Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2024, 17:17
Behavioral task
behavioral1
Sample
JaffaCakes118_5e218f93ff7c0f24a3d39b6ecb07d850d8b144f2ca610b2e543e0448c1993cf6.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
JaffaCakes118_5e218f93ff7c0f24a3d39b6ecb07d850d8b144f2ca610b2e543e0448c1993cf6.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_5e218f93ff7c0f24a3d39b6ecb07d850d8b144f2ca610b2e543e0448c1993cf6.exe
-
Size
1.3MB
-
MD5
aa32aecefe43d28a45894c3ef3c49b8a
-
SHA1
7dfdff161eb2bd11a1445091caa7c32752d3320e
-
SHA256
5e218f93ff7c0f24a3d39b6ecb07d850d8b144f2ca610b2e543e0448c1993cf6
-
SHA512
4ad6a52db6664aaad9a59640d4bd48d331fecb7cecee5b0aa65afbcfcc9809ac1c3a66ccf66ecd68e108b7d8e07b39e90304e7ffa3f01445f8a06429bfe31b61
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Process spawned unexpected child process 33 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3952 3384 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3840 3384 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 536 3384 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4868 3384 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4328 3384 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1196 3384 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2400 3384 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4088 3384 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4572 3384 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4948 3384 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3740 3384 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2456 3384 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4444 3384 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4456 3384 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3788 3384 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4864 3384 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3488 3384 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3260 3384 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1736 3384 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4152 3384 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1604 3384 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4092 3384 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4428 3384 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3468 3384 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1120 3384 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5048 3384 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3752 3384 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4460 3384 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2520 3384 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4068 3384 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4760 3384 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3624 3384 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5072 3384 schtasks.exe 90 -
resource yara_rule behavioral2/files/0x0007000000023c66-10.dat dcrat behavioral2/memory/2296-13-0x0000000000330000-0x0000000000440000-memory.dmp dcrat -
Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 4964 powershell.exe 2368 powershell.exe 4488 powershell.exe 648 powershell.exe 3412 powershell.exe 4676 powershell.exe 4420 powershell.exe 3500 powershell.exe 3192 powershell.exe 4244 powershell.exe 2468 powershell.exe 1412 powershell.exe -
Checks computer location settings 2 TTPs 18 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation JaffaCakes118_5e218f93ff7c0f24a3d39b6ecb07d850d8b144f2ca610b2e543e0448c1993cf6.exe Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation DllCommonsvc.exe Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation cmd.exe Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation cmd.exe Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation cmd.exe Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation cmd.exe Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation cmd.exe Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation cmd.exe Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation cmd.exe Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation cmd.exe Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation cmd.exe Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation cmd.exe Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation cmd.exe Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation cmd.exe Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation cmd.exe Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation cmd.exe Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation cmd.exe -
Executes dropped EXE 16 IoCs
pid Process 2296 DllCommonsvc.exe 4172 cmd.exe 4548 cmd.exe 820 cmd.exe 4540 cmd.exe 1788 cmd.exe 4844 cmd.exe 3444 cmd.exe 2348 cmd.exe 3720 cmd.exe 1536 cmd.exe 2400 cmd.exe 3420 cmd.exe 1372 cmd.exe 3964 cmd.exe 3692 cmd.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 16 IoCs
flow ioc 24 raw.githubusercontent.com 39 raw.githubusercontent.com 46 raw.githubusercontent.com 55 raw.githubusercontent.com 40 raw.githubusercontent.com 41 raw.githubusercontent.com 42 raw.githubusercontent.com 54 raw.githubusercontent.com 59 raw.githubusercontent.com 17 raw.githubusercontent.com 52 raw.githubusercontent.com 53 raw.githubusercontent.com 51 raw.githubusercontent.com 16 raw.githubusercontent.com 25 raw.githubusercontent.com 45 raw.githubusercontent.com -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\it\Registry.exe DllCommonsvc.exe File created C:\Windows\SysWOW64\it\ee2ad38f3d4382 DllCommonsvc.exe -
Drops file in Program Files directory 4 IoCs
description ioc Process File created C:\Program Files (x86)\Windows Media Player\uk-UA\cmd.exe DllCommonsvc.exe File created C:\Program Files (x86)\Windows Media Player\uk-UA\ebf1f9fa8afd6d DllCommonsvc.exe File created C:\Program Files\Windows Security\csrss.exe DllCommonsvc.exe File created C:\Program Files\Windows Security\886983d96e3d3e DllCommonsvc.exe -
Drops file in Windows directory 5 IoCs
description ioc Process File created C:\Windows\TAPI\27d1bcfc3c54e0 DllCommonsvc.exe File created C:\Windows\OCR\fr-fr\smss.exe DllCommonsvc.exe File created C:\Windows\Migration\WTR\dllhost.exe DllCommonsvc.exe File created C:\Windows\Migration\WTR\5940a34987c991 DllCommonsvc.exe File created C:\Windows\TAPI\System.exe DllCommonsvc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_5e218f93ff7c0f24a3d39b6ecb07d850d8b144f2ca610b2e543e0448c1993cf6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies registry class 16 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings JaffaCakes118_5e218f93ff7c0f24a3d39b6ecb07d850d8b144f2ca610b2e543e0448c1993cf6.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings cmd.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 33 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3952 schtasks.exe 2400 schtasks.exe 4088 schtasks.exe 3260 schtasks.exe 4068 schtasks.exe 5072 schtasks.exe 4864 schtasks.exe 3488 schtasks.exe 3788 schtasks.exe 4092 schtasks.exe 3468 schtasks.exe 1120 schtasks.exe 3840 schtasks.exe 4868 schtasks.exe 1196 schtasks.exe 3740 schtasks.exe 4760 schtasks.exe 3624 schtasks.exe 4328 schtasks.exe 4948 schtasks.exe 1736 schtasks.exe 3752 schtasks.exe 1604 schtasks.exe 4460 schtasks.exe 5048 schtasks.exe 536 schtasks.exe 2456 schtasks.exe 4444 schtasks.exe 4428 schtasks.exe 4572 schtasks.exe 4456 schtasks.exe 4152 schtasks.exe 2520 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2296 DllCommonsvc.exe 2296 DllCommonsvc.exe 2296 DllCommonsvc.exe 2296 DllCommonsvc.exe 2296 DllCommonsvc.exe 2296 DllCommonsvc.exe 2296 DllCommonsvc.exe 2296 DllCommonsvc.exe 2296 DllCommonsvc.exe 2296 DllCommonsvc.exe 2296 DllCommonsvc.exe 2296 DllCommonsvc.exe 2296 DllCommonsvc.exe 2296 DllCommonsvc.exe 2296 DllCommonsvc.exe 2296 DllCommonsvc.exe 2296 DllCommonsvc.exe 2296 DllCommonsvc.exe 2296 DllCommonsvc.exe 2296 DllCommonsvc.exe 3500 powershell.exe 3500 powershell.exe 1412 powershell.exe 1412 powershell.exe 2368 powershell.exe 2368 powershell.exe 3412 powershell.exe 3412 powershell.exe 4676 powershell.exe 4676 powershell.exe 4488 powershell.exe 4488 powershell.exe 648 powershell.exe 648 powershell.exe 3192 powershell.exe 3192 powershell.exe 4420 powershell.exe 4420 powershell.exe 2468 powershell.exe 2468 powershell.exe 4244 powershell.exe 4244 powershell.exe 4964 powershell.exe 4964 powershell.exe 4244 powershell.exe 4172 cmd.exe 4172 cmd.exe 3500 powershell.exe 3412 powershell.exe 3192 powershell.exe 2468 powershell.exe 1412 powershell.exe 2368 powershell.exe 4420 powershell.exe 4488 powershell.exe 4676 powershell.exe 648 powershell.exe 4964 powershell.exe 4548 cmd.exe 820 cmd.exe 4540 cmd.exe 1788 cmd.exe 4844 cmd.exe 3444 cmd.exe -
Suspicious use of AdjustPrivilegeToken 28 IoCs
description pid Process Token: SeDebugPrivilege 2296 DllCommonsvc.exe Token: SeDebugPrivilege 3500 powershell.exe Token: SeDebugPrivilege 1412 powershell.exe Token: SeDebugPrivilege 2368 powershell.exe Token: SeDebugPrivilege 3192 powershell.exe Token: SeDebugPrivilege 3412 powershell.exe Token: SeDebugPrivilege 4676 powershell.exe Token: SeDebugPrivilege 4488 powershell.exe Token: SeDebugPrivilege 4420 powershell.exe Token: SeDebugPrivilege 648 powershell.exe Token: SeDebugPrivilege 2468 powershell.exe Token: SeDebugPrivilege 4244 powershell.exe Token: SeDebugPrivilege 4964 powershell.exe Token: SeDebugPrivilege 4172 cmd.exe Token: SeDebugPrivilege 4548 cmd.exe Token: SeDebugPrivilege 820 cmd.exe Token: SeDebugPrivilege 4540 cmd.exe Token: SeDebugPrivilege 1788 cmd.exe Token: SeDebugPrivilege 4844 cmd.exe Token: SeDebugPrivilege 3444 cmd.exe Token: SeDebugPrivilege 2348 cmd.exe Token: SeDebugPrivilege 3720 cmd.exe Token: SeDebugPrivilege 1536 cmd.exe Token: SeDebugPrivilege 2400 cmd.exe Token: SeDebugPrivilege 3420 cmd.exe Token: SeDebugPrivilege 1372 cmd.exe Token: SeDebugPrivilege 3964 cmd.exe Token: SeDebugPrivilege 3692 cmd.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 820 wrote to memory of 4424 820 JaffaCakes118_5e218f93ff7c0f24a3d39b6ecb07d850d8b144f2ca610b2e543e0448c1993cf6.exe 83 PID 820 wrote to memory of 4424 820 JaffaCakes118_5e218f93ff7c0f24a3d39b6ecb07d850d8b144f2ca610b2e543e0448c1993cf6.exe 83 PID 820 wrote to memory of 4424 820 JaffaCakes118_5e218f93ff7c0f24a3d39b6ecb07d850d8b144f2ca610b2e543e0448c1993cf6.exe 83 PID 4424 wrote to memory of 2840 4424 WScript.exe 85 PID 4424 wrote to memory of 2840 4424 WScript.exe 85 PID 4424 wrote to memory of 2840 4424 WScript.exe 85 PID 2840 wrote to memory of 2296 2840 cmd.exe 87 PID 2840 wrote to memory of 2296 2840 cmd.exe 87 PID 2296 wrote to memory of 4964 2296 DllCommonsvc.exe 125 PID 2296 wrote to memory of 4964 2296 DllCommonsvc.exe 125 PID 2296 wrote to memory of 4676 2296 DllCommonsvc.exe 126 PID 2296 wrote to memory of 4676 2296 DllCommonsvc.exe 126 PID 2296 wrote to memory of 4420 2296 DllCommonsvc.exe 127 PID 2296 wrote to memory of 4420 2296 DllCommonsvc.exe 127 PID 2296 wrote to memory of 2368 2296 DllCommonsvc.exe 128 PID 2296 wrote to memory of 2368 2296 DllCommonsvc.exe 128 PID 2296 wrote to memory of 3500 2296 DllCommonsvc.exe 129 PID 2296 wrote to memory of 3500 2296 DllCommonsvc.exe 129 PID 2296 wrote to memory of 3192 2296 DllCommonsvc.exe 130 PID 2296 wrote to memory of 3192 2296 DllCommonsvc.exe 130 PID 2296 wrote to memory of 4488 2296 DllCommonsvc.exe 131 PID 2296 wrote to memory of 4488 2296 DllCommonsvc.exe 131 PID 2296 wrote to memory of 4244 2296 DllCommonsvc.exe 132 PID 2296 wrote to memory of 4244 2296 DllCommonsvc.exe 132 PID 2296 wrote to memory of 2468 2296 DllCommonsvc.exe 133 PID 2296 wrote to memory of 2468 2296 DllCommonsvc.exe 133 PID 2296 wrote to memory of 648 2296 DllCommonsvc.exe 134 PID 2296 wrote to memory of 648 2296 DllCommonsvc.exe 134 PID 2296 wrote to memory of 3412 2296 DllCommonsvc.exe 135 PID 2296 wrote to memory of 3412 2296 DllCommonsvc.exe 135 PID 2296 wrote to memory of 1412 2296 DllCommonsvc.exe 136 PID 2296 wrote to memory of 1412 2296 DllCommonsvc.exe 136 PID 2296 wrote to memory of 4172 2296 DllCommonsvc.exe 148 PID 2296 wrote to memory of 4172 2296 DllCommonsvc.exe 148 PID 4172 wrote to memory of 4064 4172 cmd.exe 152 PID 4172 wrote to memory of 4064 4172 cmd.exe 152 PID 4064 wrote to memory of 4856 4064 cmd.exe 154 PID 4064 wrote to memory of 4856 4064 cmd.exe 154 PID 4064 wrote to memory of 4548 4064 cmd.exe 158 PID 4064 wrote to memory of 4548 4064 cmd.exe 158 PID 4548 wrote to memory of 3816 4548 cmd.exe 164 PID 4548 wrote to memory of 3816 4548 cmd.exe 164 PID 3816 wrote to memory of 2148 3816 cmd.exe 166 PID 3816 wrote to memory of 2148 3816 cmd.exe 166 PID 3816 wrote to memory of 820 3816 cmd.exe 168 PID 3816 wrote to memory of 820 3816 cmd.exe 168 PID 820 wrote to memory of 988 820 cmd.exe 170 PID 820 wrote to memory of 988 820 cmd.exe 170 PID 988 wrote to memory of 4596 988 cmd.exe 172 PID 988 wrote to memory of 4596 988 cmd.exe 172 PID 988 wrote to memory of 4540 988 cmd.exe 176 PID 988 wrote to memory of 4540 988 cmd.exe 176 PID 4540 wrote to memory of 3196 4540 cmd.exe 179 PID 4540 wrote to memory of 3196 4540 cmd.exe 179 PID 3196 wrote to memory of 4544 3196 cmd.exe 181 PID 3196 wrote to memory of 4544 3196 cmd.exe 181 PID 3196 wrote to memory of 1788 3196 cmd.exe 183 PID 3196 wrote to memory of 1788 3196 cmd.exe 183 PID 1788 wrote to memory of 2560 1788 cmd.exe 185 PID 1788 wrote to memory of 2560 1788 cmd.exe 185 PID 2560 wrote to memory of 4348 2560 cmd.exe 187 PID 2560 wrote to memory of 4348 2560 cmd.exe 187 PID 2560 wrote to memory of 4844 2560 cmd.exe 189 PID 2560 wrote to memory of 4844 2560 cmd.exe 189 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5e218f93ff7c0f24a3d39b6ecb07d850d8b144f2ca610b2e543e0448c1993cf6.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5e218f93ff7c0f24a3d39b6ecb07d850d8b144f2ca610b2e543e0448c1993cf6.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:820 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4424 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\providercommon\DllCommonsvc.exe"C:\providercommon\DllCommonsvc.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4964
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\SearchApp.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4676
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\RuntimeBroker.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4420
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\cmd.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2368
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\TAPI\System.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3500
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\SysWOW64\it\Registry.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3192
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Media Player\uk-UA\cmd.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4488
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Security\csrss.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4244
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Recent\WaaSMedicAgent.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2468
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\RuntimeBroker.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:648
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\RuntimeBroker.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3412
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Migration\WTR\dllhost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1412
-
-
C:\Recovery\WindowsRE\cmd.exe"C:\Recovery\WindowsRE\cmd.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4172 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\kNGCBu7dv8.bat"6⤵
- Suspicious use of WriteProcessMemory
PID:4064 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:27⤵PID:4856
-
-
C:\Recovery\WindowsRE\cmd.exe"C:\Recovery\WindowsRE\cmd.exe"7⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\s2EHkno7yQ.bat"8⤵
- Suspicious use of WriteProcessMemory
PID:3816 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:29⤵PID:2148
-
-
C:\Recovery\WindowsRE\cmd.exe"C:\Recovery\WindowsRE\cmd.exe"9⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:820 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\BmKXfVMxAz.bat"10⤵
- Suspicious use of WriteProcessMemory
PID:988 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:211⤵PID:4596
-
-
C:\Recovery\WindowsRE\cmd.exe"C:\Recovery\WindowsRE\cmd.exe"11⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\cOf3pucYXi.bat"12⤵
- Suspicious use of WriteProcessMemory
PID:3196 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:213⤵PID:4544
-
-
C:\Recovery\WindowsRE\cmd.exe"C:\Recovery\WindowsRE\cmd.exe"13⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\RdAvGBYmjZ.bat"14⤵
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:215⤵PID:4348
-
-
C:\Recovery\WindowsRE\cmd.exe"C:\Recovery\WindowsRE\cmd.exe"15⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4844 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\eKh6VzgSrU.bat"16⤵PID:2980
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:217⤵PID:4440
-
-
C:\Recovery\WindowsRE\cmd.exe"C:\Recovery\WindowsRE\cmd.exe"17⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3444 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\YXbxSkVmu9.bat"18⤵PID:2580
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:219⤵PID:532
-
-
C:\Recovery\WindowsRE\cmd.exe"C:\Recovery\WindowsRE\cmd.exe"19⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2348 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\00pP7nIBMq.bat"20⤵PID:4420
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:221⤵PID:2356
-
-
C:\Recovery\WindowsRE\cmd.exe"C:\Recovery\WindowsRE\cmd.exe"21⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3720 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Ph8sa6VtQm.bat"22⤵PID:3852
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:223⤵PID:960
-
-
C:\Recovery\WindowsRE\cmd.exe"C:\Recovery\WindowsRE\cmd.exe"23⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1536 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\DiMaLaQqUm.bat"24⤵PID:3672
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:225⤵PID:1684
-
-
C:\Recovery\WindowsRE\cmd.exe"C:\Recovery\WindowsRE\cmd.exe"25⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2400 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\xEvQv3iUx6.bat"26⤵PID:4672
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:227⤵PID:2284
-
-
C:\Recovery\WindowsRE\cmd.exe"C:\Recovery\WindowsRE\cmd.exe"27⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3420 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\CrTeqwt2Oo.bat"28⤵PID:3820
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:229⤵PID:4908
-
-
C:\Recovery\WindowsRE\cmd.exe"C:\Recovery\WindowsRE\cmd.exe"29⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1372 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\eKh6VzgSrU.bat"30⤵PID:2776
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:231⤵PID:2268
-
-
C:\Recovery\WindowsRE\cmd.exe"C:\Recovery\WindowsRE\cmd.exe"31⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3964 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\D2zd9hDRps.bat"32⤵PID:5016
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:233⤵PID:2208
-
-
C:\Recovery\WindowsRE\cmd.exe"C:\Recovery\WindowsRE\cmd.exe"33⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3692 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\4stVUxPy0P.bat"34⤵PID:2388
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:235⤵PID:1364
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3952
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3840
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:536
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\providercommon\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4868
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\providercommon\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4328
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\providercommon\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1196
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "cmdc" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\cmd.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2400
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\cmd.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4088
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "cmdc" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\cmd.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4572
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'C:\Windows\TAPI\System.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4948
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Windows\TAPI\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3740
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 9 /tr "'C:\Windows\TAPI\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2456
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 13 /tr "'C:\Windows\SysWOW64\it\Registry.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4444
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Windows\SysWOW64\it\Registry.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4456
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 12 /tr "'C:\Windows\SysWOW64\it\Registry.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3788
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "cmdc" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Media Player\uk-UA\cmd.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4864
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\uk-UA\cmd.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3488
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "cmdc" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Media Player\uk-UA\cmd.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3260
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Security\csrss.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1736
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Windows Security\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4152
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Security\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1604
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 9 /tr "'C:\Users\Default\Recent\WaaSMedicAgent.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4092
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WaaSMedicAgent" /sc ONLOGON /tr "'C:\Users\Default\Recent\WaaSMedicAgent.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4428
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 8 /tr "'C:\Users\Default\Recent\WaaSMedicAgent.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3468
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\providercommon\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1120
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\providercommon\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5048
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\providercommon\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3752
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\providercommon\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4460
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\providercommon\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2520
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\providercommon\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4068
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Windows\Migration\WTR\dllhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4760
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\Migration\WTR\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3624
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\Windows\Migration\WTR\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5072
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5baf55b95da4a601229647f25dad12878
SHA1abc16954ebfd213733c4493fc1910164d825cac8
SHA256ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
SHA51224f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD56d3e9c29fe44e90aae6ed30ccf799ca8
SHA1c7974ef72264bbdf13a2793ccf1aed11bc565dce
SHA2562360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d
SHA51260c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a
-
Filesize
944B
MD56d42b6da621e8df5674e26b799c8e2aa
SHA1ab3ce1327ea1eeedb987ec823d5e0cb146bafa48
SHA2565ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c
SHA51253faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29
-
Filesize
944B
MD5bd5940f08d0be56e65e5f2aaf47c538e
SHA1d7e31b87866e5e383ab5499da64aba50f03e8443
SHA2562d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6
SHA512c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406
-
Filesize
944B
MD559d97011e091004eaffb9816aa0b9abd
SHA11602a56b01dd4b7c577ca27d3117e4bcc1aa657b
SHA25618f381e0db020a763b8c515c346ef58679ab9c403267eacfef5359e272f7e71d
SHA512d9ca49c1a17580981e2c1a50d73c0eecaa7a62f8514741512172e395af2a3d80aeb0f71c58bc7f52c18246d57ba67af09b6bff4776877d6cc6f0245c30e092d6
-
Filesize
944B
MD5e243a38635ff9a06c87c2a61a2200656
SHA1ecd95ed5bf1a9fbe96a8448fc2814a0210fa2afc
SHA256af5782703f3f2d5a29fb313dae6680a64134db26064d4a321a3f23b75f6ca00f
SHA5124418957a1b10eee44cf270c81816ae707352411c4f5ac14b6b61ab537c91480e24e0a0a2c276a6291081b4984c123cf673a45dcedb0ceeef682054ba0fc19cb4
-
Filesize
944B
MD5e448fe0d240184c6597a31d3be2ced58
SHA1372b8d8c19246d3e38cd3ba123cc0f56070f03cd
SHA256c660f0db85a1e7f0f68db19868979bf50bd541531babf77a701e1b1ce5e6a391
SHA5120b7f7eae7700d32b18eee3677cb7f89b46ace717fa7e6b501d6c47d54f15dff7e12b49f5a7d36a6ffe4c16165c7d55162db4f3621db545b6af638035752beab4
-
Filesize
944B
MD5cadef9abd087803c630df65264a6c81c
SHA1babbf3636c347c8727c35f3eef2ee643dbcc4bd2
SHA256cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438
SHA5127278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085
-
Filesize
194B
MD5905ac9b6e6adce34e432e0b669d021d0
SHA170d1095c383fa052a8e2d3695cfb6bf5ecf1a418
SHA256f40777327a957f9f4428229843aec194cdf9e3df8131692ad7b8696f96b6b1ac
SHA5120eb612508b3af7d7cd253e3e097e6fbc259fe7087a6511bed31e90596d3c2231156ebb3db2b16da6bd85b711a676b1a99746bd96ca3de662443e2ba90adea9a2
-
Filesize
194B
MD52fa01fa5cb3ff55559baf87b47130685
SHA1d6d09e2a26e0f80d19172f3ed8a5778d12d02701
SHA25640724291df025ddc1877563bedbac617b4b62281418fbb40ac8dbec921dd3029
SHA512f5455419caf85046750d76e6c231be73e1c921a9da17b7a1f1fd3e71806f71c3f4e28bfd49336f6aa21a96cfe6eae8bedd27010a9616f11863258d9d4284f137
-
Filesize
194B
MD5c7157d71c1dc4fcc7a79f9b82d5f6d07
SHA14516066ed7a59ea0ac9cc50723200ec1d46aa78a
SHA256d02f0530c1c252f8d3ed132d8b581c364a27b3d0ab319ad897c678d14d1854b3
SHA51219b4eb0ad76e17e334c93322ec55baa4769b4f00d67d0b4a34c2df81850cccbf6297edba98e5f4f943b28d6d17c718746be34577821e15e4ff4836ad2a233cb7
-
Filesize
194B
MD57f44837ea3234a8b47c2b8e44e886f67
SHA17308ad46560732d99de815a715cdc75e5b354924
SHA25616f19cd094d0897642188e0e02aa38ef0870f99ab2b8dfb39ea87babea56a56b
SHA5121c95619ff50b31457a49dada1a28edbd48efed6ad6165a293c778700969ce25cb35f4c4705aee53149df72dbcc7a58d6bd2cdd5dc0b193dbf7300160bca8108b
-
Filesize
194B
MD5ca40583628f3b36eb7ab33010e6002ab
SHA1cac93f9e6475ba2de18dfa07b4f3bd0b331454bc
SHA2560213551b846a281f0cc31535bb46a88d56ca8cc16cf1fa8477bd6ac37b022ec5
SHA51298d9bd0b58d27bc8b2bd21a71c4e883e8618e557dce04efd26ec8479e9d52b9c965300b76333af5d3b53edb23475cee94fbae95f78a58cfd6e87a5c87a9f08eb
-
Filesize
194B
MD513d92f0b3193ba6bc71f77f6fc131559
SHA142f657e6857835690608e271bec50ee0885958f1
SHA25627b246dd8242bf8492839d1a21dddea46564d2fa9091e1c07c16a2335753098f
SHA5123831ed88d0428f67b81d4f752636d497affa8097203161b181607a2436d1618b7db3db5a22915740d8f32f3ff3aeb5e39e746ea25a991071d03a927f459de398
-
Filesize
194B
MD533bcb36ec8a6ce6dae33697f855077c2
SHA1e8bf3ff9d1c0742db76e8059e31e0730f8a5120d
SHA256436e0bffca9880b1813977859192b1ef2d8ecb391a603bff405069f665f46712
SHA5121b5ea08b7de9aa0f4930585f662a7da6f72dc85d399d5f9ffafe5c12622d4113df0778e060bad720020aaf77abe197a5ecc8e628df6dc8c9eabca2f01ccf5412
-
Filesize
194B
MD58ca17e0f3555817fac25ab19561c3ac7
SHA18c038b63337eb9c8b14c1cbf2eecee4a073be029
SHA256274b2f89d77bcf101f45c6a16f3f485f2cdff1dc82ba7e62319e739679a5adae
SHA512980e26e4c9f5ee043bdd614f6ec4c6732a862c479534b7f47063d9b56484ba3eb1307e729dcf059daa2e92d2983b8e5bd161317dc5a067e70ff908a48684a3b9
-
Filesize
194B
MD5653e20146c89631d63a403cc6b6dc1d0
SHA1d912fb445b31b024bb73aeec345aa1e3015b994c
SHA256f6bb44df548225087e9868987fcb4bbfd05c62db3ace6efbfc54e651f987966c
SHA51252e52794dc58d8454420e899536708a8e9c6a2d1ee4ac44f06569eb68ff88b275ad90dabee0cee93e629736b2906705007d852e4a1c545c8bbb3a714eda14fcf
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
194B
MD554ba6891d45b018029268fd67221a0e4
SHA1154f75764baabbb47cd4559f4e3370268713c6aa
SHA2561c4156ef1d208b0a48ebccfb4fbd6c63455e8720e726deee466163d1c02a8468
SHA512fe32398a04d12fdb53dd93a9ada60bf2a75388feab8604ba7948841a11c812ff3cb8f039eb9fb91fdd32a3e21c03e378a860ac1d51826f9eea16c4f646ca2e6b
-
Filesize
194B
MD5d0ae55d63c1ea4a8a46aa4ff5974291f
SHA18da49d60831afec25e94c9d68e9d08d45c7056e2
SHA25627a3032255878227d9cc84efed35eefcb9fc2b9d614bc7b22027c4e3f7bbed79
SHA5120a9730cc2154d29c5134fcdf4237e8c4e3f15014bf5b0d3a117aa16b9b45029d10a085e04c4fa338e6cb3523897c800d9b25a9435286de19e00cc0c096b1a86c
-
Filesize
194B
MD51fa423c44409afa90a3ccb4c7c28fc8a
SHA1e8526dc8592caeef002beecdbaee61e4d9bf67bc
SHA2564ab03da2386cbac5d9f43b3520ced889fa2cfe8d35b87aad3e059dbd71b42b42
SHA51268ba924239346c7a701dad0efac2374a98ffcd2b1c812acb6b28621fb8c24e49bb1f05de70d031f1ece6c3083d58f609fe56e851e97d4144ac600f3b0173b40b
-
Filesize
194B
MD5f58c839638a3d919bcc4b39612967d08
SHA18fdef2fa91c36bb91d21e6f127dac24bbce61e66
SHA256b6f1bd6b13e87b7fc13286cf661b507d735d4d4d07fa93651756ccc5b2e2c6cc
SHA512a887bad2bfe468fc45231a82c079988fd0f8ce9f9069c84ad9268f3152fb9b0cbfceaebc0e4acb83146d1b868333c044610902f0df9de1f010c91704e1cb9abf
-
Filesize
194B
MD5eb9150005065f61e851da5f465adafb9
SHA1023726fa70e6f595bec98fe4df28353632475b9f
SHA2569512f43de0b919dedb15337233a2e1e88ce6da75232e4bdda57b91b95c19be56
SHA5129207d57585684736efa8b2751790466fa828dbbfc1280385b5f3782b9019fce50d26dd911f212f822b6122a50ab52a3ec0e1c84cb969007eb783b562d7a08116
-
Filesize
36B
MD56783c3ee07c7d151ceac57f1f9c8bed7
SHA117468f98f95bf504cc1f83c49e49a78526b3ea03
SHA2568ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322
SHA512c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8
-
Filesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
Filesize
197B
MD58088241160261560a02c84025d107592
SHA1083121f7027557570994c9fc211df61730455bb5
SHA2562072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1
SHA51220d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478