Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2024, 17:41
Behavioral task
behavioral1
Sample
JaffaCakes118_3afdc1049eae3e0b40d944915e52d52d293b450e150b66b095fde82271501428.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_3afdc1049eae3e0b40d944915e52d52d293b450e150b66b095fde82271501428.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_3afdc1049eae3e0b40d944915e52d52d293b450e150b66b095fde82271501428.exe
-
Size
1.3MB
-
MD5
71307fc13b2659f3cdc5e19f3823d738
-
SHA1
3d63ad7172e5fe0f607d1ca5575c3cf772bbaac6
-
SHA256
3afdc1049eae3e0b40d944915e52d52d293b450e150b66b095fde82271501428
-
SHA512
07192db7b6c744868c70712bd8629b64d067ff150a2029394cf5fff2319e7171088c709204f45367329bf775f898608e7dea2008d3a448d471da394524259c10
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Process spawned unexpected child process 39 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4468 3688 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3864 3688 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1592 3688 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5068 3688 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 968 3688 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2256 3688 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4060 3688 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4340 3688 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1440 3688 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2584 3688 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2964 3688 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3440 3688 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3544 3688 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2180 3688 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4568 3688 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2300 3688 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2668 3688 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2824 3688 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3348 3688 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2168 3688 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2712 3688 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4112 3688 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2836 3688 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1588 3688 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1744 3688 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1820 3688 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 792 3688 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3336 3688 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3452 3688 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4956 3688 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2368 3688 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1760 3688 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 208 3688 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4564 3688 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4612 3688 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1724 3688 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1152 3688 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4600 3688 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3460 3688 schtasks.exe 88 -
resource yara_rule behavioral2/files/0x0007000000023c8b-9.dat dcrat behavioral2/memory/464-13-0x00000000008A0000-0x00000000009B0000-memory.dmp dcrat -
Command and Scripting Interpreter: PowerShell 1 TTPs 14 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 1084 powershell.exe 3824 powershell.exe 4660 powershell.exe 3472 powershell.exe 3808 powershell.exe 1372 powershell.exe 4648 powershell.exe 1604 powershell.exe 1776 powershell.exe 4996 powershell.exe 3156 powershell.exe 2352 powershell.exe 1600 powershell.exe 2328 powershell.exe -
Checks computer location settings 2 TTPs 16 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation sihost.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation sihost.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation sihost.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation DllCommonsvc.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation sihost.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation sihost.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation sihost.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation sihost.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation sihost.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation sihost.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation sihost.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation JaffaCakes118_3afdc1049eae3e0b40d944915e52d52d293b450e150b66b095fde82271501428.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation sihost.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation sihost.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation sihost.exe -
Executes dropped EXE 14 IoCs
pid Process 464 DllCommonsvc.exe 2884 sihost.exe 216 sihost.exe 2964 sihost.exe 4864 sihost.exe 4340 sihost.exe 1724 sihost.exe 4376 sihost.exe 448 sihost.exe 5072 sihost.exe 2760 sihost.exe 4724 sihost.exe 4632 sihost.exe 2252 sihost.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 14 IoCs
flow ioc 14 raw.githubusercontent.com 23 raw.githubusercontent.com 43 raw.githubusercontent.com 53 raw.githubusercontent.com 54 raw.githubusercontent.com 56 raw.githubusercontent.com 13 raw.githubusercontent.com 38 raw.githubusercontent.com 44 raw.githubusercontent.com 45 raw.githubusercontent.com 37 raw.githubusercontent.com 42 raw.githubusercontent.com 52 raw.githubusercontent.com 55 raw.githubusercontent.com -
Drops file in Program Files directory 8 IoCs
description ioc Process File created C:\Program Files (x86)\Windows Media Player\Icons\fontdrvhost.exe DllCommonsvc.exe File created C:\Program Files\Microsoft Office\Updates\Registry.exe DllCommonsvc.exe File created C:\Program Files\Microsoft Office\Updates\ee2ad38f3d4382 DllCommonsvc.exe File created C:\Program Files (x86)\Windows Photo Viewer\fr-FR\winlogon.exe DllCommonsvc.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\fr-FR\winlogon.exe DllCommonsvc.exe File created C:\Program Files (x86)\Windows Photo Viewer\fr-FR\cc11b995f2a76d DllCommonsvc.exe File created C:\Program Files (x86)\Windows Media Player\Skins\System.exe DllCommonsvc.exe File created C:\Program Files (x86)\Windows Media Player\Skins\27d1bcfc3c54e0 DllCommonsvc.exe -
Drops file in Windows directory 6 IoCs
description ioc Process File created C:\Windows\Setup\State\sihost.exe DllCommonsvc.exe File created C:\Windows\Setup\State\66fc9ff0ee96c2 DllCommonsvc.exe File created C:\Windows\es-ES\explorer.exe DllCommonsvc.exe File created C:\Windows\es-ES\7a0fd90576e088 DllCommonsvc.exe File created C:\Windows\Panther\sihost.exe DllCommonsvc.exe File created C:\Windows\Panther\66fc9ff0ee96c2 DllCommonsvc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_3afdc1049eae3e0b40d944915e52d52d293b450e150b66b095fde82271501428.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies registry class 14 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings sihost.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings sihost.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings sihost.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings sihost.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings sihost.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings sihost.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings sihost.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings sihost.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings sihost.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings JaffaCakes118_3afdc1049eae3e0b40d944915e52d52d293b450e150b66b095fde82271501428.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings sihost.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings sihost.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings sihost.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings sihost.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 39 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2256 schtasks.exe 1440 schtasks.exe 1744 schtasks.exe 1152 schtasks.exe 968 schtasks.exe 3440 schtasks.exe 3544 schtasks.exe 2168 schtasks.exe 4564 schtasks.exe 3460 schtasks.exe 1592 schtasks.exe 1588 schtasks.exe 1820 schtasks.exe 3336 schtasks.exe 4060 schtasks.exe 4340 schtasks.exe 4112 schtasks.exe 792 schtasks.exe 4956 schtasks.exe 208 schtasks.exe 2824 schtasks.exe 3348 schtasks.exe 4468 schtasks.exe 5068 schtasks.exe 2964 schtasks.exe 2668 schtasks.exe 1724 schtasks.exe 2584 schtasks.exe 2180 schtasks.exe 4568 schtasks.exe 2300 schtasks.exe 2712 schtasks.exe 2836 schtasks.exe 3864 schtasks.exe 3452 schtasks.exe 2368 schtasks.exe 1760 schtasks.exe 4612 schtasks.exe 4600 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 464 DllCommonsvc.exe 464 DllCommonsvc.exe 464 DllCommonsvc.exe 464 DllCommonsvc.exe 464 DllCommonsvc.exe 464 DllCommonsvc.exe 464 DllCommonsvc.exe 464 DllCommonsvc.exe 464 DllCommonsvc.exe 464 DllCommonsvc.exe 464 DllCommonsvc.exe 464 DllCommonsvc.exe 464 DllCommonsvc.exe 464 DllCommonsvc.exe 464 DllCommonsvc.exe 464 DllCommonsvc.exe 464 DllCommonsvc.exe 464 DllCommonsvc.exe 464 DllCommonsvc.exe 464 DllCommonsvc.exe 464 DllCommonsvc.exe 3808 powershell.exe 3808 powershell.exe 4660 powershell.exe 4660 powershell.exe 2328 powershell.exe 2328 powershell.exe 1372 powershell.exe 1372 powershell.exe 3472 powershell.exe 3472 powershell.exe 4648 powershell.exe 4648 powershell.exe 3824 powershell.exe 3824 powershell.exe 4996 powershell.exe 4996 powershell.exe 1600 powershell.exe 1600 powershell.exe 1084 powershell.exe 1084 powershell.exe 3156 powershell.exe 3156 powershell.exe 2352 powershell.exe 2352 powershell.exe 3472 powershell.exe 1604 powershell.exe 1604 powershell.exe 1776 powershell.exe 1776 powershell.exe 1604 powershell.exe 4996 powershell.exe 3824 powershell.exe 2884 sihost.exe 2884 sihost.exe 3808 powershell.exe 1372 powershell.exe 4660 powershell.exe 2328 powershell.exe 1084 powershell.exe 1600 powershell.exe 1776 powershell.exe 3156 powershell.exe 4648 powershell.exe -
Suspicious use of AdjustPrivilegeToken 28 IoCs
description pid Process Token: SeDebugPrivilege 464 DllCommonsvc.exe Token: SeDebugPrivilege 3808 powershell.exe Token: SeDebugPrivilege 3472 powershell.exe Token: SeDebugPrivilege 4660 powershell.exe Token: SeDebugPrivilege 2328 powershell.exe Token: SeDebugPrivilege 1372 powershell.exe Token: SeDebugPrivilege 4648 powershell.exe Token: SeDebugPrivilege 1776 powershell.exe Token: SeDebugPrivilege 1084 powershell.exe Token: SeDebugPrivilege 3824 powershell.exe Token: SeDebugPrivilege 4996 powershell.exe Token: SeDebugPrivilege 1600 powershell.exe Token: SeDebugPrivilege 3156 powershell.exe Token: SeDebugPrivilege 2352 powershell.exe Token: SeDebugPrivilege 1604 powershell.exe Token: SeDebugPrivilege 2884 sihost.exe Token: SeDebugPrivilege 216 sihost.exe Token: SeDebugPrivilege 2964 sihost.exe Token: SeDebugPrivilege 4864 sihost.exe Token: SeDebugPrivilege 4340 sihost.exe Token: SeDebugPrivilege 1724 sihost.exe Token: SeDebugPrivilege 4376 sihost.exe Token: SeDebugPrivilege 448 sihost.exe Token: SeDebugPrivilege 5072 sihost.exe Token: SeDebugPrivilege 2760 sihost.exe Token: SeDebugPrivilege 4724 sihost.exe Token: SeDebugPrivilege 4632 sihost.exe Token: SeDebugPrivilege 2252 sihost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1524 wrote to memory of 2276 1524 JaffaCakes118_3afdc1049eae3e0b40d944915e52d52d293b450e150b66b095fde82271501428.exe 83 PID 1524 wrote to memory of 2276 1524 JaffaCakes118_3afdc1049eae3e0b40d944915e52d52d293b450e150b66b095fde82271501428.exe 83 PID 1524 wrote to memory of 2276 1524 JaffaCakes118_3afdc1049eae3e0b40d944915e52d52d293b450e150b66b095fde82271501428.exe 83 PID 2276 wrote to memory of 1340 2276 WScript.exe 85 PID 2276 wrote to memory of 1340 2276 WScript.exe 85 PID 2276 wrote to memory of 1340 2276 WScript.exe 85 PID 1340 wrote to memory of 464 1340 cmd.exe 87 PID 1340 wrote to memory of 464 1340 cmd.exe 87 PID 464 wrote to memory of 1604 464 DllCommonsvc.exe 129 PID 464 wrote to memory of 1604 464 DllCommonsvc.exe 129 PID 464 wrote to memory of 3472 464 DllCommonsvc.exe 130 PID 464 wrote to memory of 3472 464 DllCommonsvc.exe 130 PID 464 wrote to memory of 1084 464 DllCommonsvc.exe 131 PID 464 wrote to memory of 1084 464 DllCommonsvc.exe 131 PID 464 wrote to memory of 2352 464 DllCommonsvc.exe 132 PID 464 wrote to memory of 2352 464 DllCommonsvc.exe 132 PID 464 wrote to memory of 3808 464 DllCommonsvc.exe 133 PID 464 wrote to memory of 3808 464 DllCommonsvc.exe 133 PID 464 wrote to memory of 1600 464 DllCommonsvc.exe 134 PID 464 wrote to memory of 1600 464 DllCommonsvc.exe 134 PID 464 wrote to memory of 3824 464 DllCommonsvc.exe 135 PID 464 wrote to memory of 3824 464 DllCommonsvc.exe 135 PID 464 wrote to memory of 1372 464 DllCommonsvc.exe 136 PID 464 wrote to memory of 1372 464 DllCommonsvc.exe 136 PID 464 wrote to memory of 3156 464 DllCommonsvc.exe 137 PID 464 wrote to memory of 3156 464 DllCommonsvc.exe 137 PID 464 wrote to memory of 4660 464 DllCommonsvc.exe 138 PID 464 wrote to memory of 4660 464 DllCommonsvc.exe 138 PID 464 wrote to memory of 4996 464 DllCommonsvc.exe 139 PID 464 wrote to memory of 4996 464 DllCommonsvc.exe 139 PID 464 wrote to memory of 1776 464 DllCommonsvc.exe 140 PID 464 wrote to memory of 1776 464 DllCommonsvc.exe 140 PID 464 wrote to memory of 2328 464 DllCommonsvc.exe 141 PID 464 wrote to memory of 2328 464 DllCommonsvc.exe 141 PID 464 wrote to memory of 4648 464 DllCommonsvc.exe 142 PID 464 wrote to memory of 4648 464 DllCommonsvc.exe 142 PID 464 wrote to memory of 2884 464 DllCommonsvc.exe 157 PID 464 wrote to memory of 2884 464 DllCommonsvc.exe 157 PID 2884 wrote to memory of 3680 2884 sihost.exe 159 PID 2884 wrote to memory of 3680 2884 sihost.exe 159 PID 3680 wrote to memory of 748 3680 cmd.exe 161 PID 3680 wrote to memory of 748 3680 cmd.exe 161 PID 3680 wrote to memory of 216 3680 cmd.exe 167 PID 3680 wrote to memory of 216 3680 cmd.exe 167 PID 216 wrote to memory of 2208 216 sihost.exe 175 PID 216 wrote to memory of 2208 216 sihost.exe 175 PID 2208 wrote to memory of 872 2208 cmd.exe 177 PID 2208 wrote to memory of 872 2208 cmd.exe 177 PID 2208 wrote to memory of 2964 2208 cmd.exe 181 PID 2208 wrote to memory of 2964 2208 cmd.exe 181 PID 2964 wrote to memory of 3120 2964 sihost.exe 184 PID 2964 wrote to memory of 3120 2964 sihost.exe 184 PID 3120 wrote to memory of 4432 3120 cmd.exe 186 PID 3120 wrote to memory of 4432 3120 cmd.exe 186 PID 3120 wrote to memory of 4864 3120 cmd.exe 188 PID 3120 wrote to memory of 4864 3120 cmd.exe 188 PID 4864 wrote to memory of 1364 4864 sihost.exe 190 PID 4864 wrote to memory of 1364 4864 sihost.exe 190 PID 1364 wrote to memory of 3964 1364 cmd.exe 192 PID 1364 wrote to memory of 3964 1364 cmd.exe 192 PID 1364 wrote to memory of 4340 1364 cmd.exe 194 PID 1364 wrote to memory of 4340 1364 cmd.exe 194 PID 4340 wrote to memory of 2852 4340 sihost.exe 196 PID 4340 wrote to memory of 2852 4340 sihost.exe 196 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3afdc1049eae3e0b40d944915e52d52d293b450e150b66b095fde82271501428.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3afdc1049eae3e0b40d944915e52d52d293b450e150b66b095fde82271501428.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1340 -
C:\providercommon\DllCommonsvc.exe"C:\providercommon\DllCommonsvc.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:464 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1604
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Photo Viewer\fr-FR\winlogon.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3472
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Panther\sihost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1084
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\smss.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2352
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Templates\System.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3808
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\Idle.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1600
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\RuntimeBroker.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3824
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\SearchApp.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1372
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Setup\State\sihost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3156
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Media Player\Skins\System.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4660
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\es-ES\explorer.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4996
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\wininit.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1776
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Microsoft Office\Updates\Registry.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2328
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\smss.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4648
-
-
C:\Windows\Setup\State\sihost.exe"C:\Windows\Setup\State\sihost.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\WtQmBjXbDh.bat"6⤵
- Suspicious use of WriteProcessMemory
PID:3680 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:27⤵PID:748
-
-
C:\Windows\Setup\State\sihost.exe"C:\Windows\Setup\State\sihost.exe"7⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:216 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\NjKeWzk8OD.bat"8⤵
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:29⤵PID:872
-
-
C:\Windows\Setup\State\sihost.exe"C:\Windows\Setup\State\sihost.exe"9⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\bbMo3XBCxD.bat"10⤵
- Suspicious use of WriteProcessMemory
PID:3120 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:211⤵PID:4432
-
-
C:\Windows\Setup\State\sihost.exe"C:\Windows\Setup\State\sihost.exe"11⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\eXOrkcF5G0.bat"12⤵
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:213⤵PID:3964
-
-
C:\Windows\Setup\State\sihost.exe"C:\Windows\Setup\State\sihost.exe"13⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\F4MZx53eLu.bat"14⤵PID:2852
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:215⤵PID:2632
-
-
C:\Windows\Setup\State\sihost.exe"C:\Windows\Setup\State\sihost.exe"15⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1724 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\yMeEqlK1gO.bat"16⤵PID:3612
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:217⤵PID:4912
-
-
C:\Windows\Setup\State\sihost.exe"C:\Windows\Setup\State\sihost.exe"17⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4376 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\NjKeWzk8OD.bat"18⤵PID:1292
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:219⤵PID:1132
-
-
C:\Windows\Setup\State\sihost.exe"C:\Windows\Setup\State\sihost.exe"19⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:448 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\TdlfhXh7Yo.bat"20⤵PID:5004
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:221⤵PID:3156
-
-
C:\Windows\Setup\State\sihost.exe"C:\Windows\Setup\State\sihost.exe"21⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:5072 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\0IgHXqOu0A.bat"22⤵PID:2496
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:223⤵PID:2352
-
-
C:\Windows\Setup\State\sihost.exe"C:\Windows\Setup\State\sihost.exe"23⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2760 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\gTQuRhIyam.bat"24⤵PID:4108
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:225⤵PID:1352
-
-
C:\Windows\Setup\State\sihost.exe"C:\Windows\Setup\State\sihost.exe"25⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4724 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\uVa8TbDE3p.bat"26⤵PID:1916
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:227⤵PID:1756
-
-
C:\Windows\Setup\State\sihost.exe"C:\Windows\Setup\State\sihost.exe"27⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4632 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ZgKlNS7JdR.bat"28⤵PID:3572
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:229⤵PID:380
-
-
C:\Windows\Setup\State\sihost.exe"C:\Windows\Setup\State\sihost.exe"29⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2252 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\8xeM6k5O3T.bat"30⤵PID:3452
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:231⤵PID:4736
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Photo Viewer\fr-FR\winlogon.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4468
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\fr-FR\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3864
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Photo Viewer\fr-FR\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1592
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihosts" /sc MINUTE /mo 8 /tr "'C:\Windows\Panther\sihost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5068
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Windows\Panther\sihost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:968
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihosts" /sc MINUTE /mo 8 /tr "'C:\Windows\Panther\sihost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2256
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\providercommon\smss.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4060
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\providercommon\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4340
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 7 /tr "'C:\providercommon\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1440
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'C:\Users\Default\Templates\System.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2584
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Users\Default\Templates\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2964
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'C:\Users\Default\Templates\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3440
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 10 /tr "'C:\providercommon\Idle.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3544
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\providercommon\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2180
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 9 /tr "'C:\providercommon\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4568
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2300
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2668
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2824
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 7 /tr "'C:\Users\Default User\SearchApp.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3348
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Users\Default User\SearchApp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2168
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 8 /tr "'C:\Users\Default User\SearchApp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2712
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihosts" /sc MINUTE /mo 12 /tr "'C:\Windows\Setup\State\sihost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4112
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Windows\Setup\State\sihost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2836
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihosts" /sc MINUTE /mo 9 /tr "'C:\Windows\Setup\State\sihost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1588
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Media Player\Skins\System.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1744
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\Skins\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1820
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Media Player\Skins\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:792
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\Windows\es-ES\explorer.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3336
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\es-ES\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3452
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 9 /tr "'C:\Windows\es-ES\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4956
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\wininit.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2368
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\wininit.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1760
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\wininit.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:208
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 13 /tr "'C:\Program Files\Microsoft Office\Updates\Registry.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4564
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\Updates\Registry.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4612
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 12 /tr "'C:\Program Files\Microsoft Office\Updates\Registry.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1724
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\smss.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1152
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4600
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3460
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5a43e653ffb5ab07940f4bdd9cc8fade4
SHA1af43d04e3427f111b22dc891c5c7ee8a10ac4123
SHA256c4c53abb13e99475aebfbe9fec7a8fead81c14c80d9dcc2b81375304f3a683fe
SHA51262a97e95e1f19a8d4302847110dae44f469877eed6aa8ea22345c6eb25ee220e7d310fa0b7ec5df42356815421c0af7c46a0f1fee8933cc446641800eda6cd1b
-
Filesize
1KB
MD5baf55b95da4a601229647f25dad12878
SHA1abc16954ebfd213733c4493fc1910164d825cac8
SHA256ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
SHA51224f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545
-
Filesize
944B
MD519e3446e5131ffc8654c075ae8beda24
SHA1bc85831fdbfdf20f74929bbad25aeaddf8d1dfb1
SHA2561b407adb428381b328c00a5dc3f2817cfa6a88f8d7566aea0ef2638ad05f611d
SHA5126a190badc5d0f1b16a4b428336cf33d75a1169c526a3682611265b7f1d577632bbbd869db34f421cfb73a380dbabd539d41365921bec658746f58799bf323fc2
-
Filesize
944B
MD53a6bad9528f8e23fb5c77fbd81fa28e8
SHA1f127317c3bc6407f536c0f0600dcbcf1aabfba36
SHA256986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05
SHA512846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2
-
Filesize
944B
MD5d28a889fd956d5cb3accfbaf1143eb6f
SHA1157ba54b365341f8ff06707d996b3635da8446f7
SHA25621e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45
SHA5120b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c
-
Filesize
944B
MD559d97011e091004eaffb9816aa0b9abd
SHA11602a56b01dd4b7c577ca27d3117e4bcc1aa657b
SHA25618f381e0db020a763b8c515c346ef58679ab9c403267eacfef5359e272f7e71d
SHA512d9ca49c1a17580981e2c1a50d73c0eecaa7a62f8514741512172e395af2a3d80aeb0f71c58bc7f52c18246d57ba67af09b6bff4776877d6cc6f0245c30e092d6
-
Filesize
944B
MD5ecceac16628651c18879d836acfcb062
SHA1420502b3e5220a01586c59504e94aa1ee11982c9
SHA25658238de09a8817ed9f894ed8e5bf06a897fd08e0b0bd77e508d37b2598edd2a9
SHA512be3c7cb529cafb00f58790a6f8b35c4ff6db9f7f43a507d2218fd80cebc88413e46f71b1bc35b8afcc36b68f9409c946470d1e74a4fe225400eeb6f3f898f5b3
-
Filesize
435B
MD58a40d348bf315972a387714e9e0bd0be
SHA134bbd64f14781e2498ebd7504f82e92cc4f5193d
SHA25622c7b5a70e0d24a779732e5144ad2689c8ae8770082b074704e5dedbc0f64b97
SHA5122d0dd1fcfc82a9a5ed33a38223841194dbff9e1c8b427bca9a6ea37f739abbe735daffb6588d041d78a71cf08314516b818f874b8e0995fe81b7061c116be56a
-
Filesize
198B
MD5a43066e89e489d5c179e0d85185fd5de
SHA1be6d54e78ebda89e830c45b798d86c04f04458da
SHA2566dfaac4a979fae3b0db0c23122fc9e1643061c126c51105461ebfffeb84307ee
SHA5127b17023d3477446fe33f7aeb04e9346b29248ef84ee0e73df7aae78121d6b9aa2370fa779d45bff2b9fa5e8de919682bbee8abe8a7058f10fd68198a8d1c7e72
-
Filesize
198B
MD55db1b7791ebe6d75891c58916fcc8180
SHA1b9f6d79df2d66fa289fb68023c6c019bcd119767
SHA256fff0697b780035b7a680824119ec495ced6ffc5ffded3d159efc712236450517
SHA5129fc80088a4269f26c28f009ec976d811de0f130c270e66a11758c07a1cf3eba6333af0ee1c1fbfd92cc6cfc7825e1fbb75cb5a7d569a893895ff6c2dcf2c6da1
-
Filesize
198B
MD5e057a94232b3e40d80f44624503aaa67
SHA1ecc70b8193b1f88bd928d363efac37910ac798d1
SHA25618f5cb4418007e4f49f62c4a62d82742b4d74d79f1bcdbc506f742a219f59255
SHA512a0f19f46e67ed173d6f1873466ffa402e4881a2ba7b848d55132a09b076ae5aa572c291525829a05cccc7c5867e56201f24ab108ad4eb3c1dfe4780f0c842ee3
-
Filesize
198B
MD5110e23735d7f41c8127870e64c7c4088
SHA172d1b351e307d88dd64eb5eb3e0943f4c1a7114c
SHA256f87071e146aa58a875f827e73111d2314f6c3f7e2a4de71fbae5ff431556dbaf
SHA51206f9112598a4902c926254fcb7054af07f9d9e12e7631f8fe43fc4b965d6501c23f95fbaf6eef378ccbcf4e9188c497d1888dc938ef206375c4604f88ea35da4
-
Filesize
198B
MD5f2d522ebfdf9def2221980e4147b8768
SHA1124b1eef293a2eaba0ce40cd5fed8b3023a02517
SHA2562a83a8c201be85aa60df3542859ad40b4b43cae11bca4af93e3a910b15a76e69
SHA512c6a2de077dfbad510ad36a5b4a8977c66134862598e37e93a91d4574894d453823679f804988013152b562536c3720112cc10e6875aa0662218967d84346dee1
-
Filesize
198B
MD53efe2183c00a7c31809e991efa9e2be6
SHA1044aca37d65e0d23f0b7758c337e419d939f9858
SHA2568ba09f6c0518e9040097652091415096c6f940cc113c6dcd2c8fe0fde04049f2
SHA51225076f0658284ab703ffe18a37e1d22ce641c1580d7dceac691fe0020b6ae139aa23fe58da7ef5e239df4736cc781520b681e4fe009d4252af96c122665e77c4
-
Filesize
198B
MD5219f4bacd8a5c004ff42673394293e0f
SHA13f4560633b21b904023018d63f313dacd473de91
SHA256d1bd11cb8755fb34a4683c492bae2dc9b513c397b192f9f276d1d7b6b651269b
SHA512added2d1cbef969b9b83b1be979e78fed4f9f12e81747ef18061c5e6a028e326528000ec5ebd2958128dd8a1c0c039c118fd2c8d345364a39bb64fdddb90fa7d
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
198B
MD53cb30be8b19df501f4b3038a3b9336de
SHA17429d63e734e0500e401d95996a6319ccabad41f
SHA2565d293d7305afbdedaf8006f4bf2f7c68f1a262d058e5c55482e1159b14ccc69b
SHA5126140702ac86d059064eb5dd704eb835ef88bd101b0a81c1cebc80e9e6a7b828ef2afac829f380f3467a40f9f297832629046050bf6924a59752e74639fe85cda
-
Filesize
198B
MD57fa4264c40af24019c39002264cb59fe
SHA15facd98b37ee7b63ab7417503170f89d982cf320
SHA25616e00bf647871769747cacf25633f02eaf0e716ebc8a89f8b81e3d664eba5dbb
SHA5121a6cdf307dfce7875f1c9a2d236dec874ccf6cd857a5ad80ae7eeff5428fb540b17779fd08b955618aca225ccb9cea6d4bb4415ec2e9381e34718ad268cd82f4
-
Filesize
198B
MD56d271438af242016dcf3502dfbe2747c
SHA15f243ecdfdedb7bb043e402badc23cb2f1d61494
SHA256cd52723adf0a9c4e6ffb5921b6869b374f8205c1ae84b3c2911638aec7be2028
SHA5126625a9c45885fb0377de8f3c3a4f5ef6c78ddd96a40f264cda9152e15a3274f41ac6f2efd544fa453fd4a769ad6fcdc517f2c0560a2acf88d293c940b75e4f6c
-
Filesize
198B
MD5eca9c4c1466a045ca24ff1600a80401a
SHA1b8ccbaefaeeea4bb4bb13676c276a67b1e81ea5f
SHA25664c570a1747a38b148697e4e6c2ff5ef5b5c2cc2a6f094b45b1481a261ce1633
SHA5123d84f2641ed4a8d8a454bfce409ca1b452f098ac966af17093890df70db0fc6ae0c0ce15b4812f74bfba1f3b56af86293d2812c60fa321e7840ed1da2e3de18e
-
Filesize
198B
MD5ae47780bb1d07d615304610d621e794a
SHA174161d585509d5694fd3f96b3df34a0a08a4aa9a
SHA2569d6c213e04b8d1f0d0864546d3b709c63ca3c6dc767166d7ccc105ce3fc62648
SHA512451e720680a10fd62d51d57291689c741b0eab0beb925bff5c2294862396b7f4df2c4ba78b021cd18e56d40c702a50f8d8ea615a462cb900c00768b3f342df9a
-
Filesize
36B
MD56783c3ee07c7d151ceac57f1f9c8bed7
SHA117468f98f95bf504cc1f83c49e49a78526b3ea03
SHA2568ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322
SHA512c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8
-
Filesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
Filesize
197B
MD58088241160261560a02c84025d107592
SHA1083121f7027557570994c9fc211df61730455bb5
SHA2562072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1
SHA51220d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478