Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/12/2024, 17:24

General

  • Target

    JaffaCakes118_1702ad666d39b8802ca30fdaf876f2c1ea070e0c7a9010e8a7a2b4d791512ac5.exe

  • Size

    1.3MB

  • MD5

    479adce474d995761b5dd7cf15ee982b

  • SHA1

    089521a9018dcb5abe009f549375e85054feef16

  • SHA256

    1702ad666d39b8802ca30fdaf876f2c1ea070e0c7a9010e8a7a2b4d791512ac5

  • SHA512

    d852bfeb11f729f355627cfd466fca37cb6403016889d3d1a2dfe621632e4308e36c15c2b410d4980e61252d898ea7cf9029459b3b8a0a4564953d71667f7682

  • SSDEEP

    24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Dcrat family
  • Process spawned unexpected child process 24 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • DCRat payload 2 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 9 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks computer location settings 2 TTPs 15 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 13 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 13 IoCs
  • Drops file in Program Files directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 13 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 24 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 44 IoCs
  • Suspicious use of AdjustPrivilegeToken 22 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1702ad666d39b8802ca30fdaf876f2c1ea070e0c7a9010e8a7a2b4d791512ac5.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1702ad666d39b8802ca30fdaf876f2c1ea070e0c7a9010e8a7a2b4d791512ac5.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2588
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
      2⤵
      • Checks computer location settings
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3196
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2540
        • C:\providercommon\DllCommonsvc.exe
          "C:\providercommon\DllCommonsvc.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3188
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4052
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Common Files\spoolsv.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1608
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\OfficeClickToRun.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3784
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Uninstall Information\TextInputHost.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2928
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\dllhost.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4948
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\SendTo\dwm.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1164
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\csrss.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4008
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\cmd.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3740
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\fontdrvhost.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4224
          • C:\Program Files\Uninstall Information\TextInputHost.exe
            "C:\Program Files\Uninstall Information\TextInputHost.exe"
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:4924
            • C:\Windows\System32\cmd.exe
              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\EzDSmeWZ76.bat"
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:4916
              • C:\Windows\system32\w32tm.exe
                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                7⤵
                  PID:2468
                • C:\Program Files\Uninstall Information\TextInputHost.exe
                  "C:\Program Files\Uninstall Information\TextInputHost.exe"
                  7⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Modifies registry class
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:3092
                  • C:\Windows\System32\cmd.exe
                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\KteTxDTZHh.bat"
                    8⤵
                    • Suspicious use of WriteProcessMemory
                    PID:3576
                    • C:\Windows\system32\w32tm.exe
                      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                      9⤵
                        PID:2448
                      • C:\Program Files\Uninstall Information\TextInputHost.exe
                        "C:\Program Files\Uninstall Information\TextInputHost.exe"
                        9⤵
                        • Checks computer location settings
                        • Executes dropped EXE
                        • Modifies registry class
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        PID:1916
                        • C:\Windows\System32\cmd.exe
                          "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Myoa8e0eVV.bat"
                          10⤵
                          • Suspicious use of WriteProcessMemory
                          PID:4988
                          • C:\Windows\system32\w32tm.exe
                            w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                            11⤵
                              PID:2820
                            • C:\Program Files\Uninstall Information\TextInputHost.exe
                              "C:\Program Files\Uninstall Information\TextInputHost.exe"
                              11⤵
                              • Checks computer location settings
                              • Executes dropped EXE
                              • Modifies registry class
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of WriteProcessMemory
                              PID:3560
                              • C:\Windows\System32\cmd.exe
                                "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\2K3DLFE7WC.bat"
                                12⤵
                                • Suspicious use of WriteProcessMemory
                                PID:716
                                • C:\Windows\system32\w32tm.exe
                                  w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                  13⤵
                                    PID:4936
                                  • C:\Program Files\Uninstall Information\TextInputHost.exe
                                    "C:\Program Files\Uninstall Information\TextInputHost.exe"
                                    13⤵
                                    • Checks computer location settings
                                    • Executes dropped EXE
                                    • Modifies registry class
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of AdjustPrivilegeToken
                                    • Suspicious use of WriteProcessMemory
                                    PID:5036
                                    • C:\Windows\System32\cmd.exe
                                      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\19YD2Vui68.bat"
                                      14⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:3812
                                      • C:\Windows\system32\w32tm.exe
                                        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                        15⤵
                                          PID:4472
                                        • C:\Program Files\Uninstall Information\TextInputHost.exe
                                          "C:\Program Files\Uninstall Information\TextInputHost.exe"
                                          15⤵
                                          • Checks computer location settings
                                          • Executes dropped EXE
                                          • Modifies registry class
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of AdjustPrivilegeToken
                                          • Suspicious use of WriteProcessMemory
                                          PID:1712
                                          • C:\Windows\System32\cmd.exe
                                            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\mNrvcGFykN.bat"
                                            16⤵
                                            • Suspicious use of WriteProcessMemory
                                            PID:1160
                                            • C:\Windows\system32\w32tm.exe
                                              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                              17⤵
                                                PID:4140
                                              • C:\Program Files\Uninstall Information\TextInputHost.exe
                                                "C:\Program Files\Uninstall Information\TextInputHost.exe"
                                                17⤵
                                                • Checks computer location settings
                                                • Executes dropped EXE
                                                • Modifies registry class
                                                • Suspicious behavior: EnumeratesProcesses
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:2960
                                                • C:\Windows\System32\cmd.exe
                                                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\1Gu59oh2IN.bat"
                                                  18⤵
                                                    PID:4284
                                                    • C:\Windows\system32\w32tm.exe
                                                      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                      19⤵
                                                        PID:4848
                                                      • C:\Program Files\Uninstall Information\TextInputHost.exe
                                                        "C:\Program Files\Uninstall Information\TextInputHost.exe"
                                                        19⤵
                                                        • Checks computer location settings
                                                        • Executes dropped EXE
                                                        • Modifies registry class
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:4460
                                                        • C:\Windows\System32\cmd.exe
                                                          "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\989MOUOnUX.bat"
                                                          20⤵
                                                            PID:3012
                                                            • C:\Windows\system32\w32tm.exe
                                                              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                              21⤵
                                                                PID:4648
                                                              • C:\Program Files\Uninstall Information\TextInputHost.exe
                                                                "C:\Program Files\Uninstall Information\TextInputHost.exe"
                                                                21⤵
                                                                • Checks computer location settings
                                                                • Executes dropped EXE
                                                                • Modifies registry class
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:5040
                                                                • C:\Windows\System32\cmd.exe
                                                                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\45aGjaybPu.bat"
                                                                  22⤵
                                                                    PID:392
                                                                    • C:\Windows\system32\w32tm.exe
                                                                      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                      23⤵
                                                                        PID:1480
                                                                      • C:\Program Files\Uninstall Information\TextInputHost.exe
                                                                        "C:\Program Files\Uninstall Information\TextInputHost.exe"
                                                                        23⤵
                                                                        • Checks computer location settings
                                                                        • Executes dropped EXE
                                                                        • Modifies registry class
                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        PID:4340
                                                                        • C:\Windows\System32\cmd.exe
                                                                          "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\3Bw8qtkvcA.bat"
                                                                          24⤵
                                                                            PID:1636
                                                                            • C:\Windows\system32\w32tm.exe
                                                                              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                              25⤵
                                                                                PID:4184
                                                                              • C:\Program Files\Uninstall Information\TextInputHost.exe
                                                                                "C:\Program Files\Uninstall Information\TextInputHost.exe"
                                                                                25⤵
                                                                                • Checks computer location settings
                                                                                • Executes dropped EXE
                                                                                • Modifies registry class
                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                PID:1340
                                                                                • C:\Windows\System32\cmd.exe
                                                                                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\gZmmY05In2.bat"
                                                                                  26⤵
                                                                                    PID:3824
                                                                                    • C:\Windows\system32\w32tm.exe
                                                                                      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                      27⤵
                                                                                        PID:4992
                                                                                      • C:\Program Files\Uninstall Information\TextInputHost.exe
                                                                                        "C:\Program Files\Uninstall Information\TextInputHost.exe"
                                                                                        27⤵
                                                                                        • Checks computer location settings
                                                                                        • Executes dropped EXE
                                                                                        • Modifies registry class
                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        PID:1060
                                                                                        • C:\Windows\System32\cmd.exe
                                                                                          "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\57xCWyooww.bat"
                                                                                          28⤵
                                                                                            PID:1980
                                                                                            • C:\Windows\system32\w32tm.exe
                                                                                              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                              29⤵
                                                                                                PID:4744
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 7 /tr "'C:\Program Files\Common Files\spoolsv.exe'" /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:3228
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files\Common Files\spoolsv.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:5048
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\Program Files\Common Files\spoolsv.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:4636
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 13 /tr "'C:\providercommon\OfficeClickToRun.exe'" /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:3644
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\providercommon\OfficeClickToRun.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:1368
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 12 /tr "'C:\providercommon\OfficeClickToRun.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:5028
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 13 /tr "'C:\Program Files\Uninstall Information\TextInputHost.exe'" /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:4584
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\TextInputHost.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:1492
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 7 /tr "'C:\Program Files\Uninstall Information\TextInputHost.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:3484
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\providercommon\dllhost.exe'" /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:876
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\providercommon\dllhost.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:1972
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\providercommon\dllhost.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:3624
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 12 /tr "'C:\Users\Default\SendTo\dwm.exe'" /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:4460
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Users\Default\SendTo\dwm.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:2476
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\Users\Default\SendTo\dwm.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:3024
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Users\All Users\csrss.exe'" /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:4348
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\All Users\csrss.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:4448
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\csrss.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:4208
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 10 /tr "'C:\providercommon\cmd.exe'" /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:1692
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\providercommon\cmd.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:1504
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 7 /tr "'C:\providercommon\cmd.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:2080
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\providercommon\fontdrvhost.exe'" /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:624
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\providercommon\fontdrvhost.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:396
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\providercommon\fontdrvhost.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:4804

                                      Network

                                            MITRE ATT&CK Enterprise v15

                                            Replay Monitor

                                            Loading Replay Monitor...

                                            Downloads

                                            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\TextInputHost.exe.log

                                              Filesize

                                              1KB

                                              MD5

                                              baf55b95da4a601229647f25dad12878

                                              SHA1

                                              abc16954ebfd213733c4493fc1910164d825cac8

                                              SHA256

                                              ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

                                              SHA512

                                              24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

                                            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                              Filesize

                                              2KB

                                              MD5

                                              d85ba6ff808d9e5444a4b369f5bc2730

                                              SHA1

                                              31aa9d96590fff6981b315e0b391b575e4c0804a

                                              SHA256

                                              84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                              SHA512

                                              8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                              Filesize

                                              944B

                                              MD5

                                              2979eabc783eaca50de7be23dd4eafcf

                                              SHA1

                                              d709ce5f3a06b7958a67e20870bfd95b83cad2ea

                                              SHA256

                                              006cca90e78fbb571532a83082ac6712721a34ea4b21f490058ffb3f521f4903

                                              SHA512

                                              92bc433990572d9427d0c93eef9bd1cc23fa00ed60dd0c9c983d87d3421e02ce3f156c6f88fe916ef6782dbf185cbce083bc0094f8c527f302be6a37d1c53aba

                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                              Filesize

                                              944B

                                              MD5

                                              77d622bb1a5b250869a3238b9bc1402b

                                              SHA1

                                              d47f4003c2554b9dfc4c16f22460b331886b191b

                                              SHA256

                                              f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

                                              SHA512

                                              d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                              Filesize

                                              944B

                                              MD5

                                              62623d22bd9e037191765d5083ce16a3

                                              SHA1

                                              4a07da6872672f715a4780513d95ed8ddeefd259

                                              SHA256

                                              95d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010

                                              SHA512

                                              9a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992

                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                              Filesize

                                              944B

                                              MD5

                                              cadef9abd087803c630df65264a6c81c

                                              SHA1

                                              babbf3636c347c8727c35f3eef2ee643dbcc4bd2

                                              SHA256

                                              cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

                                              SHA512

                                              7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                              Filesize

                                              944B

                                              MD5

                                              3a6bad9528f8e23fb5c77fbd81fa28e8

                                              SHA1

                                              f127317c3bc6407f536c0f0600dcbcf1aabfba36

                                              SHA256

                                              986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

                                              SHA512

                                              846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

                                            • C:\Users\Admin\AppData\Local\Temp\19YD2Vui68.bat

                                              Filesize

                                              221B

                                              MD5

                                              5f6d1f0731f072edf5be2504b5173fd9

                                              SHA1

                                              7a96e8117e9241e938a9caa33b19a923ff21e15a

                                              SHA256

                                              9530df2ffad9e9c61692e41ee15d48e30847476eca76c531451a9594e0f60c81

                                              SHA512

                                              cbbe97c8a1e8ccd9603d21539d6ca785e2777a568cf73483ee861a5cbc12d936a9891648e238783e7beeaa4732a8b5103a5b10285e37d3bb3ec716d43b8df0e7

                                            • C:\Users\Admin\AppData\Local\Temp\1Gu59oh2IN.bat

                                              Filesize

                                              221B

                                              MD5

                                              548872ae535a40ff7de52b1e38b83ca6

                                              SHA1

                                              038913bfdc8be7abe28f37c0232bc35a5c159db9

                                              SHA256

                                              e66298f30e43a460e7467cedef27e02f53951051941169f1dc265c865c82cc65

                                              SHA512

                                              d5803afac118e0f4484ced92895b4e5d6b4c02ba1a2366bcc3030784227ec2b3595b8b7c6c78bb35e7e025581a98c4e4f20f37f58911b7ef51983f8350b64702

                                            • C:\Users\Admin\AppData\Local\Temp\2K3DLFE7WC.bat

                                              Filesize

                                              221B

                                              MD5

                                              499eaf617ff1a3e6b3e7dc0ebc10b0f0

                                              SHA1

                                              a257e4388bbca80a4f8529a735b1cc060929132f

                                              SHA256

                                              456ab22de454b63cb3c67c9a565f8b15cc0592ddd24a1570cdc46603965c42bf

                                              SHA512

                                              ab7432bce8a78443c46142bb9a232b2cff9c8cab9122a513e1e5e8a976b744b8b5b346b52446cfb7af212bf45d31c683c22d1306afbf02d6bf8717b0b1915b3b

                                            • C:\Users\Admin\AppData\Local\Temp\3Bw8qtkvcA.bat

                                              Filesize

                                              221B

                                              MD5

                                              c62be8c9d419a332e981a09dfd262f05

                                              SHA1

                                              3f3dc12e90268e059d40ad9457f626f6ddf38551

                                              SHA256

                                              2c582918ab3f85a51731af0f67e2753d744e2de31cb791bb03179307d376583d

                                              SHA512

                                              8fcff9cf9c7847affb693f40c644fe66d13d1582a347b7ff175fe042f1966ccb27f8cb3f9cd2ab8f70b0862b96df5e8592490a75543c694c0a5d218958ab9921

                                            • C:\Users\Admin\AppData\Local\Temp\45aGjaybPu.bat

                                              Filesize

                                              221B

                                              MD5

                                              acd985db65ea1d84219ea9512a6be827

                                              SHA1

                                              47ea92a1819b6241048eb248355c31eeb7633bb5

                                              SHA256

                                              b7f0d9b8135f4c450aa269b6c75d7bc39aa986b1f4622059847fcb31e22e124c

                                              SHA512

                                              1dba068b1026c8b6a809eddf483f45deb4e6de1ef42d65fe6d0ccb90c707c09870dd12c2a87b50d3ee3f680fc23a886216f00ee76832780cce15e97d19e48134

                                            • C:\Users\Admin\AppData\Local\Temp\57xCWyooww.bat

                                              Filesize

                                              221B

                                              MD5

                                              24bf520ad0af663d113da0e99cf54258

                                              SHA1

                                              76eaf111ac90c1dc0a641e511948f04a11badb57

                                              SHA256

                                              6e16c73050566aebb943ff265d6c5a751076f99e93976fc1e0e849e71543113b

                                              SHA512

                                              6383473b5c0cf62f459692af3d9fa1c011852a33b68615170ceedb1c9e610696b39e237b579d61829d18743d886de50f956154cb4ccdefcfd1b0106dd5016aea

                                            • C:\Users\Admin\AppData\Local\Temp\989MOUOnUX.bat

                                              Filesize

                                              221B

                                              MD5

                                              a38767a567b38700c6b1a0c298e771ed

                                              SHA1

                                              d926732d6ab7e8224c1f4a8741f0e4d5ad5ae2c8

                                              SHA256

                                              52cd3b6fd01f9f4b770adad6f02a36a3d8fbd5600c9c201a877956eb694c02f7

                                              SHA512

                                              dc80c21bc33ba528c15c5236723b35d14b6a775787aa61043e2375ffa5d3eb040fd9ba8fbde5e33841b847e5ba45edfeab4b4669fb3b9346d5703ba5b43ce650

                                            • C:\Users\Admin\AppData\Local\Temp\EzDSmeWZ76.bat

                                              Filesize

                                              221B

                                              MD5

                                              e94c690a08aba064148adb145ebdac09

                                              SHA1

                                              ed895b9dcf3f5ecd9b7f54c3048da80dbaba8722

                                              SHA256

                                              81905193fb00c43d57f21c604c6845cbed731365b1502b93fde3429ad5ee793f

                                              SHA512

                                              0cc2a5eeed1aceb2ffdf08737647cac4b06aca395e26ea7d354999d6fef7642eea4e4e4df765a09a3339e5634df313078a42c099cabec5386711a02c95742dff

                                            • C:\Users\Admin\AppData\Local\Temp\KteTxDTZHh.bat

                                              Filesize

                                              221B

                                              MD5

                                              37e712d16daa1eefd155d8f3eec75800

                                              SHA1

                                              812a5f4c73498386e621f056a5b3ebc4be84f084

                                              SHA256

                                              a37744c6153f7f9ea1b0e12af08bd7972634855602a73df807ada943a9141df2

                                              SHA512

                                              2c0eceb316161f5af090990301ed1cc23e7e3ebdf557b897dcf9dc4755eff87d8929cde4adf16818a910f2c633b639f92ccd55c883d710ee715ecb7f4b53a89e

                                            • C:\Users\Admin\AppData\Local\Temp\Myoa8e0eVV.bat

                                              Filesize

                                              221B

                                              MD5

                                              0144ab8c39b114a4a0ce83f9824b7d69

                                              SHA1

                                              39ac61d0bb8c072b1b4b65690a28f98d74b3c09d

                                              SHA256

                                              75b4400420d3f1f45dfbf479651ce5b40ce06bdf776f775fcbe58a7d9941df7b

                                              SHA512

                                              980166e40f4118025afc7bf0a7d7f4b398ae688d09c91bf310f8366db25878d08a6bf8361ff7f2d196283f64f09b44ea6922a3abd4075ca4ab3464e3515dc3d7

                                            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vstex24f.hsq.ps1

                                              Filesize

                                              60B

                                              MD5

                                              d17fe0a3f47be24a6453e9ef58c94641

                                              SHA1

                                              6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                              SHA256

                                              96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                              SHA512

                                              5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                            • C:\Users\Admin\AppData\Local\Temp\gZmmY05In2.bat

                                              Filesize

                                              221B

                                              MD5

                                              fe2da22800e7aefccd7464914d6a77a8

                                              SHA1

                                              69c9e8ac6d70cc42c55b1ac3cae53e004e755330

                                              SHA256

                                              bb0d6a67a5b92ffa37711d1383834929ae54813199da1c948b29a13cf4da9ad3

                                              SHA512

                                              2470dc8f330c82e8e50a9ae15671f593c8f892259e98562d5f2615e1e26f358d681d9a8b1658bacb5c6d24aba7ffb19387a8f2d9859e7a2f723e2b1a9bb6ee09

                                            • C:\Users\Admin\AppData\Local\Temp\mNrvcGFykN.bat

                                              Filesize

                                              221B

                                              MD5

                                              2846451d2206df14befc939becdabe6e

                                              SHA1

                                              77942843137a677d633b81c43744180099119c90

                                              SHA256

                                              2aee9ec5d38d0232f3dc7ea3a60094e9a83f0a844a5aebc430b32bbdebfb652e

                                              SHA512

                                              2b4bc2dcfd2a0348a361094b212906a5518d963c331a229c57e60dc1038f98986db5e2374020367aaa21dc4a3d4dfa1c80781591863c3394f8a0b07b5864669d

                                            • C:\providercommon\1zu9dW.bat

                                              Filesize

                                              36B

                                              MD5

                                              6783c3ee07c7d151ceac57f1f9c8bed7

                                              SHA1

                                              17468f98f95bf504cc1f83c49e49a78526b3ea03

                                              SHA256

                                              8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

                                              SHA512

                                              c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

                                            • C:\providercommon\DllCommonsvc.exe

                                              Filesize

                                              1.0MB

                                              MD5

                                              bd31e94b4143c4ce49c17d3af46bcad0

                                              SHA1

                                              f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                              SHA256

                                              b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                              SHA512

                                              f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                            • C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

                                              Filesize

                                              197B

                                              MD5

                                              8088241160261560a02c84025d107592

                                              SHA1

                                              083121f7027557570994c9fc211df61730455bb5

                                              SHA256

                                              2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

                                              SHA512

                                              20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

                                            • memory/1060-215-0x0000000001900000-0x0000000001912000-memory.dmp

                                              Filesize

                                              72KB

                                            • memory/1164-68-0x0000020C44D30000-0x0000020C44D52000-memory.dmp

                                              Filesize

                                              136KB

                                            • memory/1712-178-0x0000000000C80000-0x0000000000C92000-memory.dmp

                                              Filesize

                                              72KB

                                            • memory/1916-159-0x0000000002310000-0x0000000002322000-memory.dmp

                                              Filesize

                                              72KB

                                            • memory/3092-152-0x0000000002DB0000-0x0000000002DC2000-memory.dmp

                                              Filesize

                                              72KB

                                            • memory/3188-17-0x0000000002850000-0x000000000285C000-memory.dmp

                                              Filesize

                                              48KB

                                            • memory/3188-14-0x0000000002820000-0x0000000002832000-memory.dmp

                                              Filesize

                                              72KB

                                            • memory/3188-15-0x0000000002840000-0x000000000284C000-memory.dmp

                                              Filesize

                                              48KB

                                            • memory/3188-16-0x0000000002830000-0x000000000283C000-memory.dmp

                                              Filesize

                                              48KB

                                            • memory/3188-13-0x0000000000600000-0x0000000000710000-memory.dmp

                                              Filesize

                                              1.1MB

                                            • memory/3188-12-0x00007FFDC3863000-0x00007FFDC3865000-memory.dmp

                                              Filesize

                                              8KB