Analysis
-
max time kernel
144s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2024, 17:21
Behavioral task
behavioral1
Sample
JaffaCakes118_1ebaa7ed4637c29a58054d76654806ceb134309a5e6f97c7cedaa5b8c18b266f.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_1ebaa7ed4637c29a58054d76654806ceb134309a5e6f97c7cedaa5b8c18b266f.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_1ebaa7ed4637c29a58054d76654806ceb134309a5e6f97c7cedaa5b8c18b266f.exe
-
Size
1.3MB
-
MD5
fedee8ea04a3f6492e257a602f572046
-
SHA1
1f66231cefbabedfeec7087ecb028720d89dd5af
-
SHA256
1ebaa7ed4637c29a58054d76654806ceb134309a5e6f97c7cedaa5b8c18b266f
-
SHA512
8e376fad91e1762b52cac76c3a80ee11863d0786a05e7ccc67d25b8119dcb670f39c5d12e219675ed9236d410bdf55f270c45665388c20199aad7323c588aa64
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Process spawned unexpected child process 30 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2328 4464 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2104 4464 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1760 4464 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3432 4464 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2228 4464 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2100 4464 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 632 4464 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 616 4464 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4320 4464 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1964 4464 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3944 4464 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1656 4464 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3068 4464 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3288 4464 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1944 4464 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1052 4464 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2332 4464 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4048 4464 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3048 4464 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4012 4464 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1684 4464 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3472 4464 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2948 4464 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3656 4464 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2340 4464 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 440 4464 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2268 4464 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1580 4464 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1576 4464 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4564 4464 schtasks.exe 86 -
resource yara_rule behavioral2/files/0x000a000000023b79-10.dat dcrat behavioral2/memory/1348-13-0x00000000006E0000-0x00000000007F0000-memory.dmp dcrat -
Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2680 powershell.exe 4884 powershell.exe 1544 powershell.exe 1420 powershell.exe 1300 powershell.exe 4220 powershell.exe 2508 powershell.exe 4004 powershell.exe 3800 powershell.exe 3616 powershell.exe 4188 powershell.exe -
Checks computer location settings 2 TTPs 15 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation DllCommonsvc.exe Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation taskhostw.exe Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation taskhostw.exe Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation taskhostw.exe Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation taskhostw.exe Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation taskhostw.exe Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation taskhostw.exe Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation taskhostw.exe Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation JaffaCakes118_1ebaa7ed4637c29a58054d76654806ceb134309a5e6f97c7cedaa5b8c18b266f.exe Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation taskhostw.exe Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation taskhostw.exe Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation taskhostw.exe Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation taskhostw.exe Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation taskhostw.exe -
Executes dropped EXE 14 IoCs
pid Process 1348 DllCommonsvc.exe 876 taskhostw.exe 4424 taskhostw.exe 2560 taskhostw.exe 2764 taskhostw.exe 1972 taskhostw.exe 2800 taskhostw.exe 4664 taskhostw.exe 4152 taskhostw.exe 1420 taskhostw.exe 4916 taskhostw.exe 2764 taskhostw.exe 2104 taskhostw.exe 2524 taskhostw.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 13 IoCs
flow ioc 43 raw.githubusercontent.com 45 raw.githubusercontent.com 48 raw.githubusercontent.com 49 raw.githubusercontent.com 51 raw.githubusercontent.com 36 raw.githubusercontent.com 42 raw.githubusercontent.com 31 raw.githubusercontent.com 37 raw.githubusercontent.com 38 raw.githubusercontent.com 50 raw.githubusercontent.com 20 raw.githubusercontent.com 21 raw.githubusercontent.com -
Drops file in Program Files directory 6 IoCs
description ioc Process File created C:\Program Files (x86)\Windows Portable Devices\e1ef82546f0b02 DllCommonsvc.exe File created C:\Program Files\Uninstall Information\RuntimeBroker.exe DllCommonsvc.exe File created C:\Program Files\Uninstall Information\9e8d7a4ca61bd9 DllCommonsvc.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\taskhostw.exe DllCommonsvc.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\ea9f0e6c9e2dcd DllCommonsvc.exe File created C:\Program Files (x86)\Windows Portable Devices\SppExtComObj.exe DllCommonsvc.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\INF\PERFLIB\ee2ad38f3d4382 DllCommonsvc.exe File created C:\Windows\it-IT\DllCommonsvc.exe DllCommonsvc.exe File created C:\Windows\it-IT\a76d7bf15d8370 DllCommonsvc.exe File created C:\Windows\INF\PERFLIB\Registry.exe DllCommonsvc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_1ebaa7ed4637c29a58054d76654806ceb134309a5e6f97c7cedaa5b8c18b266f.exe -
Modifies registry class 14 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings taskhostw.exe Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings taskhostw.exe Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings taskhostw.exe Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings taskhostw.exe Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings DllCommonsvc.exe Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings taskhostw.exe Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings taskhostw.exe Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings taskhostw.exe Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings JaffaCakes118_1ebaa7ed4637c29a58054d76654806ceb134309a5e6f97c7cedaa5b8c18b266f.exe Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings taskhostw.exe Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings taskhostw.exe Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings taskhostw.exe Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings taskhostw.exe Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings taskhostw.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 30 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2228 schtasks.exe 440 schtasks.exe 1576 schtasks.exe 4564 schtasks.exe 1656 schtasks.exe 3048 schtasks.exe 632 schtasks.exe 4320 schtasks.exe 3472 schtasks.exe 2100 schtasks.exe 1944 schtasks.exe 4012 schtasks.exe 3656 schtasks.exe 1760 schtasks.exe 3432 schtasks.exe 1684 schtasks.exe 2948 schtasks.exe 1580 schtasks.exe 2328 schtasks.exe 616 schtasks.exe 3288 schtasks.exe 4048 schtasks.exe 2104 schtasks.exe 1964 schtasks.exe 3944 schtasks.exe 2268 schtasks.exe 3068 schtasks.exe 1052 schtasks.exe 2332 schtasks.exe 2340 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 61 IoCs
pid Process 1348 DllCommonsvc.exe 1348 DllCommonsvc.exe 1348 DllCommonsvc.exe 1348 DllCommonsvc.exe 1348 DllCommonsvc.exe 1348 DllCommonsvc.exe 1348 DllCommonsvc.exe 1348 DllCommonsvc.exe 1348 DllCommonsvc.exe 1348 DllCommonsvc.exe 1348 DllCommonsvc.exe 1348 DllCommonsvc.exe 1348 DllCommonsvc.exe 1348 DllCommonsvc.exe 1348 DllCommonsvc.exe 2508 powershell.exe 2508 powershell.exe 1420 powershell.exe 1420 powershell.exe 3616 powershell.exe 4220 powershell.exe 3616 powershell.exe 4220 powershell.exe 4884 powershell.exe 4884 powershell.exe 1300 powershell.exe 1300 powershell.exe 4188 powershell.exe 4188 powershell.exe 2680 powershell.exe 2680 powershell.exe 1544 powershell.exe 1544 powershell.exe 4004 powershell.exe 4004 powershell.exe 3800 powershell.exe 3800 powershell.exe 1544 powershell.exe 1420 powershell.exe 2508 powershell.exe 4220 powershell.exe 3616 powershell.exe 4188 powershell.exe 4884 powershell.exe 2680 powershell.exe 1300 powershell.exe 4004 powershell.exe 3800 powershell.exe 876 taskhostw.exe 4424 taskhostw.exe 2560 taskhostw.exe 2764 taskhostw.exe 1972 taskhostw.exe 2800 taskhostw.exe 4664 taskhostw.exe 4152 taskhostw.exe 1420 taskhostw.exe 4916 taskhostw.exe 2764 taskhostw.exe 2104 taskhostw.exe 2524 taskhostw.exe -
Suspicious use of AdjustPrivilegeToken 25 IoCs
description pid Process Token: SeDebugPrivilege 1348 DllCommonsvc.exe Token: SeDebugPrivilege 2508 powershell.exe Token: SeDebugPrivilege 1420 powershell.exe Token: SeDebugPrivilege 3616 powershell.exe Token: SeDebugPrivilege 1544 powershell.exe Token: SeDebugPrivilege 4220 powershell.exe Token: SeDebugPrivilege 4884 powershell.exe Token: SeDebugPrivilege 1300 powershell.exe Token: SeDebugPrivilege 2680 powershell.exe Token: SeDebugPrivilege 4188 powershell.exe Token: SeDebugPrivilege 4004 powershell.exe Token: SeDebugPrivilege 3800 powershell.exe Token: SeDebugPrivilege 876 taskhostw.exe Token: SeDebugPrivilege 4424 taskhostw.exe Token: SeDebugPrivilege 2560 taskhostw.exe Token: SeDebugPrivilege 2764 taskhostw.exe Token: SeDebugPrivilege 1972 taskhostw.exe Token: SeDebugPrivilege 2800 taskhostw.exe Token: SeDebugPrivilege 4664 taskhostw.exe Token: SeDebugPrivilege 4152 taskhostw.exe Token: SeDebugPrivilege 1420 taskhostw.exe Token: SeDebugPrivilege 4916 taskhostw.exe Token: SeDebugPrivilege 2764 taskhostw.exe Token: SeDebugPrivilege 2104 taskhostw.exe Token: SeDebugPrivilege 2524 taskhostw.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2708 wrote to memory of 2512 2708 JaffaCakes118_1ebaa7ed4637c29a58054d76654806ceb134309a5e6f97c7cedaa5b8c18b266f.exe 82 PID 2708 wrote to memory of 2512 2708 JaffaCakes118_1ebaa7ed4637c29a58054d76654806ceb134309a5e6f97c7cedaa5b8c18b266f.exe 82 PID 2708 wrote to memory of 2512 2708 JaffaCakes118_1ebaa7ed4637c29a58054d76654806ceb134309a5e6f97c7cedaa5b8c18b266f.exe 82 PID 2512 wrote to memory of 760 2512 WScript.exe 83 PID 2512 wrote to memory of 760 2512 WScript.exe 83 PID 2512 wrote to memory of 760 2512 WScript.exe 83 PID 760 wrote to memory of 1348 760 cmd.exe 85 PID 760 wrote to memory of 1348 760 cmd.exe 85 PID 1348 wrote to memory of 3800 1348 DllCommonsvc.exe 117 PID 1348 wrote to memory of 3800 1348 DllCommonsvc.exe 117 PID 1348 wrote to memory of 1420 1348 DllCommonsvc.exe 118 PID 1348 wrote to memory of 1420 1348 DllCommonsvc.exe 118 PID 1348 wrote to memory of 3616 1348 DllCommonsvc.exe 119 PID 1348 wrote to memory of 3616 1348 DllCommonsvc.exe 119 PID 1348 wrote to memory of 1300 1348 DllCommonsvc.exe 120 PID 1348 wrote to memory of 1300 1348 DllCommonsvc.exe 120 PID 1348 wrote to memory of 4188 1348 DllCommonsvc.exe 121 PID 1348 wrote to memory of 4188 1348 DllCommonsvc.exe 121 PID 1348 wrote to memory of 4220 1348 DllCommonsvc.exe 122 PID 1348 wrote to memory of 4220 1348 DllCommonsvc.exe 122 PID 1348 wrote to memory of 2508 1348 DllCommonsvc.exe 123 PID 1348 wrote to memory of 2508 1348 DllCommonsvc.exe 123 PID 1348 wrote to memory of 4004 1348 DllCommonsvc.exe 124 PID 1348 wrote to memory of 4004 1348 DllCommonsvc.exe 124 PID 1348 wrote to memory of 2680 1348 DllCommonsvc.exe 125 PID 1348 wrote to memory of 2680 1348 DllCommonsvc.exe 125 PID 1348 wrote to memory of 4884 1348 DllCommonsvc.exe 126 PID 1348 wrote to memory of 4884 1348 DllCommonsvc.exe 126 PID 1348 wrote to memory of 1544 1348 DllCommonsvc.exe 127 PID 1348 wrote to memory of 1544 1348 DllCommonsvc.exe 127 PID 1348 wrote to memory of 1780 1348 DllCommonsvc.exe 138 PID 1348 wrote to memory of 1780 1348 DllCommonsvc.exe 138 PID 1780 wrote to memory of 1368 1780 cmd.exe 141 PID 1780 wrote to memory of 1368 1780 cmd.exe 141 PID 1780 wrote to memory of 876 1780 cmd.exe 145 PID 1780 wrote to memory of 876 1780 cmd.exe 145 PID 876 wrote to memory of 3276 876 taskhostw.exe 149 PID 876 wrote to memory of 3276 876 taskhostw.exe 149 PID 3276 wrote to memory of 2460 3276 cmd.exe 151 PID 3276 wrote to memory of 2460 3276 cmd.exe 151 PID 3276 wrote to memory of 4424 3276 cmd.exe 152 PID 3276 wrote to memory of 4424 3276 cmd.exe 152 PID 4424 wrote to memory of 3980 4424 taskhostw.exe 154 PID 4424 wrote to memory of 3980 4424 taskhostw.exe 154 PID 3980 wrote to memory of 2648 3980 cmd.exe 156 PID 3980 wrote to memory of 2648 3980 cmd.exe 156 PID 3980 wrote to memory of 2560 3980 cmd.exe 158 PID 3980 wrote to memory of 2560 3980 cmd.exe 158 PID 2560 wrote to memory of 3728 2560 taskhostw.exe 159 PID 2560 wrote to memory of 3728 2560 taskhostw.exe 159 PID 3728 wrote to memory of 1044 3728 cmd.exe 161 PID 3728 wrote to memory of 1044 3728 cmd.exe 161 PID 3728 wrote to memory of 2764 3728 cmd.exe 162 PID 3728 wrote to memory of 2764 3728 cmd.exe 162 PID 2764 wrote to memory of 1456 2764 taskhostw.exe 163 PID 2764 wrote to memory of 1456 2764 taskhostw.exe 163 PID 1456 wrote to memory of 3324 1456 cmd.exe 165 PID 1456 wrote to memory of 3324 1456 cmd.exe 165 PID 1456 wrote to memory of 1972 1456 cmd.exe 166 PID 1456 wrote to memory of 1972 1456 cmd.exe 166 PID 1972 wrote to memory of 3280 1972 taskhostw.exe 167 PID 1972 wrote to memory of 3280 1972 taskhostw.exe 167 PID 3280 wrote to memory of 2104 3280 cmd.exe 169 PID 3280 wrote to memory of 2104 3280 cmd.exe 169 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1ebaa7ed4637c29a58054d76654806ceb134309a5e6f97c7cedaa5b8c18b266f.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1ebaa7ed4637c29a58054d76654806ceb134309a5e6f97c7cedaa5b8c18b266f.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:760 -
C:\providercommon\DllCommonsvc.exe"C:\providercommon\DllCommonsvc.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3800
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Adobe\smss.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1420
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\it-IT\DllCommonsvc.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3616
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\INF\PERFLIB\Registry.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1300
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\Idle.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4188
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Uninstall Information\RuntimeBroker.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4220
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\sihost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2508
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\taskhostw.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4004
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Portable Devices\SppExtComObj.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2680
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\cmd.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4884
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\dllhost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1544
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\9pj6mQXw8A.bat"5⤵
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:26⤵PID:1368
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\taskhostw.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\taskhostw.exe"6⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:876 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\uSow6ZWML2.bat"7⤵
- Suspicious use of WriteProcessMemory
PID:3276 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:28⤵PID:2460
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\taskhostw.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\taskhostw.exe"8⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4424 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\0VN2lTwXPf.bat"9⤵
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:210⤵PID:2648
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\taskhostw.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\taskhostw.exe"10⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\HD5NsnfB5C.bat"11⤵
- Suspicious use of WriteProcessMemory
PID:3728 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:212⤵PID:1044
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\taskhostw.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\taskhostw.exe"12⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\R8iYvsD9nO.bat"13⤵
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:214⤵PID:3324
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\taskhostw.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\taskhostw.exe"14⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\7JTBpj7DN0.bat"15⤵
- Suspicious use of WriteProcessMemory
PID:3280 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:216⤵PID:2104
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\taskhostw.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\taskhostw.exe"16⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2800 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\kYBl3UyOdq.bat"17⤵PID:2300
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:218⤵PID:1220
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\taskhostw.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\taskhostw.exe"18⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4664 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Q3ZRkRg4YZ.bat"19⤵PID:4968
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:220⤵PID:4412
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\taskhostw.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\taskhostw.exe"20⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4152 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\biigBqxW9T.bat"21⤵PID:372
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:222⤵PID:448
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\taskhostw.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\taskhostw.exe"22⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1420 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\CL2HVdYORd.bat"23⤵PID:2704
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:224⤵PID:2044
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\taskhostw.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\taskhostw.exe"24⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4916 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\WqeaogqjWu.bat"25⤵PID:5016
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:226⤵PID:3924
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\taskhostw.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\taskhostw.exe"26⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2764 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\UucX7bnqC8.bat"27⤵PID:4520
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:228⤵PID:4976
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\taskhostw.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\taskhostw.exe"28⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2104 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\jhJpXqSaXt.bat"29⤵PID:3036
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:230⤵PID:2796
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\taskhostw.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\taskhostw.exe"30⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2524
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\Adobe\smss.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2328
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Users\All Users\Adobe\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2104
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\Users\All Users\Adobe\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1760
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 5 /tr "'C:\Windows\it-IT\DllCommonsvc.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3432
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\Windows\it-IT\DllCommonsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2228
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 13 /tr "'C:\Windows\it-IT\DllCommonsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2100
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 9 /tr "'C:\Windows\INF\PERFLIB\Registry.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:632
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Windows\INF\PERFLIB\Registry.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:616
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 5 /tr "'C:\Windows\INF\PERFLIB\Registry.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4320
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\Idle.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1964
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3944
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1656
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Program Files\Uninstall Information\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3068
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3288
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Program Files\Uninstall Information\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1944
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihosts" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\sihost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1052
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sihost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2332
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihosts" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\sihost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4048
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\taskhostw.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3048
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\taskhostw.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4012
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\taskhostw.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1684
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Portable Devices\SppExtComObj.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3472
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\SppExtComObj.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2948
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Portable Devices\SppExtComObj.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3656
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "cmdc" /sc MINUTE /mo 5 /tr "'C:\providercommon\cmd.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2340
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\providercommon\cmd.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:440
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "cmdc" /sc MINUTE /mo 9 /tr "'C:\providercommon\cmd.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2268
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\providercommon\dllhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1580
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\providercommon\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1576
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\providercommon\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4564
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
1KB
MD5baf55b95da4a601229647f25dad12878
SHA1abc16954ebfd213733c4493fc1910164d825cac8
SHA256ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
SHA51224f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545
-
Filesize
944B
MD5d28a889fd956d5cb3accfbaf1143eb6f
SHA1157ba54b365341f8ff06707d996b3635da8446f7
SHA25621e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45
SHA5120b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c
-
Filesize
944B
MD5cadef9abd087803c630df65264a6c81c
SHA1babbf3636c347c8727c35f3eef2ee643dbcc4bd2
SHA256cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438
SHA5127278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085
-
Filesize
944B
MD559d97011e091004eaffb9816aa0b9abd
SHA11602a56b01dd4b7c577ca27d3117e4bcc1aa657b
SHA25618f381e0db020a763b8c515c346ef58679ab9c403267eacfef5359e272f7e71d
SHA512d9ca49c1a17580981e2c1a50d73c0eecaa7a62f8514741512172e395af2a3d80aeb0f71c58bc7f52c18246d57ba67af09b6bff4776877d6cc6f0245c30e092d6
-
Filesize
104B
MD55134142521eeda431755e29e9c9bfa9c
SHA164e5cf4a4bb482bc364f47725e7fa2bcec2a2407
SHA256ab82455cb19ceef15cc21d5676802f96e494c47f591e3a28a2b65e258b90ee45
SHA5126fdd0ae47f4b08088643ca8e64afcb9111e9d2bb7dda5218c9578df465a636a6d722b77f73b792ef7af15ed5ad6efc31057b7f1321b455762ae2bf1195747ded
-
Filesize
236B
MD5e9aeda70ffd344410066064e8b5b596f
SHA1ca0329df418605d3e5142544ac3b5b6eea0bc904
SHA256d64f10acb6bd729e8e28769e3aa7269ce43f82ccc6930b8578ee06bc9e6dad26
SHA512cfb292e94993aea96114952183f1446a6a6c834858487a1ffaf9666530846d41303143a99393409394ec6374a1bbcb90a7da8be613fa7ab5ba14e9cf319955a5
-
Filesize
236B
MD5ce51212783defadafb82040a528e269a
SHA1c8380478215d67cf067a0471b6fe22db21aafbbd
SHA2568ea94cdef1d38385a97117695b2d05f9759ea498ff6fc9e83f3a71b747e6c061
SHA512cbcb942b7caf7171bb5ce350cdcf233b4ab466fdda4b94948ca0d024541b51e5a614538433bbc6790ae0ce2a3c37145f8c71c72ff6db7e7e2dd8e419a338a85e
-
Filesize
236B
MD51eddd09772ff9a65f01e5c613ab97ac9
SHA1a335a8d6c669f75910a851d522b4290c6ced2e01
SHA256f0adaf16b5db3cd3f4f4a73673e22f3128c03c84a9c899dd01383c84db1ad40c
SHA512d30c7f4146a07d930ea4525a4592c0c5c9aa1f25493c6afbff660b42befae4d997f1845c9976db8b88b3f4bb9aedf152d28ed08583f6b3412e3a35cb6a577bcd
-
Filesize
236B
MD5b2417a826f8b17d8ccdb47c24f446aa1
SHA1565154c93122f1a697b4990908a446f4d6089efe
SHA2564e6406c2761a744ce2a4b2f4964d5dbb674105b239d87977fdfcafaff5c59f7a
SHA5120f8722b48d33510013e7a9c15f0d0ba899b2a0c04cd359763362e02d4ee9206ba3c2100e7fb3e303e0b0a39b33a2812f6a526812228b09534ecf5e8aae29a05e
-
Filesize
236B
MD54f7048f215cf342c9b81db5754248507
SHA100ae08cae647a921e5bac44a082b94a8a4d7469e
SHA256099a15243cb9f2fc8a8b76e146d257d6e54f2fb255166049909d5806248a28a3
SHA512854542030b056ee92b33ed8f7b3fe129cdd819922a4ac4232ca102096df70c70ec9139914a8f917aec2ebb9713d5fa8b0aca2c40e74e5345f84414dc993997ef
-
Filesize
236B
MD58df88d425d99ef013baec1e3d69a6061
SHA181345d894de6a90493f9b4f4046db34b84628a60
SHA256b137ec5769ed4adca5f0db0ded9d6bd2d5e288efc4bc66548b6f585009eb98c5
SHA51240031e02795eefc5ed7c5cc09b56c445e0525df3cf242aa79a5e1bf43ce660932cbcb85cc17a50ff55bd88b1b6ff3d4c758cde22dedb0fb6896b6667e8489c47
-
Filesize
236B
MD5971569bfcdaf34096a0f68fcf6d19e8a
SHA1f89ffddb1810e9a6bcdf97b89c29fc4f1ee2299a
SHA2563a45e6b57463cf1bd908250c455f861cbac2ebacb0dc1e8b3bf97687a09e2c61
SHA5128ed4ca5cb840a3f7c24e8e201087fa134ec438bc3c96f90ac038a23ff8a7fc7b240b5cbd440760d4bfec758cab34dd4364a1ccfba88d5eed6b760df45bf52153
-
Filesize
236B
MD5aa71b0cae49a849867acefd09b19961c
SHA13f15eafb5fed25dec7b7607838fbc7b957fe4655
SHA256f3146196d1a9ddc59f27d1bc25fed24e5a8d8a029654f7df0d3b7e4c777172c4
SHA512a63395b5e07628773c53b5549c026e727fd05ffb212a9d3e0ac72d649bce1f3fb1e9c378ce5293c522826b17ad89550ede0eddae0d15156c90da999e8dfc4e4d
-
Filesize
236B
MD56d2fa059be7810d8e513a2cd9bbab552
SHA1f582d49bbb25099d5ab18a962b463932673a4425
SHA2566fa5cd2f3a8fb30f9cfa747ff0ed6b3027bb138f8f5014221ca774aa1d5bf380
SHA512884b69a80e58c0dffa98397d200740904742e6dbaf8089544825531e2e017b79c1caf002fd8a7271f247f49ae47b7c9c2a8885a8541d4b9dbae75fb84b4ac711
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
236B
MD503d3c1d1a0072bdc11423551dc8e12d3
SHA153195c873c5b418451f1bdeb467ddf601bc48e4b
SHA256607fe6b5b88b5f4e5ff3917743de4a2608456623cb656e0943c6a96a79b83788
SHA5127f117d68ea64902bc3e4c7206e646c65a1d84c9c421d3dc4277b7b325fb91a10b04ed335000b607d921a46ddadd489b49d0621d901bb81cd3baef8fc4e523b64
-
Filesize
236B
MD5c5cf9669b2d74a0ed34646143f9a00a7
SHA1ea578b1ad4cdf90cbbecaf6861294237c2cdaf39
SHA256cb136342044e30d2565c17a4a1d565d318f2c2c912cbf5c0bc1cebfc61b28960
SHA512e8937b76d58854078b6a9fa65f4b2669a1a4538775dd98eb7b7810daad5d1ebb5982bcd6431d341bbc15d5a55409073b4235777f95e5ff861b0792753fff7b5e
-
Filesize
236B
MD5672146a9d1ebbc6202b9d8be1d001d42
SHA1318fed0247c9a07a613ebddc0338af5111211be7
SHA2564191b2ac353592b78d5b79a2739c35170234a25c36363e6a209853eff52429a9
SHA512d0c1d12c9a7fb79135b2be078650324a7302a3959cdfb44124d23bde8f6cb0d98d959389dbfc97e4050db0704f69f24959fc3c2a76c47daccfcaa8cf2da88021
-
Filesize
236B
MD53c68c147481acd3379f99ed4719c5462
SHA11887d556286daa1154d4f52e7bfbf0ea15f9d15b
SHA2560cb539bf8309ff6df63ede4ab8bc6dbe1cc451b5346c1d77aa17638a24c67ae2
SHA51232a4786b0b7053b39d9356e9dd4b9c3b76a5b32ba8f60881c2600e3e363961f708ec2c79d6b6b8b770d52e68b1daf3afe4645899605074b846d6640ceb57c336
-
Filesize
36B
MD56783c3ee07c7d151ceac57f1f9c8bed7
SHA117468f98f95bf504cc1f83c49e49a78526b3ea03
SHA2568ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322
SHA512c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8
-
Filesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
Filesize
197B
MD58088241160261560a02c84025d107592
SHA1083121f7027557570994c9fc211df61730455bb5
SHA2562072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1
SHA51220d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478