Analysis
-
max time kernel
147s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2024, 19:36
Behavioral task
behavioral1
Sample
JaffaCakes118_d5b9de29cfe9f7e39de10a08b31e41bcc5abb783a6d39ae7c45237a18bf011b3.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_d5b9de29cfe9f7e39de10a08b31e41bcc5abb783a6d39ae7c45237a18bf011b3.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_d5b9de29cfe9f7e39de10a08b31e41bcc5abb783a6d39ae7c45237a18bf011b3.exe
-
Size
1.3MB
-
MD5
7eca7694e78a6975896268ad0c5948f5
-
SHA1
5e012926fde5f131c71c4e5f83f65298e75ec128
-
SHA256
d5b9de29cfe9f7e39de10a08b31e41bcc5abb783a6d39ae7c45237a18bf011b3
-
SHA512
2aa45b80fa311f52b8148fe1f222b2018f5975b5971c6ebb5b80493420bf8baaa3c50eefbb6a281e7e60c573f1323281112946a9d4894588e2fce5b60598d2dc
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Process spawned unexpected child process 48 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3412 4100 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 808 4100 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3988 4100 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3220 4100 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4964 4100 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2016 4100 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3284 4100 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3400 4100 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4472 4100 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4192 4100 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1360 4100 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2768 4100 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4160 4100 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4412 4100 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4672 4100 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 856 4100 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2060 4100 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1184 4100 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3836 4100 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4268 4100 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1356 4100 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1800 4100 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1632 4100 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4448 4100 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4128 4100 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4536 4100 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3764 4100 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 228 4100 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1968 4100 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4708 4100 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2688 4100 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2408 4100 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4692 4100 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4764 4100 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4068 4100 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 904 4100 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 388 4100 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2056 4100 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3800 4100 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4548 4100 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 376 4100 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1876 4100 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1664 4100 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2304 4100 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1568 4100 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1596 4100 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3968 4100 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4804 4100 schtasks.exe 88 -
resource yara_rule behavioral2/files/0x0007000000023c94-10.dat dcrat behavioral2/memory/396-13-0x00000000002D0000-0x00000000003E0000-memory.dmp dcrat -
Command and Scripting Interpreter: PowerShell 1 TTPs 17 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 3504 powershell.exe 3872 powershell.exe 2736 powershell.exe 4952 powershell.exe 2988 powershell.exe 3544 powershell.exe 4316 powershell.exe 2152 powershell.exe 4584 powershell.exe 1200 powershell.exe 2340 powershell.exe 964 powershell.exe 4640 powershell.exe 4648 powershell.exe 4484 powershell.exe 1888 powershell.exe 4084 powershell.exe -
Checks computer location settings 2 TTPs 14 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation sysmon.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation DllCommonsvc.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation sysmon.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation sysmon.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation sysmon.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation JaffaCakes118_d5b9de29cfe9f7e39de10a08b31e41bcc5abb783a6d39ae7c45237a18bf011b3.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation sysmon.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation sysmon.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation sysmon.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation sysmon.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation sysmon.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation sysmon.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation sysmon.exe -
Executes dropped EXE 12 IoCs
pid Process 396 DllCommonsvc.exe 1032 sysmon.exe 2028 sysmon.exe 3824 sysmon.exe 2700 sysmon.exe 1460 sysmon.exe 4360 sysmon.exe 4376 sysmon.exe 3064 sysmon.exe 3804 sysmon.exe 864 sysmon.exe 3840 sysmon.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 12 IoCs
flow ioc 36 raw.githubusercontent.com 37 raw.githubusercontent.com 41 raw.githubusercontent.com 47 raw.githubusercontent.com 48 raw.githubusercontent.com 50 raw.githubusercontent.com 20 raw.githubusercontent.com 34 raw.githubusercontent.com 49 raw.githubusercontent.com 51 raw.githubusercontent.com 19 raw.githubusercontent.com 40 raw.githubusercontent.com -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\Windows Media Player\es-ES\ea9f0e6c9e2dcd DllCommonsvc.exe File created C:\Program Files\Windows Media Player\es-ES\taskhostw.exe DllCommonsvc.exe -
Drops file in Windows directory 10 IoCs
description ioc Process File created C:\Windows\fr-FR\csrss.exe DllCommonsvc.exe File created C:\Windows\L2Schemas\sysmon.exe DllCommonsvc.exe File created C:\Windows\Media\Heritage\RuntimeBroker.exe DllCommonsvc.exe File created C:\Windows\Globalization\ICU\DllCommonsvc.exe DllCommonsvc.exe File created C:\Windows\Globalization\ICU\a76d7bf15d8370 DllCommonsvc.exe File created C:\Windows\fr-FR\886983d96e3d3e DllCommonsvc.exe File created C:\Windows\L2Schemas\121e5b5079f7c0 DllCommonsvc.exe File created C:\Windows\Media\Heritage\9e8d7a4ca61bd9 DllCommonsvc.exe File created C:\Windows\InputMethod\fontdrvhost.exe DllCommonsvc.exe File created C:\Windows\InputMethod\5b884080fd4f94 DllCommonsvc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_d5b9de29cfe9f7e39de10a08b31e41bcc5abb783a6d39ae7c45237a18bf011b3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies registry class 13 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings sysmon.exe Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings sysmon.exe Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings sysmon.exe Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings sysmon.exe Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings sysmon.exe Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings sysmon.exe Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings JaffaCakes118_d5b9de29cfe9f7e39de10a08b31e41bcc5abb783a6d39ae7c45237a18bf011b3.exe Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings DllCommonsvc.exe Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings sysmon.exe Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings sysmon.exe Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings sysmon.exe Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings sysmon.exe Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings sysmon.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 48 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1632 schtasks.exe 4128 schtasks.exe 228 schtasks.exe 1968 schtasks.exe 2688 schtasks.exe 4548 schtasks.exe 808 schtasks.exe 4160 schtasks.exe 4804 schtasks.exe 1356 schtasks.exe 4692 schtasks.exe 2056 schtasks.exe 376 schtasks.exe 1568 schtasks.exe 3400 schtasks.exe 2768 schtasks.exe 1876 schtasks.exe 1664 schtasks.exe 1184 schtasks.exe 3836 schtasks.exe 4536 schtasks.exe 3764 schtasks.exe 4192 schtasks.exe 856 schtasks.exe 4412 schtasks.exe 4764 schtasks.exe 3800 schtasks.exe 3968 schtasks.exe 3412 schtasks.exe 3220 schtasks.exe 1596 schtasks.exe 4268 schtasks.exe 4448 schtasks.exe 3284 schtasks.exe 4472 schtasks.exe 2060 schtasks.exe 4964 schtasks.exe 2016 schtasks.exe 4672 schtasks.exe 1800 schtasks.exe 4708 schtasks.exe 2408 schtasks.exe 4068 schtasks.exe 904 schtasks.exe 3988 schtasks.exe 1360 schtasks.exe 388 schtasks.exe 2304 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 396 DllCommonsvc.exe 396 DllCommonsvc.exe 396 DllCommonsvc.exe 396 DllCommonsvc.exe 396 DllCommonsvc.exe 396 DllCommonsvc.exe 396 DllCommonsvc.exe 396 DllCommonsvc.exe 396 DllCommonsvc.exe 396 DllCommonsvc.exe 396 DllCommonsvc.exe 4316 powershell.exe 4316 powershell.exe 4640 powershell.exe 4640 powershell.exe 3872 powershell.exe 3872 powershell.exe 2988 powershell.exe 2988 powershell.exe 2152 powershell.exe 2152 powershell.exe 1200 powershell.exe 1200 powershell.exe 964 powershell.exe 964 powershell.exe 1888 powershell.exe 1888 powershell.exe 3544 powershell.exe 3544 powershell.exe 2736 powershell.exe 2736 powershell.exe 4484 powershell.exe 4484 powershell.exe 4584 powershell.exe 4584 powershell.exe 2340 powershell.exe 2340 powershell.exe 3504 powershell.exe 3504 powershell.exe 4952 powershell.exe 4952 powershell.exe 4584 powershell.exe 4648 powershell.exe 4648 powershell.exe 4084 powershell.exe 4084 powershell.exe 4484 powershell.exe 3504 powershell.exe 2736 powershell.exe 4084 powershell.exe 2988 powershell.exe 4648 powershell.exe 1888 powershell.exe 4640 powershell.exe 4316 powershell.exe 4316 powershell.exe 3872 powershell.exe 2152 powershell.exe 3544 powershell.exe 964 powershell.exe 2340 powershell.exe 4952 powershell.exe 1200 powershell.exe 1032 sysmon.exe -
Suspicious use of AdjustPrivilegeToken 29 IoCs
description pid Process Token: SeDebugPrivilege 396 DllCommonsvc.exe Token: SeDebugPrivilege 4316 powershell.exe Token: SeDebugPrivilege 4640 powershell.exe Token: SeDebugPrivilege 2988 powershell.exe Token: SeDebugPrivilege 1888 powershell.exe Token: SeDebugPrivilege 4584 powershell.exe Token: SeDebugPrivilege 3504 powershell.exe Token: SeDebugPrivilege 3544 powershell.exe Token: SeDebugPrivilege 3872 powershell.exe Token: SeDebugPrivilege 2152 powershell.exe Token: SeDebugPrivilege 1200 powershell.exe Token: SeDebugPrivilege 964 powershell.exe Token: SeDebugPrivilege 2736 powershell.exe Token: SeDebugPrivilege 2340 powershell.exe Token: SeDebugPrivilege 4484 powershell.exe Token: SeDebugPrivilege 4648 powershell.exe Token: SeDebugPrivilege 4952 powershell.exe Token: SeDebugPrivilege 4084 powershell.exe Token: SeDebugPrivilege 1032 sysmon.exe Token: SeDebugPrivilege 2028 sysmon.exe Token: SeDebugPrivilege 3824 sysmon.exe Token: SeDebugPrivilege 2700 sysmon.exe Token: SeDebugPrivilege 1460 sysmon.exe Token: SeDebugPrivilege 4360 sysmon.exe Token: SeDebugPrivilege 4376 sysmon.exe Token: SeDebugPrivilege 3064 sysmon.exe Token: SeDebugPrivilege 3804 sysmon.exe Token: SeDebugPrivilege 864 sysmon.exe Token: SeDebugPrivilege 3840 sysmon.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4792 wrote to memory of 2108 4792 JaffaCakes118_d5b9de29cfe9f7e39de10a08b31e41bcc5abb783a6d39ae7c45237a18bf011b3.exe 83 PID 4792 wrote to memory of 2108 4792 JaffaCakes118_d5b9de29cfe9f7e39de10a08b31e41bcc5abb783a6d39ae7c45237a18bf011b3.exe 83 PID 4792 wrote to memory of 2108 4792 JaffaCakes118_d5b9de29cfe9f7e39de10a08b31e41bcc5abb783a6d39ae7c45237a18bf011b3.exe 83 PID 2108 wrote to memory of 368 2108 WScript.exe 85 PID 2108 wrote to memory of 368 2108 WScript.exe 85 PID 2108 wrote to memory of 368 2108 WScript.exe 85 PID 368 wrote to memory of 396 368 cmd.exe 87 PID 368 wrote to memory of 396 368 cmd.exe 87 PID 396 wrote to memory of 4084 396 DllCommonsvc.exe 138 PID 396 wrote to memory of 4084 396 DllCommonsvc.exe 138 PID 396 wrote to memory of 1888 396 DllCommonsvc.exe 139 PID 396 wrote to memory of 1888 396 DllCommonsvc.exe 139 PID 396 wrote to memory of 4484 396 DllCommonsvc.exe 140 PID 396 wrote to memory of 4484 396 DllCommonsvc.exe 140 PID 396 wrote to memory of 4316 396 DllCommonsvc.exe 141 PID 396 wrote to memory of 4316 396 DllCommonsvc.exe 141 PID 396 wrote to memory of 3504 396 DllCommonsvc.exe 142 PID 396 wrote to memory of 3504 396 DllCommonsvc.exe 142 PID 396 wrote to memory of 1200 396 DllCommonsvc.exe 143 PID 396 wrote to memory of 1200 396 DllCommonsvc.exe 143 PID 396 wrote to memory of 3872 396 DllCommonsvc.exe 144 PID 396 wrote to memory of 3872 396 DllCommonsvc.exe 144 PID 396 wrote to memory of 4584 396 DllCommonsvc.exe 145 PID 396 wrote to memory of 4584 396 DllCommonsvc.exe 145 PID 396 wrote to memory of 2340 396 DllCommonsvc.exe 146 PID 396 wrote to memory of 2340 396 DllCommonsvc.exe 146 PID 396 wrote to memory of 964 396 DllCommonsvc.exe 147 PID 396 wrote to memory of 964 396 DllCommonsvc.exe 147 PID 396 wrote to memory of 2736 396 DllCommonsvc.exe 148 PID 396 wrote to memory of 2736 396 DllCommonsvc.exe 148 PID 396 wrote to memory of 4640 396 DllCommonsvc.exe 149 PID 396 wrote to memory of 4640 396 DllCommonsvc.exe 149 PID 396 wrote to memory of 4952 396 DllCommonsvc.exe 150 PID 396 wrote to memory of 4952 396 DllCommonsvc.exe 150 PID 396 wrote to memory of 2988 396 DllCommonsvc.exe 151 PID 396 wrote to memory of 2988 396 DllCommonsvc.exe 151 PID 396 wrote to memory of 4648 396 DllCommonsvc.exe 152 PID 396 wrote to memory of 4648 396 DllCommonsvc.exe 152 PID 396 wrote to memory of 3544 396 DllCommonsvc.exe 153 PID 396 wrote to memory of 3544 396 DllCommonsvc.exe 153 PID 396 wrote to memory of 2152 396 DllCommonsvc.exe 154 PID 396 wrote to memory of 2152 396 DllCommonsvc.exe 154 PID 396 wrote to memory of 4540 396 DllCommonsvc.exe 171 PID 396 wrote to memory of 4540 396 DllCommonsvc.exe 171 PID 4540 wrote to memory of 1292 4540 cmd.exe 174 PID 4540 wrote to memory of 1292 4540 cmd.exe 174 PID 4540 wrote to memory of 1032 4540 cmd.exe 181 PID 4540 wrote to memory of 1032 4540 cmd.exe 181 PID 1032 wrote to memory of 2424 1032 sysmon.exe 189 PID 1032 wrote to memory of 2424 1032 sysmon.exe 189 PID 2424 wrote to memory of 3608 2424 cmd.exe 191 PID 2424 wrote to memory of 3608 2424 cmd.exe 191 PID 2424 wrote to memory of 2028 2424 cmd.exe 193 PID 2424 wrote to memory of 2028 2424 cmd.exe 193 PID 2028 wrote to memory of 2436 2028 sysmon.exe 198 PID 2028 wrote to memory of 2436 2028 sysmon.exe 198 PID 2436 wrote to memory of 1128 2436 cmd.exe 200 PID 2436 wrote to memory of 1128 2436 cmd.exe 200 PID 2436 wrote to memory of 3824 2436 cmd.exe 202 PID 2436 wrote to memory of 3824 2436 cmd.exe 202 PID 3824 wrote to memory of 4508 3824 sysmon.exe 204 PID 3824 wrote to memory of 4508 3824 sysmon.exe 204 PID 4508 wrote to memory of 3688 4508 cmd.exe 206 PID 4508 wrote to memory of 3688 4508 cmd.exe 206 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d5b9de29cfe9f7e39de10a08b31e41bcc5abb783a6d39ae7c45237a18bf011b3.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d5b9de29cfe9f7e39de10a08b31e41bcc5abb783a6d39ae7c45237a18bf011b3.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:368 -
C:\providercommon\DllCommonsvc.exe"C:\providercommon\DllCommonsvc.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:396 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4084
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\PrintHood\SppExtComObj.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1888
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Media Player\es-ES\taskhostw.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4484
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\dllhost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4316
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\fr-FR\csrss.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3504
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\conhost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1200
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\L2Schemas\sysmon.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3872
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Media\Heritage\RuntimeBroker.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4584
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Contacts\csrss.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2340
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\TextInputHost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:964
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\dllhost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2736
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Globalization\ICU\DllCommonsvc.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4640
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\fontdrvhost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4952
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\dllhost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2988
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\spoolsv.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4648
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\InputMethod\fontdrvhost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3544
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\Registry.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2152
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\eG1TJSfVtY.bat"5⤵
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:26⤵PID:1292
-
-
C:\Windows\L2Schemas\sysmon.exe"C:\Windows\L2Schemas\sysmon.exe"6⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1032 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\M53DwaTFc6.bat"7⤵
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:28⤵PID:3608
-
-
C:\Windows\L2Schemas\sysmon.exe"C:\Windows\L2Schemas\sysmon.exe"8⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Y23Kn3rQqK.bat"9⤵
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:210⤵PID:1128
-
-
C:\Windows\L2Schemas\sysmon.exe"C:\Windows\L2Schemas\sysmon.exe"10⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3824 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\5ixwcMXCIg.bat"11⤵
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:212⤵PID:3688
-
-
C:\Windows\L2Schemas\sysmon.exe"C:\Windows\L2Schemas\sysmon.exe"12⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2700 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\xjNnGM38uG.bat"13⤵PID:4472
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:214⤵PID:3480
-
-
C:\Windows\L2Schemas\sysmon.exe"C:\Windows\L2Schemas\sysmon.exe"14⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1460 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\cu7QADyCUt.bat"15⤵PID:2308
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:216⤵PID:1828
-
-
C:\Windows\L2Schemas\sysmon.exe"C:\Windows\L2Schemas\sysmon.exe"16⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4360 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\zfOrxS71E3.bat"17⤵PID:2888
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:218⤵PID:1000
-
-
C:\Windows\L2Schemas\sysmon.exe"C:\Windows\L2Schemas\sysmon.exe"18⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4376 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\IJ9EkrtYDM.bat"19⤵PID:512
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:220⤵PID:1912
-
-
C:\Windows\L2Schemas\sysmon.exe"C:\Windows\L2Schemas\sysmon.exe"20⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3064 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\guIa2jZB2U.bat"21⤵PID:1900
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:222⤵PID:3688
-
-
C:\Windows\L2Schemas\sysmon.exe"C:\Windows\L2Schemas\sysmon.exe"22⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3804 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\CMv1BFFgLz.bat"23⤵PID:3480
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:224⤵PID:2348
-
-
C:\Windows\L2Schemas\sysmon.exe"C:\Windows\L2Schemas\sysmon.exe"24⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:864 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Z7DRyUOV59.bat"25⤵PID:3400
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:226⤵PID:4568
-
-
C:\Windows\L2Schemas\sysmon.exe"C:\Windows\L2Schemas\sysmon.exe"26⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3840 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\VF9LbKHiRa.bat"27⤵PID:4004
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:228⤵PID:1184
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 11 /tr "'C:\Users\Default\PrintHood\SppExtComObj.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3412
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Users\Default\PrintHood\SppExtComObj.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:808
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 9 /tr "'C:\Users\Default\PrintHood\SppExtComObj.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3988
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Media Player\es-ES\taskhostw.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3220
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Program Files\Windows Media Player\es-ES\taskhostw.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4964
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Media Player\es-ES\taskhostw.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2016
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\providercommon\dllhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3284
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\providercommon\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3400
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\providercommon\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4472
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Windows\fr-FR\csrss.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4192
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\fr-FR\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1360
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Windows\fr-FR\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2768
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 5 /tr "'C:\providercommon\conhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4160
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\providercommon\conhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4412
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 10 /tr "'C:\providercommon\conhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4672
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmons" /sc MINUTE /mo 8 /tr "'C:\Windows\L2Schemas\sysmon.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:856
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Windows\L2Schemas\sysmon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2060
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmons" /sc MINUTE /mo 12 /tr "'C:\Windows\L2Schemas\sysmon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1184
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Windows\Media\Heritage\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3836
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\Media\Heritage\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4268
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Windows\Media\Heritage\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1356
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Users\Admin\Contacts\csrss.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1800
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Admin\Contacts\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1632
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\Contacts\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4448
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 14 /tr "'C:\providercommon\TextInputHost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4128
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\providercommon\TextInputHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4536
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 9 /tr "'C:\providercommon\TextInputHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3764
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\providercommon\dllhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:228
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\providercommon\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1968
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\providercommon\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4708
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 5 /tr "'C:\Windows\Globalization\ICU\DllCommonsvc.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2688
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\Windows\Globalization\ICU\DllCommonsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2408
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 14 /tr "'C:\Windows\Globalization\ICU\DllCommonsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4692
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\Users\Public\fontdrvhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4764
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\Public\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4068
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\Users\Public\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:904
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:388
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2056
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3800
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 9 /tr "'C:\Users\Default\spoolsv.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4548
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Users\Default\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:376
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 10 /tr "'C:\Users\Default\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1876
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\Windows\InputMethod\fontdrvhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1664
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\InputMethod\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2304
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Windows\InputMethod\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1568
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 12 /tr "'C:\providercommon\Registry.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1596
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\providercommon\Registry.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3968
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 10 /tr "'C:\providercommon\Registry.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4804
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5440cb38dbee06645cc8b74d51f6e5f71
SHA1d7e61da91dc4502e9ae83281b88c1e48584edb7c
SHA2568ef7a682dfd99ff5b7e9de0e1be43f0016d68695a43c33c028af2635cc15ecfe
SHA5123aab19578535e6ba0f6beb5690c87d970292100704209d2dcebddcdd46c6bead27588ef5d98729bfd50606a54cc1edf608b3d15bef42c13b9982aaaf15de7fd6
-
Filesize
1KB
MD5baf55b95da4a601229647f25dad12878
SHA1abc16954ebfd213733c4493fc1910164d825cac8
SHA256ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
SHA51224f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545
-
Filesize
944B
MD577d622bb1a5b250869a3238b9bc1402b
SHA1d47f4003c2554b9dfc4c16f22460b331886b191b
SHA256f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb
SHA512d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9
-
Filesize
944B
MD5d28a889fd956d5cb3accfbaf1143eb6f
SHA1157ba54b365341f8ff06707d996b3635da8446f7
SHA25621e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45
SHA5120b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c
-
Filesize
944B
MD562623d22bd9e037191765d5083ce16a3
SHA14a07da6872672f715a4780513d95ed8ddeefd259
SHA25695d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010
SHA5129a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992
-
Filesize
944B
MD53a6bad9528f8e23fb5c77fbd81fa28e8
SHA1f127317c3bc6407f536c0f0600dcbcf1aabfba36
SHA256986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05
SHA512846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2
-
Filesize
944B
MD5cadef9abd087803c630df65264a6c81c
SHA1babbf3636c347c8727c35f3eef2ee643dbcc4bd2
SHA256cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438
SHA5127278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085
-
Filesize
944B
MD5bd5940f08d0be56e65e5f2aaf47c538e
SHA1d7e31b87866e5e383ab5499da64aba50f03e8443
SHA2562d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6
SHA512c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406
-
Filesize
944B
MD5a8e8360d573a4ff072dcc6f09d992c88
SHA13446774433ceaf0b400073914facab11b98b6807
SHA256bf5e284e8f95122bf75ead61c7e2b40f55c96742b05330b5b1cb7915991df13b
SHA5124ee5167643d82082f57c42616007ef9be57f43f9731921bdf7bca611a914724ad94072d3c8f5b130fa54129e5328ccdebf37ba74339c37deb53e79df5cdf0dbe
-
Filesize
944B
MD5aaaac7c68d2b7997ed502c26fd9f65c2
SHA17c5a3731300d672bf53c43e2f9e951c745f7fbdf
SHA2568724dc2c3c8e8f17aeefae44a23741b1ea3b43c490fbc52fd61575ffe1cd82bb
SHA512c526febd9430413b48bed976edd9a795793ad1f06c8ff4f6b768b4ad63f4d2f06b9da72d4fcfa7cb9530a64e2dc3554f5ad97fd0ab60129701d175f2724ef1ac
-
Filesize
196B
MD5a5b1daf05e66343b427ee63a461a5c7e
SHA15df069bf8d09cfd391119b405a57986aace681ba
SHA256a23a113c4deb3cb2de03d98f71a293ce3db442c44bc407268d99df52ed227975
SHA5121647052ebaae0fd1854571a1f8f070a3819e8b5c92ec7405d1cf36910dd499034266bc1e68332f5f26a5cb27f32705b1e3b5d53440a54d09d71c851f75e4268e
-
Filesize
196B
MD532d582dea498e25d24d3f5cf2ce387a9
SHA1bf3e0d5c78027523d7c8996cc9c5a72dcf642d54
SHA25653b0411e0c6e3ac5dee55bc473467330c3c5a28eab4ed3d88eed3fae665f697d
SHA512e7613fb4a7a9820f67463f433dd5b7622537f9a3db90ffc189837c6534dbda9aad006ba59edf2f2c63a13c433e3730e1247ce9c2407ffbe1c2cb0511b5be9b75
-
Filesize
196B
MD5c91075272de317699bb31bd78930cb34
SHA10aa97f7b25d1d4cb545fa6b44d897c8fbdda9e4d
SHA25617239236d1bcefc38483ca778702beb8532e9a4694e80af1ce0ccc36cbef69d7
SHA512cab20dfb10cb62d56e901573b20514a8b3c399ec176d29633edc968fc74760ed2fca863d8ad9861ba303f8c406352dc94a14705930496215dcf9a00288c9ff9a
-
Filesize
196B
MD5213d139baeafbfcfee9340ad037e0093
SHA1bc6aa0580e9a5e2e8fbbcf933c14d686efc16075
SHA2566081ba344586a8b15c68e5eee799c3e8d031f24e2dfff7406603898aef777cda
SHA5129cd85584aaf5a9e7ab4afc3d4a1f1abf677503e1328edbcde0c6904af7413ee12e9ee461d0965b1c73bec5b2da7960341db0b95f06d6f76d29a4fcd06d6054b9
-
Filesize
196B
MD540743fa8ebb67e583e1883a6923f7eec
SHA1d84748cc92be9d478d880bd21d7925adaf68c451
SHA256a3d03935a486257a122e0fda219836a032e0d8a1495df274effd5db637eb078f
SHA512626e74bb2cfd418a3f74ae5b0456b472ddbf06c9e1e9ca2c6722ba864d6b6dce8f0d1cd870a817badc427de783e46d890de380136ac6f0b3f8b36dd3d9fa1a20
-
Filesize
196B
MD5dc0d4f0d031395a55530f73a210dc77a
SHA1e3c1f14354d991b1bcf166a0625f806fb2c4f915
SHA2562558738a6828341d9a3c0093ab6028f1819bdd5e28fc3745930b670c084e6433
SHA512a563c2498a6257447d4bb2d951efe97ba68ff861c5c22231e75788705107891e6f5b0c73a1110710d2fd3967c1eebfc1ed10972d7e9b42b524029eed56ea0c8d
-
Filesize
196B
MD5c1d3426a8e8d09d4b033a9d470371581
SHA1499c5fc6543064ac37a761c852dd09c3194b0ec8
SHA256ee57e33d18ce5f68819fbf1b4db66e20af000ebed5009c155377d6a55d74b84a
SHA512d78707b39a97803dbc88aea29ff6c183343edb058462c8dfab146583c358e29a64c2f7ba4ddef7bc45be85a05cff34e0b22882ca177d137504bb4e2470404788
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
196B
MD5d28f8720e748961c899e7a3058dfa2c0
SHA16c34d676d15d206b1eca69def4d2580c7d9c4123
SHA256a119f0563ff060759b456be7a513bce779154f52113c17dbd22bde6fc6d14e25
SHA51208d96f963bf87b6a66c95b73b59ece5a0c4991fa4900cb30a7244215801546fa836750e844aa3a86108590a6927d16ef53a3d26ce6567d54c37370349ba2b86e
-
Filesize
196B
MD5bef11beebf9fa017e129b8a884495369
SHA1756b70f2f08fef4c52e4dea5e5baef1f93cbf8a2
SHA2565c1d696c2fbf5a7f834c333b5454b7cfefae7f3567b7e8e7007c15318cb34fd1
SHA51278ff951bd401e66ffa77848a5e671ec5a6df63e94da361939eb772a732dab459fde0bd9dcb4edcb432122c7ca8bda770572eec5999d7dd74ec99977b135c2ff0
-
Filesize
196B
MD515b01f5128f7f55a498fde808cdefdd4
SHA1fee945c0b58c64584885f3092ba51beccecfdb6e
SHA25680d191ec648a5b2fe629432525f5d6b0a15fccb283803a8378e4bc11c50ab26b
SHA512e1900ea392cc6af8f790d085037d993f29867fc87fc41b8144d417d87a763134e72a641ee1ea5cc3e892ab305a7f84527172cfa1ff51b712518d9b881edb57ce
-
Filesize
196B
MD557baf877a1ea5c26f5464e3dbe2679df
SHA126bcd00f525f155e784880be22385da5af3063c0
SHA256186d3d5c7c59ff9ae83b121abcf7111a9fdc764eecf206c9fea2ee6cb76b7318
SHA5129e05b549f0365e7896ed28e2a7908cff39bf22a03217884eebae6b3d6413737632449165f742000d2b1d16931f076261e35ffd3e759c1c0f2bf6ba5f6e2cbe4d
-
Filesize
196B
MD56711decb961aea3939dcdcef1fe475fa
SHA16b7b0540fcc9fc6c90a315b746b9b6279e08d15c
SHA25618ee0e51d280fef8df23940525ce4ffd43264cc90478c65f8e41cbb7717e45b9
SHA51289fc3c438a56e39434bc0499c4909ec48985d0798d871dae025416b15bf6b813b1f9094bd300893fcd53541b970e8f60b35a92bff1e5389e9cd9a8388763448a
-
Filesize
36B
MD56783c3ee07c7d151ceac57f1f9c8bed7
SHA117468f98f95bf504cc1f83c49e49a78526b3ea03
SHA2568ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322
SHA512c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8
-
Filesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
Filesize
197B
MD58088241160261560a02c84025d107592
SHA1083121f7027557570994c9fc211df61730455bb5
SHA2562072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1
SHA51220d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478