe File created C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\csrss.exe DllCommonsvc.exe File created C:\Program Files (x86)\Google\9e8d7a4ca61bd9 DllCommonsvc.exe File created C:\Program Files\Windows Mail\DllCommonsvc.exe DllCommonsvc.exe -
Drops file in Windows directory 6 IoCs
description ioc Process File created C:\Windows\GameBarPresenceWriter\taskhostw.exe DllCommonsvc.exe File created C:\Windows\GameBarPresenceWriter\ea9f0e6c9e2dcd DllCommonsvc.exe File created C:\Windows\rescache\_merged\System.exe DllCommonsvc.exe File created C:\Windows\OCR\cmd.exe DllCommonsvc.exe File created C:\Windows\Branding\Basebrd\it-IT\explorer.exe DllCommonsvc.exe File created C:\Windows\Branding\Basebrd\it-IT\7a0fd90576e088 DllCommonsvc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_b864648c3665b63ba4a6fdab253dd9b87f5e242314a6c5998d56af54b2b3b37a.exe -
Modifies registry class 12 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings lsass.exe Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings lsass.exe Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings lsass.exe Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings lsass.exe Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings lsass.exe Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings lsass.exe Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings JaffaCakes118_b864648c3665b63ba4a6fdab253dd9b87f5e242314a6c5998d56af54b2b3b37a.exe Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings lsass.exe Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings lsass.exe Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings lsass.exe Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings lsass.exe Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings lsass.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 54 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2520 schtasks.exe 5080 schtasks.exe 1780 schtasks.exe 3136 schtasks.exe 3220 schtasks.exe 4812 schtasks.exe 4640 schtasks.exe 1280 schtasks.exe 3952 schtasks.exe 5084 schtasks.exe 1396 schtasks.exe 4560 schtasks.exe 4556 schtasks.exe 5092 schtasks.exe 3356 schtasks.exe 4432 schtasks.exe 1032 schtasks.exe 2388 schtasks.exe 3816 schtasks.exe 1448 schtasks.exe 4980 schtasks.exe 1684 schtasks.exe 3444 schtasks.exe 868 schtasks.exe 2960 schtasks.exe 3976 schtasks.exe 3092 schtasks.exe 2256 schtasks.exe 2456 schtasks.exe 4032 schtasks.exe 2072 schtasks.exe 1140 schtasks.exe 4532 schtasks.exe 980 schtasks.exe 5048 schtasks.exe 824 schtasks.exe 2124 schtasks.exe 4240 schtasks.exe 3748 schtasks.exe 232 schtasks.exe 2020 schtasks.exe 3216 schtasks.exe 4460 schtasks.exe 1828 schtasks.exe 4736 schtasks.exe 3248 schtasks.exe 1312 schtasks.exe 4348 schtasks.exe 3048 schtasks.exe 3152 schtasks.exe 3900 schtasks.exe 2164 schtasks.exe 2360 schtasks.exe 820 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2996 DllCommonsvc.exe 2996 DllCommonsvc.exe 2996 DllCommonsvc.exe 2996 DllCommonsvc.exe 2996 DllCommonsvc.exe 2996 DllCommonsvc.exe 2996 DllCommonsvc.exe 2996 DllCommonsvc.exe 2996 DllCommonsvc.exe 2996 DllCommonsvc.exe 2996 DllCommonsvc.exe 2996 DllCommonsvc.exe 2996 DllCommonsvc.exe 2996 DllCommonsvc.exe 2996 DllCommonsvc.exe 2996 DllCommonsvc.exe 2996 DllCommonsvc.exe 2996 DllCommonsvc.exe 2996 DllCommonsvc.exe 2996 DllCommonsvc.exe 2996 DllCommonsvc.exe 2996 DllCommonsvc.exe 2996 DllCommonsvc.exe 4840 powershell.exe 4840 powershell.exe 3064 powershell.exe 3064 powershell.exe 2024 powershell.exe 2024 powershell.exe 2204 powershell.exe 2204 powershell.exe 4464 powershell.exe 4464 powershell.exe 2508 powershell.exe 2508 powershell.exe 2140 powershell.exe 2140 powershell.exe 1988 powershell.exe 1988 powershell.exe 5088 powershell.exe 5088 powershell.exe 3984 powershell.exe 3984 powershell.exe 892 powershell.exe 892 powershell.exe 412 powershell.exe 412 powershell.exe 1776 powershell.exe 1776 powershell.exe 448 powershell.exe 448 powershell.exe 2316 powershell.exe 2316 powershell.exe 4400 powershell.exe 4400 powershell.exe 4952 powershell.exe 4952 powershell.exe 4680 powershell.exe 4680 powershell.exe 4972 powershell.exe 4972 powershell.exe 4680 powershell.exe 1152 lsass.exe 1152 lsass.exe -
Suspicious use of AdjustPrivilegeToken 32 IoCs
description pid Process Token: SeDebugPrivilege 2996 DllCommonsvc.exe Token: SeDebugPrivilege 4840 powershell.exe Token: SeDebugPrivilege 3064 powershell.exe Token: SeDebugPrivilege 892 powershell.exe Token: SeDebugPrivilege 2024 powershell.exe Token: SeDebugPrivilege 2204 powershell.exe Token: SeDebugPrivilege 4464 powershell.exe Token: SeDebugPrivilege 2508 powershell.exe Token: SeDebugPrivilege 1988 powershell.exe Token: SeDebugPrivilege 4680 powershell.exe Token: SeDebugPrivilege 2140 powershell.exe Token: SeDebugPrivilege 5088 powershell.exe Token: SeDebugPrivilege 3984 powershell.exe Token: SeDebugPrivilege 412 powershell.exe Token: SeDebugPrivilege 1776 powershell.exe Token: SeDebugPrivilege 448 powershell.exe Token: SeDebugPrivilege 2316 powershell.exe Token: SeDebugPrivilege 4400 powershell.exe Token: SeDebugPrivilege 4952 powershell.exe Token: SeDebugPrivilege 1152 lsass.exe Token: SeDebugPrivilege 4972 powershell.exe Token: SeDebugPrivilege 2520 lsass.exe Token: SeDebugPrivilege 2264 lsass.exe Token: SeDebugPrivilege 3092 lsass.exe Token: SeDebugPrivilege 3112 lsass.exe Token: SeDebugPrivilege 2224 lsass.exe Token: SeDebugPrivilege 3356 lsass.exe Token: SeDebugPrivilege 4712 lsass.exe Token: SeDebugPrivilege 1716 lsass.exe Token: SeDebugPrivilege 940 lsass.exe Token: SeDebugPrivilege 5116 lsass.exe Token: SeDebugPrivilege 4116 lsass.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3932 wrote to memory of 3588 3932 JaffaCakes118_b864648c3665b63ba4a6fdab253dd9b87f5e242314a6c5998d56af54b2b3b37a.exe 83 PID 3932 wrote to memory of 3588 3932 JaffaCakes118_b864648c3665b63ba4a6fdab253dd9b87f5e242314a6c5998d56af54b2b3b37a.exe 83 PID 3932 wrote to memory of 3588 3932 JaffaCakes118_b864648c3665b63ba4a6fdab253dd9b87f5e242314a6c5998d56af54b2b3b37a.exe 83 PID 3588 wrote to memory of 1656 3588 WScript.exe 85 PID 3588 wrote to memory of 1656 3588 WScript.exe 85 PID 3588 wrote to memory of 1656 3588 WScript.exe 85 PID 1656 wrote to memory of 2996 1656 cmd.exe 87 PID 1656 wrote to memory of 2996 1656 cmd.exe 87 PID 2996 wrote to memory of 4972 2996 DllCommonsvc.exe 144 PID 2996 wrote to memory of 4972 2996 DllCommonsvc.exe 144 PID 2996 wrote to memory of 4840 2996 DllCommonsvc.exe 145 PID 2996 wrote to memory of 4840 2996 DllCommonsvc.exe 145 PID 2996 wrote to memory of 4680 2996 DllCommonsvc.exe 146 PID 2996 wrote to memory of 4680 2996 DllCommonsvc.exe 146 PID 2996 wrote to memory of 2508 2996 DllCommonsvc.exe 147 PID 2996 wrote to memory of 2508 2996 DllCommonsvc.exe 147 PID 2996 wrote to memory of 4952 2996 DllCommonsvc.exe 148 PID 2996 wrote to memory of 4952 2996 DllCommonsvc.exe 148 PID 2996 wrote to memory of 892 2996 DllCommonsvc.exe 149 PID 2996 wrote to memory of 892 2996 DllCommonsvc.exe 149 PID 2996 wrote to memory of 1988 2996 DllCommonsvc.exe 151 PID 2996 wrote to memory of 1988 2996 DllCommonsvc.exe 151 PID 2996 wrote to memory of 4400 2996 DllCommonsvc.exe 152 PID 2996 wrote to memory of 4400 2996 DllCommonsvc.exe 152 PID 2996 wrote to memory of 2204 2996 DllCommonsvc.exe 153 PID 2996 wrote to memory of 2204 2996 DllCommonsvc.exe 153 PID 2996 wrote to memory of 2140 2996 DllCommonsvc.exe 154 PID 2996 wrote to memory of 2140 2996 DllCommonsvc.exe 154 PID 2996 wrote to memory of 3984 2996 DllCommonsvc.exe 155 PID 2996 wrote to memory of 3984 2996 DllCommonsvc.exe 155 PID 2996 wrote to memory of 1776 2996 DllCommonsvc.exe 156 PID 2996 wrote to memory of 1776 2996 DllCommonsvc.exe 156 PID 2996 wrote to memory of 2024 2996 DllCommonsvc.exe 157 PID 2996 wrote to memory of 2024 2996 DllCommonsvc.exe 157 PID 2996 wrote to memory of 5088 2996 DllCommonsvc.exe 158 PID 2996 wrote to memory of 5088 2996 DllCommonsvc.exe 158 PID 2996 wrote to memory of 412 2996 DllCommonsvc.exe 161 PID 2996 wrote to memory of 412 2996 DllCommonsvc.exe 161 PID 2996 wrote to memory of 448 2996 DllCommonsvc.exe 165 PID 2996 wrote to memory of 448 2996 DllCommonsvc.exe 165 PID 2996 wrote to memory of 2316 2996 DllCommonsvc.exe 167 PID 2996 wrote to memory of 2316 2996 DllCommonsvc.exe 167 PID 2996 wrote to memory of 3064 2996 DllCommonsvc.exe 168 PID 2996 wrote to memory of 3064 2996 DllCommonsvc.exe 168 PID 2996 wrote to memory of 4464 2996 DllCommonsvc.exe 169 PID 2996 wrote to memory of 4464 2996 DllCommonsvc.exe 169 PID 2996 wrote to memory of 1152 2996 DllCommonsvc.exe 181 PID 2996 wrote to memory of 1152 2996 DllCommonsvc.exe 181 PID 1152 wrote to memory of 5852 1152 lsass.exe 191 PID 1152 wrote to memory of 5852 1152 lsass.exe 191 PID 5852 wrote to memory of 5912 5852 cmd.exe 193 PID 5852 wrote to memory of 5912 5852 cmd.exe 193 PID 5852 wrote to memory of 2520 5852 cmd.exe 199 PID 5852 wrote to memory of 2520 5852 cmd.exe 199 PID 2520 wrote to memory of 880 2520 lsass.exe 201 PID 2520 wrote to memory of 880 2520 lsass.exe 201 PID 880 wrote to memory of 5200 880 cmd.exe 203 PID 880 wrote to memory of 5200 880 cmd.exe 203 PID 880 wrote to memory of 2264 880 cmd.exe 207 PID 880 wrote to memory of 2264 880 cmd.exe 207 PID 2264 wrote to memory of 456 2264 lsass.exe 210 PID 2264 wrote to memory of 456 2264 lsass.exe 210 PID 456 wrote to memory of 1604 456 cmd.exe 212 PID 456 wrote to memory of 1604 456 cmd.exe 212 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b864648c3665b63ba4a6fdab253dd9b87f5e242314a6c5998d56af54b2b3b37a.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b864648c3665b63ba4a6fdab253dd9b87f5e242314a6c5998d56af54b2b3b37a.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3932 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3588 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\providercommon\DllCommonsvc.exe"C:\providercommon\DllCommonsvc.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4972
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Music\dwm.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4840
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\lsass.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4680
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\lsass.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2508
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\smss.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4952
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\dwm.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:892
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\GameBarPresenceWriter\taskhostw.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1988
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\fontdrvhost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4400
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Mail\dllhost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2204
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\TextInputHost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2140
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\csrss.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3984
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Google\RuntimeBroker.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1776
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Sidebar\Gadgets\taskhostw.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2024
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\RuntimeBroker.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5088
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\upfc.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:412
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Branding\Basebrd\it-IT\explorer.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:448
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\winlogon.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2316
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\RuntimeBroker.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3064
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Mail\DllCommonsvc.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4464
-
-
C:\Recovery\WindowsRE\lsass.exe"C:\Recovery\WindowsRE\lsass.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\lLU0orPlEL.bat"6⤵
- Suspicious use of WriteProcessMemory
PID:5852 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:27⤵PID:5912
-
-
C:\Recovery\WindowsRE\lsass.exe"C:\Recovery\WindowsRE\lsass.exe"7⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\GvFVSjZSRs.bat"8⤵
- Suspicious use of WriteProcessMemory
PID:880 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:29⤵PID:5200
-
-
C:\Recovery\WindowsRE\lsass.exe"C:\Recovery\WindowsRE\lsass.exe"9⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\GvFVSjZSRs.bat"10⤵
- Suspicious use of WriteProcessMemory
PID:456 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:211⤵PID:1604
-
-
C:\Recovery\WindowsRE\lsass.exe"C:\Recovery\WindowsRE\lsass.exe"11⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3092 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\oS12nhm3yC.bat"12⤵PID:408
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:213⤵PID:5108
-
-
C:\Recovery\WindowsRE\lsass.exe"C:\Recovery\WindowsRE\lsass.exe"13⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3112 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Rhkc0SdEF2.bat"14⤵PID:4896
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:215⤵PID:3608
-
-
C:\Recovery\WindowsRE\lsass.exe"C:\Recovery\WindowsRE\lsass.exe"15⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2224 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\uOEGMIRuqZ.bat"16⤵PID:4192
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:217⤵PID:5432
-
-
C:\Recovery\WindowsRE\lsass.exe"C:\Recovery\WindowsRE\lsass.exe"17⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3356 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\yMeEqlK1gO.bat"18⤵PID:3244
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:219⤵PID:5420
-
-
C:\Recovery\WindowsRE\lsass.exe"C:\Recovery\WindowsRE\lsass.exe"19⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4712 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\wRcBAgH7Mb.bat"20⤵PID:5868
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:221⤵PID:5940
-
-
C:\Recovery\WindowsRE\lsass.exe"C:\Recovery\WindowsRE\lsass.exe"21⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1716 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\pCY6B1XXru.bat"22⤵PID:5508
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:223⤵PID:5616
-
-
C:\Recovery\WindowsRE\lsass.exe"C:\Recovery\WindowsRE\lsass.exe"23⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:940 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\mQe7zIwqSA.bat"24⤵PID:5048
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:225⤵PID:1592
-
-
C:\Recovery\WindowsRE\lsass.exe"C:\Recovery\WindowsRE\lsass.exe"25⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:5116 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\EzDSmeWZ76.bat"26⤵PID:456
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:227⤵PID:4768
-
-
C:\Recovery\WindowsRE\lsass.exe"C:\Recovery\WindowsRE\lsass.exe"27⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4116
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 6 /tr "'C:\Users\Public\Music\dwm.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4460
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Users\Public\Music\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1684
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\Users\Public\Music\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3048
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\lsass.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1780
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3444
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3136
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 7 /tr "'C:\Users\Default User\lsass.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2388
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Users\Default User\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2164
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:868
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\providercommon\smss.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1448
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\providercommon\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4640
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\providercommon\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4560
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 8 /tr "'C:\providercommon\dwm.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2360
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\providercommon\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1828
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 12 /tr "'C:\providercommon\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4240
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 14 /tr "'C:\Windows\GameBarPresenceWriter\taskhostw.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3816
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Windows\GameBarPresenceWriter\taskhostw.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5048
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 11 /tr "'C:\Windows\GameBarPresenceWriter\taskhostw.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:232
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\providercommon\fontdrvhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:820
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\providercommon\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:824
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\providercommon\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2256
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Mail\dllhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4556
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2072
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Mail\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3356
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 11 /tr "'C:\Users\Default User\TextInputHost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4432
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Users\Default User\TextInputHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2960
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\TextInputHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2456
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\csrss.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1280
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3220
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3976
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Google\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2124
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2520
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Google\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4032
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\taskhostw.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3152
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\taskhostw.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3092
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\taskhostw.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3216
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4532
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3952
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1140
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "upfcu" /sc MINUTE /mo 9 /tr "'C:\providercommon\upfc.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3248
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\providercommon\upfc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5092
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "upfcu" /sc MINUTE /mo 5 /tr "'C:\providercommon\upfc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3900
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 9 /tr "'C:\Windows\Branding\Basebrd\it-IT\explorer.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1312
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\Branding\Basebrd\it-IT\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:980
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\Windows\Branding\Basebrd\it-IT\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1396
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5084
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4736
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4980
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4812
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\All Users\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3748
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Users\All Users\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1032
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Mail\DllCommonsvc.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4348
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\DllCommonsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5080
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Mail\DllCommonsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2020
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5baf55b95da4a601229647f25dad12878
SHA1abc16954ebfd213733c4493fc1910164d825cac8
SHA256ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
SHA51224f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD5cadef9abd087803c630df65264a6c81c
SHA1babbf3636c347c8727c35f3eef2ee643dbcc4bd2
SHA256cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438
SHA5127278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085
-
Filesize
944B
MD562623d22bd9e037191765d5083ce16a3
SHA14a07da6872672f715a4780513d95ed8ddeefd259
SHA25695d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010
SHA5129a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992
-
Filesize
944B
MD5e243a38635ff9a06c87c2a61a2200656
SHA1ecd95ed5bf1a9fbe96a8448fc2814a0210fa2afc
SHA256af5782703f3f2d5a29fb313dae6680a64134db26064d4a321a3f23b75f6ca00f
SHA5124418957a1b10eee44cf270c81816ae707352411c4f5ac14b6b61ab537c91480e24e0a0a2c276a6291081b4984c123cf673a45dcedb0ceeef682054ba0fc19cb4
-
Filesize
944B
MD5bd5940f08d0be56e65e5f2aaf47c538e
SHA1d7e31b87866e5e383ab5499da64aba50f03e8443
SHA2562d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6
SHA512c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406
-
Filesize
944B
MD55f0ddc7f3691c81ee14d17b419ba220d
SHA1f0ef5fde8bab9d17c0b47137e014c91be888ee53
SHA256a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5
SHA5122ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3
-
Filesize
196B
MD52f406e36a6b2f9ddbf7776af0b184d64
SHA1ddeaa161c963ae7cbfb74706ff52234163bb4af0
SHA256f59ad0b1a17c95523e1a0c05de74b34fdd8056ce069f7bfe55a0e3bdc870e1b1
SHA5127e769ddb0504048b4986945179203301586105fa943854efd8e0b4cc774458fa9e875ee882e8812e8f3ec9ca8b95759a355d0deaba2becc0c82c3d7e447beea6
-
Filesize
196B
MD5b12eb246e4f194622b57e783165422ec
SHA1a43bf0b8010604c2a7b9a662c727efe723981ed3
SHA256402b7ead7c2d468bfb880b2d39ed6744cf13dad70108e2af2f6dd751fb004768
SHA512b778efb221824a605f547a3d02906b6287dd0c17f190352020b0d70e6220e7d3c3ba65b3853b46282cdf7b3a590870be9ab4f8471c084180da12708b23d633ab
-
Filesize
196B
MD5b398b139cf46a703223f2a0195cd122a
SHA17b7645f9ab75bf0a0e9788cec256ac2803a0ad58
SHA25609840a83296f20dff385238c3d263f67b2e5d7893779217186b675694852ecae
SHA5125d8bb747aa934ce4fb2dae725b39839ee9229f443d3cc2090d0b806796da6fe93dba8545c8dd99aa33335eb550bd7619ce5b8f78a8afc882c1c7f413bbe083fd
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
196B
MD54794cefd4237ee3ced1d426f8aff7ddf
SHA132f6fb5672507449cc6ab3393f6cf0150131879a
SHA256f84ecbc107a3f6a7fa5da61306b921b94b59852c69fbb72874b0d9a9e6d46105
SHA5128c14bfb5c96c1c75a482e6f999f4fa7c21bdc9962212115cd61d5d564ad111de3680d310e9f2a4803c479f8cf3a8c0b9b2c68b4936d6e23877d51e451f16f64b
-
Filesize
196B
MD56ef5c47c4af5fd2dfd683fb6b4ddbc2d
SHA1501ce1ac61ba6b379108fb1b76fef883e34f4300
SHA2569d6631e001082ba544c7dcd0ecdc22c4e6b880049eb05d92a8ce6120f0aff41d
SHA5121514c66692b06e6cb582ef6dd35f861360129fe59792e79a3b86c39a3a5d680c3d45a6f86be78989c42687e0e6792f1ec52ea3ceeaa2964059b21cdbe4e548ac
-
Filesize
196B
MD5a6c9c153a2fffb3b00e87daa5f45ce33
SHA1f7061de08d5cf8b6bd18dfdfcd820213277d5357
SHA256bd8a8247dd245dcc5aacd6a27392251cc0aaa31b5442fdc10ccee53bbdd0778a
SHA512c1c2858fab00666e9d15be8e8fffd6514041cc604e748bf3a01a949d87a6a0b8639a8c0837521e82f866ffd728f8d1c50c36ab5f22d479514e6a3b82d1cab3f5
-
Filesize
196B
MD5301e1805356e433ecc2e62c330f7f1b2
SHA15e0bf75e9d0db57c94e1ed9dceb56f65bccd068b
SHA2560a2c4387136472ba2c54ba65f89110efc71322582d99347a03245bdbbe22aadb
SHA512b413078b33f13cd8ad78c604c034e4ed317b84cca5f1f7b9eec1169c2cf23b138ae03ba79f2c92e3ab7cda035c1bd845bdd77d6554cbed961e854c6dc69b04af
-
Filesize
196B
MD570f273f8be9e25d756f84dd2f635416b
SHA1abfe9f407b23a7152c0e5d18487f5b1e2b0e5f2c
SHA2564753c64ca388cfeabedf19fb5de339891735c5885ac21d22b6e5a187adfa46b5
SHA512680501d5303bfa91145937c5f7e13069f19dfa2f5a1f5a57f2bf5b88355df1556d5aa1dd930deaffd6918a3631205dba1c7b60f63dd78ec1496f56dd8cfbe756
-
Filesize
196B
MD5ccdb67cac5ff3d164f928cfe4ad1ab43
SHA12adea377fbacc0314d321e79c9fbb8797ced3d94
SHA2566cb3e804e35a48220f412abb35870e4735c1786b587116de017e1e542d0960fe
SHA5124a9bf975ed7a5e2dfd7e5c2ca73d7178a18752c8ef09e265625e71150628f1e50ee66a25ffeeb3d72edc0b07812dd6c8aecb2100e656043fb755602caa7cbce6
-
Filesize
196B
MD5ad095146cdb564805b063da8c93eb50b
SHA19d98d158429d4ebc7b4c978f5373b476f79b7efd
SHA25683c43ddc70eab94fa8a10feb5a1f67d1393ce46370c0731f906e9070389c7915
SHA512f6a7bdb649f1b4083a68a1df1fe6da39dc34b020877e05dab48e006d59c3f391ae78f612e26d6d1afc123c199a3de7dd619c888cd32c7bb9559b3ae6ae39b198
-
Filesize
36B
MD56783c3ee07c7d151ceac57f1f9c8bed7
SHA117468f98f95bf504cc1f83c49e49a78526b3ea03
SHA2568ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322
SHA512c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8
-
Filesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
Filesize
197B
MD58088241160261560a02c84025d107592
SHA1083121f7027557570994c9fc211df61730455bb5
SHA2562072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1
SHA51220d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478