dcrat | 22d82c0ce9e11edaebaa4dbf351e2e9cc144060f0c2b6e42918d6485d96a5ebf

Analysis

max time kernel
146s
max time network
148s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
01/11/2022, 01:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
22d82c0ce9e11edaebaa4dbf351e2e9cc144060f0c2b6e42918d6485d96a5ebf.exe
Size 1.3MB
Sample221101-b2nsesfhel
SHA256 22d82c0ce9e11edaebaa4dbf351e2e9cc144060f0c2b6e42918d6485d96a5ebf
MD5 6e54599378ea115e63eaf4ad2484cdad
SHA1 dfb2091e633165604ca64441bcbf1ee5ef5b56d2
SHA512 edcdc477a9d8b08a1c4c4e6362a7910e1d87373713fdc43e245a4197ffb882216cb9b731082db207f7e231ae191ef39c73d0725b02ddfb2826e1e8c0d9df82fe
SSDEEP 24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 51 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4456	4752	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3136	4752	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4264	4752	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4228	4752	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3032	4752	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4568	4752	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2928	4752	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3368	4752	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5020	4752	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4900	4752	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4912	4752	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4580	4752	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3180	4752	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4536	4752	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4584	4752	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4220	4752	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4496	4752	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4476	4752	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4424	4752	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4608	4752	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4380	4752	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4444	4752	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4376	4752	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	748	4752	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	416	4752	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3156	4752	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3200	4752	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3760	4752	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1048	4752	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	412	4752	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1284	4752	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	68	4752	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1012	4752	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	924	4752	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1260	4752	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	744	4752	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4620	4752	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1572	4752	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3348	4752	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	216	4752	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	32	4752	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2312	4752	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2220	4752	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2208	4752	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1868	4752	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	752	4752	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1944	4752	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2912	4752	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2508	4752	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2484	4752	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1948	4752	schtasks.exe	70

DCRat payload 15 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x000800000001ac2e-280.dat	dcrat
behavioral1/files/0x000800000001ac2e-281.dat	dcrat
behavioral1/memory/3936-282-0x0000000000E80000-0x0000000000F90000-memory.dmp	dcrat
behavioral1/files/0x000700000001ac6d-375.dat	dcrat
behavioral1/files/0x000700000001ac6d-374.dat	dcrat
behavioral1/files/0x000700000001ac6d-916.dat	dcrat
behavioral1/files/0x000700000001ac6d-923.dat	dcrat
behavioral1/files/0x000700000001ac6d-929.dat	dcrat
behavioral1/files/0x000700000001ac6d-934.dat	dcrat
behavioral1/files/0x000700000001ac6d-939.dat	dcrat
behavioral1/files/0x000700000001ac6d-945.dat	dcrat
behavioral1/files/0x000700000001ac6d-951.dat	dcrat
behavioral1/files/0x000700000001ac6d-957.dat	dcrat
behavioral1/files/0x000700000001ac6d-962.dat	dcrat
behavioral1/files/0x000700000001ac6d-968.dat	dcrat

Executes dropped EXE 12 IoCs

pid	Process
3936	DllCommonsvc.exe
776	winlogon.exe
5152	winlogon.exe
2252	winlogon.exe
5600	winlogon.exe
5936	winlogon.exe
4732	winlogon.exe
6068	winlogon.exe
6084	winlogon.exe
1048	winlogon.exe
4656	winlogon.exe
3652	winlogon.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Reference Assemblies\csrss.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Reference Assemblies\886983d96e3d3e	DllCommonsvc.exe
File created	C:\Program Files\Windows Portable Devices\RuntimeBroker.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Portable Devices\9e8d7a4ca61bd9	DllCommonsvc.exe
File created	C:\Program Files (x86)\MSBuild\OfficeClickToRun.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\MSBuild\e6c9b481da804f	DllCommonsvc.exe

Drops file in Windows directory 7 IoCs

description	ioc	Process
File created	C:\Windows\Performance\WinSAT\DataStore\lsass.exe	DllCommonsvc.exe
File created	C:\Windows\Performance\WinSAT\DataStore\6203df4a6bafc7	DllCommonsvc.exe
File created	C:\Windows\rescache\_merged\2483382631\wininit.exe	DllCommonsvc.exe
File created	C:\Windows\Speech_OneCore\Engines\Lexicon\System.exe	DllCommonsvc.exe
File created	C:\Windows\Speech_OneCore\Engines\Lexicon\27d1bcfc3c54e0	DllCommonsvc.exe
File created	C:\Windows\INF\PERFLIB\040C\OfficeClickToRun.exe	DllCommonsvc.exe
File created	C:\Windows\INF\PERFLIB\040C\e6c9b481da804f	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 51 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3032	schtasks.exe
4476	schtasks.exe
4608	schtasks.exe
4380	schtasks.exe
1944	schtasks.exe
924	schtasks.exe
4900	schtasks.exe
4536	schtasks.exe
4496	schtasks.exe
416	schtasks.exe
3760	schtasks.exe
412	schtasks.exe
1284	schtasks.exe
32	schtasks.exe
2928	schtasks.exe
3368	schtasks.exe
4444	schtasks.exe
748	schtasks.exe
3156	schtasks.exe
1048	schtasks.exe
744	schtasks.exe
2220	schtasks.exe
752	schtasks.exe
4568	schtasks.exe
5020	schtasks.exe
3200	schtasks.exe
68	schtasks.exe
1260	schtasks.exe
2312	schtasks.exe
4912	schtasks.exe
3180	schtasks.exe
4584	schtasks.exe
4220	schtasks.exe
1868	schtasks.exe
4264	schtasks.exe
4580	schtasks.exe
4424	schtasks.exe
1012	schtasks.exe
4620	schtasks.exe
1572	schtasks.exe
216	schtasks.exe
4456	schtasks.exe
3136	schtasks.exe
4376	schtasks.exe
3348	schtasks.exe
2484	schtasks.exe
1948	schtasks.exe
4228	schtasks.exe
2208	schtasks.exe
2912	schtasks.exe
2508	schtasks.exe

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	22d82c0ce9e11edaebaa4dbf351e2e9cc144060f0c2b6e42918d6485d96a5ebf.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3936	DllCommonsvc.exe
3936	DllCommonsvc.exe
3936	DllCommonsvc.exe
3936	DllCommonsvc.exe
3936	DllCommonsvc.exe
3936	DllCommonsvc.exe
3936	DllCommonsvc.exe
3936	DllCommonsvc.exe
3936	DllCommonsvc.exe
3912	powershell.exe
3912	powershell.exe
2192	powershell.exe
2192	powershell.exe
3912	powershell.exe
2720	powershell.exe
2720	powershell.exe
2192	powershell.exe
2720	powershell.exe
3044	powershell.exe
3044	powershell.exe
1728	powershell.exe
1728	powershell.exe
4684	powershell.exe
4684	powershell.exe
3912	powershell.exe
4484	powershell.exe
4484	powershell.exe
340	powershell.exe
340	powershell.exe
4804	powershell.exe
4804	powershell.exe
4684	powershell.exe
4176	powershell.exe
4176	powershell.exe
352	powershell.exe
352	powershell.exe
4484	powershell.exe
2136	powershell.exe
2136	powershell.exe
2788	powershell.exe
2788	powershell.exe
1204	powershell.exe
1204	powershell.exe
4884	powershell.exe
4884	powershell.exe
2720	powershell.exe
4432	powershell.exe
4432	powershell.exe
2192	powershell.exe
4856	powershell.exe
4856	powershell.exe
1728	powershell.exe
3044	powershell.exe
4684	powershell.exe
4484	powershell.exe
776	winlogon.exe
776	winlogon.exe
340	powershell.exe
4804	powershell.exe
2788	powershell.exe
4176	powershell.exe
1204	powershell.exe
352	powershell.exe
2136	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3936	DllCommonsvc.exe
Token: SeDebugPrivilege	3912	powershell.exe
Token: SeDebugPrivilege	2192	powershell.exe
Token: SeDebugPrivilege	2720	powershell.exe
Token: SeDebugPrivilege	3044	powershell.exe
Token: SeDebugPrivilege	1728	powershell.exe
Token: SeDebugPrivilege	4684	powershell.exe
Token: SeDebugPrivilege	4484	powershell.exe
Token: SeDebugPrivilege	340	powershell.exe
Token: SeDebugPrivilege	4804	powershell.exe
Token: SeDebugPrivilege	4176	powershell.exe
Token: SeDebugPrivilege	352	powershell.exe
Token: SeDebugPrivilege	2136	powershell.exe
Token: SeDebugPrivilege	2788	powershell.exe
Token: SeDebugPrivilege	1204	powershell.exe
Token: SeDebugPrivilege	4884	powershell.exe
Token: SeDebugPrivilege	4432	powershell.exe
Token: SeDebugPrivilege	4856	powershell.exe
Token: SeDebugPrivilege	776	winlogon.exe
Token: SeIncreaseQuotaPrivilege	3912	powershell.exe
Token: SeSecurityPrivilege	3912	powershell.exe
Token: SeTakeOwnershipPrivilege	3912	powershell.exe
Token: SeLoadDriverPrivilege	3912	powershell.exe
Token: SeSystemProfilePrivilege	3912	powershell.exe
Token: SeSystemtimePrivilege	3912	powershell.exe
Token: SeProfSingleProcessPrivilege	3912	powershell.exe
Token: SeIncBasePriorityPrivilege	3912	powershell.exe
Token: SeCreatePagefilePrivilege	3912	powershell.exe
Token: SeBackupPrivilege	3912	powershell.exe
Token: SeRestorePrivilege	3912	powershell.exe
Token: SeShutdownPrivilege	3912	powershell.exe
Token: SeDebugPrivilege	3912	powershell.exe
Token: SeSystemEnvironmentPrivilege	3912	powershell.exe
Token: SeRemoteShutdownPrivilege	3912	powershell.exe
Token: SeUndockPrivilege	3912	powershell.exe
Token: SeManageVolumePrivilege	3912	powershell.exe
Token: 33	3912	powershell.exe
Token: 34	3912	powershell.exe
Token: 35	3912	powershell.exe
Token: 36	3912	powershell.exe
Token: SeIncreaseQuotaPrivilege	2720	powershell.exe
Token: SeSecurityPrivilege	2720	powershell.exe
Token: SeTakeOwnershipPrivilege	2720	powershell.exe
Token: SeLoadDriverPrivilege	2720	powershell.exe
Token: SeSystemProfilePrivilege	2720	powershell.exe
Token: SeSystemtimePrivilege	2720	powershell.exe
Token: SeProfSingleProcessPrivilege	2720	powershell.exe
Token: SeIncBasePriorityPrivilege	2720	powershell.exe
Token: SeCreatePagefilePrivilege	2720	powershell.exe
Token: SeBackupPrivilege	2720	powershell.exe
Token: SeRestorePrivilege	2720	powershell.exe
Token: SeShutdownPrivilege	2720	powershell.exe
Token: SeDebugPrivilege	2720	powershell.exe
Token: SeSystemEnvironmentPrivilege	2720	powershell.exe
Token: SeRemoteShutdownPrivilege	2720	powershell.exe
Token: SeUndockPrivilege	2720	powershell.exe
Token: SeManageVolumePrivilege	2720	powershell.exe
Token: 33	2720	powershell.exe
Token: 34	2720	powershell.exe
Token: 35	2720	powershell.exe
Token: 36	2720	powershell.exe
Token: SeIncreaseQuotaPrivilege	2192	powershell.exe
Token: SeSecurityPrivilege	2192	powershell.exe
Token: SeTakeOwnershipPrivilege	2192	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2668 wrote to memory of 4768	2668	22d82c0ce9e11edaebaa4dbf351e2e9cc144060f0c2b6e42918d6485d96a5ebf.exe	66
PID 2668 wrote to memory of 4768	2668	22d82c0ce9e11edaebaa4dbf351e2e9cc144060f0c2b6e42918d6485d96a5ebf.exe	66
PID 2668 wrote to memory of 4768	2668	22d82c0ce9e11edaebaa4dbf351e2e9cc144060f0c2b6e42918d6485d96a5ebf.exe	66
PID 4768 wrote to memory of 3680	4768	WScript.exe	67
PID 4768 wrote to memory of 3680	4768	WScript.exe	67
PID 4768 wrote to memory of 3680	4768	WScript.exe	67
PID 3680 wrote to memory of 3936	3680	cmd.exe	69
PID 3680 wrote to memory of 3936	3680	cmd.exe	69
PID 3936 wrote to memory of 2192	3936	DllCommonsvc.exe	122
PID 3936 wrote to memory of 2192	3936	DllCommonsvc.exe	122
PID 3936 wrote to memory of 2068	3936	DllCommonsvc.exe	157
PID 3936 wrote to memory of 2068	3936	DllCommonsvc.exe	157
PID 3936 wrote to memory of 3912	3936	DllCommonsvc.exe	123
PID 3936 wrote to memory of 3912	3936	DllCommonsvc.exe	123
PID 3936 wrote to memory of 2720	3936	DllCommonsvc.exe	124
PID 3936 wrote to memory of 2720	3936	DllCommonsvc.exe	124
PID 3936 wrote to memory of 3044	3936	DllCommonsvc.exe	128
PID 3936 wrote to memory of 3044	3936	DllCommonsvc.exe	128
PID 3936 wrote to memory of 1728	3936	DllCommonsvc.exe	126
PID 3936 wrote to memory of 1728	3936	DllCommonsvc.exe	126
PID 3936 wrote to memory of 4684	3936	DllCommonsvc.exe	129
PID 3936 wrote to memory of 4684	3936	DllCommonsvc.exe	129
PID 3936 wrote to memory of 4484	3936	DllCommonsvc.exe	130
PID 3936 wrote to memory of 4484	3936	DllCommonsvc.exe	130
PID 3936 wrote to memory of 340	3936	DllCommonsvc.exe	131
PID 3936 wrote to memory of 340	3936	DllCommonsvc.exe	131
PID 3936 wrote to memory of 4804	3936	DllCommonsvc.exe	150
PID 3936 wrote to memory of 4804	3936	DllCommonsvc.exe	150
PID 3936 wrote to memory of 2136	3936	DllCommonsvc.exe	132
PID 3936 wrote to memory of 2136	3936	DllCommonsvc.exe	132
PID 3936 wrote to memory of 352	3936	DllCommonsvc.exe	133
PID 3936 wrote to memory of 352	3936	DllCommonsvc.exe	133
PID 3936 wrote to memory of 4176	3936	DllCommonsvc.exe	147
PID 3936 wrote to memory of 4176	3936	DllCommonsvc.exe	147
PID 3936 wrote to memory of 1204	3936	DllCommonsvc.exe	146
PID 3936 wrote to memory of 1204	3936	DllCommonsvc.exe	146
PID 3936 wrote to memory of 2788	3936	DllCommonsvc.exe	136
PID 3936 wrote to memory of 2788	3936	DllCommonsvc.exe	136
PID 3936 wrote to memory of 4884	3936	DllCommonsvc.exe	144
PID 3936 wrote to memory of 4884	3936	DllCommonsvc.exe	144
PID 3936 wrote to memory of 4432	3936	DllCommonsvc.exe	138
PID 3936 wrote to memory of 4432	3936	DllCommonsvc.exe	138
PID 3936 wrote to memory of 4856	3936	DllCommonsvc.exe	139
PID 3936 wrote to memory of 4856	3936	DllCommonsvc.exe	139
PID 3936 wrote to memory of 776	3936	DllCommonsvc.exe	158
PID 3936 wrote to memory of 776	3936	DllCommonsvc.exe	158
PID 776 wrote to memory of 5412	776	winlogon.exe	160
PID 776 wrote to memory of 5412	776	winlogon.exe	160
PID 5412 wrote to memory of 5708	5412	cmd.exe	162
PID 5412 wrote to memory of 5708	5412	cmd.exe	162
PID 5412 wrote to memory of 5152	5412	cmd.exe	163
PID 5412 wrote to memory of 5152	5412	cmd.exe	163
PID 5152 wrote to memory of 5296	5152	winlogon.exe	164
PID 5152 wrote to memory of 5296	5152	winlogon.exe	164
PID 5296 wrote to memory of 5368	5296	cmd.exe	166
PID 5296 wrote to memory of 5368	5296	cmd.exe	166
PID 5296 wrote to memory of 2252	5296	cmd.exe	167
PID 5296 wrote to memory of 2252	5296	cmd.exe	167
PID 2252 wrote to memory of 2036	2252	winlogon.exe	168
PID 2252 wrote to memory of 2036	2252	winlogon.exe	168
PID 2036 wrote to memory of 5544	2036	cmd.exe	170
PID 2036 wrote to memory of 5544	2036	cmd.exe	170
PID 2036 wrote to memory of 5600	2036	cmd.exe	171
PID 2036 wrote to memory of 5600	2036	cmd.exe	171

C:\Users\Admin\AppData\Local\Temp\22d82c0ce9e11edaebaa4dbf351e2e9cc144060f0c2b6e42918d6485d96a5ebf.exe
"C:\Users\Admin\AppData\Local\Temp\22d82c0ce9e11edaebaa4dbf351e2e9cc144060f0c2b6e42918d6485d96a5ebf.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2668
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4768
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3680
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3936
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2192
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Reference Assemblies\csrss.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3912
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Portable Devices\RuntimeBroker.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2720
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\INF\PERFLIB\040C\OfficeClickToRun.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1728
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Speech_OneCore\Engines\Lexicon\System.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3044
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Temp\Crashpad\reports\conhost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4684
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Saved Games\fontdrvhost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4484
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Performance\WinSAT\DataStore\lsass.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:340
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\smss.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2136
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\ShellExperienceHost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:352
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\services.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2788
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\RuntimeBroker.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4432
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\MSBuild\OfficeClickToRun.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4856
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\winlogon.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4884
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\fontdrvhost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1204
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\sppsvc.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4176
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\Idle.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4804
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\fontdrvhost.exe'
        5⤵
        
        PID:2068
    - - C:\Users\Public\Videos\winlogon.exe
        
        "C:\Users\Public\Videos\winlogon.exe"
        5⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:776
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\iRE9Vp3kbL.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:5412
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:5708
        
        C:\Users\Public\Videos\winlogon.exe
        
        "C:\Users\Public\Videos\winlogon.exe"
        7⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5152
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Iu2jWrKESR.bat"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:5296
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:5368
        
        C:\Users\Public\Videos\winlogon.exe
        
        "C:\Users\Public\Videos\winlogon.exe"
        9⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2252
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\eTpA0L9dlX.bat"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:2036
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:5544
        
        C:\Users\Public\Videos\winlogon.exe
        
        "C:\Users\Public\Videos\winlogon.exe"
        11⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5600
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\UQ4uSu8U9J.bat"
        12⤵
        
        PID:5712
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:5924
        
        C:\Users\Public\Videos\winlogon.exe
        
        "C:\Users\Public\Videos\winlogon.exe"
        13⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5936
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\aMI81VmL1g.bat"
        14⤵
        
        PID:3348
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        15⤵
        
        PID:5136
        
        C:\Users\Public\Videos\winlogon.exe
        
        "C:\Users\Public\Videos\winlogon.exe"
        15⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4732
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\mJIFszAWFu.bat"
        16⤵
        
        PID:1376
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        17⤵
        
        PID:3904
        
        C:\Users\Public\Videos\winlogon.exe
        
        "C:\Users\Public\Videos\winlogon.exe"
        17⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:6068
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\qzqLwOyuSO.bat"
        18⤵
        
        PID:2716
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        19⤵
        
        PID:200
        
        C:\Users\Public\Videos\winlogon.exe
        
        "C:\Users\Public\Videos\winlogon.exe"
        19⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:6084
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\RdAvGBYmjZ.bat"
        20⤵
        
        PID:4868
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        21⤵
        
        PID:4048
        
        C:\Users\Public\Videos\winlogon.exe
        
        "C:\Users\Public\Videos\winlogon.exe"
        21⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1048
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Ap6i2Y3psm.bat"
        22⤵
        
        PID:4412
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        23⤵
        
        PID:1948
        
        C:\Users\Public\Videos\winlogon.exe
        
        "C:\Users\Public\Videos\winlogon.exe"
        23⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4656
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Nflxmifgtk.bat"
        24⤵
        
        PID:5532
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        25⤵
        
        PID:4772
        
        C:\Users\Public\Videos\winlogon.exe
        
        "C:\Users\Public\Videos\winlogon.exe"
        25⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3652
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\HcCr6nEVp7.bat"
        26⤵
        
        PID:4776
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        27⤵
        
        PID:4336

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4456

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3136

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4264

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Reference Assemblies\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Reference Assemblies\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Portable Devices\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3368

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Portable Devices\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 13 /tr "'C:\Windows\Speech_OneCore\Engines\Lexicon\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Windows\Speech_OneCore\Engines\Lexicon\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'C:\Windows\Speech_OneCore\Engines\Lexicon\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 9 /tr "'C:\Windows\INF\PERFLIB\040C\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3180

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Windows\INF\PERFLIB\040C\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 10 /tr "'C:\Windows\INF\PERFLIB\040C\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 11 /tr "'C:\Windows\Temp\Crashpad\reports\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Windows\Temp\Crashpad\reports\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 8 /tr "'C:\Windows\Temp\Crashpad\reports\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\Saved Games\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4424

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\Admin\Saved Games\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\Saved Games\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\Windows\Performance\WinSAT\DataStore\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\Performance\WinSAT\DataStore\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\Windows\Performance\WinSAT\DataStore\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 9 /tr "'C:\providercommon\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\providercommon\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\providercommon\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ShellExperienceHostS" /sc MINUTE /mo 11 /tr "'C:\providercommon\ShellExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ShellExperienceHost" /sc ONLOGON /tr "'C:\providercommon\ShellExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:68

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ShellExperienceHostS" /sc MINUTE /mo 9 /tr "'C:\providercommon\ShellExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 7 /tr "'C:\providercommon\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\providercommon\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1260

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 8 /tr "'C:\providercommon\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\providercommon\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\providercommon\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\providercommon\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:32

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2312

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'C:\Users\Public\Videos\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Users\Public\Videos\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'C:\Users\Public\Videos\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\odt\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\odt\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\odt\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\MSBuild\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\MSBuild\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1948

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Web Service

T1102

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...