dcrat | bee0b32350449cb47b2e50e57e0e09fe146e58a765974db35aa07f0007c4bc76

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
01/11/2022, 01:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bee0b32350449cb47b2e50e57e0e09fe146e58a765974db35aa07f0007c4bc76.exe
Size 1.3MB
Sample221101-b3dzlsfhem
SHA256 bee0b32350449cb47b2e50e57e0e09fe146e58a765974db35aa07f0007c4bc76
MD5 b17178a18de7b93baf3101cbc99cf7d7
SHA1 c9f75c6d5f7fdea9a6f20dcc4a9e145e131732a9
SHA512 d5def133e5dd848b9a40e98239b4611fe984a13a34c645dc4d2808e2d53ec49ba92c8b4289c2eb7c7e9e7e2d8823be3e6d82400326259a64d5dc146964bb03a5
SSDEEP 24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 48 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3964	2936	schtasks.exe	50
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4304	2936	schtasks.exe	50
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3660	2936	schtasks.exe	50
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3588	2936	schtasks.exe	50
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3464	2936	schtasks.exe	50
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4396	2936	schtasks.exe	50
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	212	2936	schtasks.exe	50
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4900	2936	schtasks.exe	50
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4544	2936	schtasks.exe	50
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4236	2936	schtasks.exe	50
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3816	2936	schtasks.exe	50
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1092	2936	schtasks.exe	50
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2312	2936	schtasks.exe	50
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1136	2936	schtasks.exe	50
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1872	2936	schtasks.exe	50
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2036	2936	schtasks.exe	50
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5060	2936	schtasks.exe	50
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4228	2936	schtasks.exe	50
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1816	2936	schtasks.exe	50
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1828	2936	schtasks.exe	50
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2864	2936	schtasks.exe	50
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3108	2936	schtasks.exe	50
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3456	2936	schtasks.exe	50
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3560	2936	schtasks.exe	50
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2784	2936	schtasks.exe	50
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1048	2936	schtasks.exe	50
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1412	2936	schtasks.exe	50
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4348	2936	schtasks.exe	50
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4388	2936	schtasks.exe	50
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	672	2936	schtasks.exe	50
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	432	2936	schtasks.exe	50
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4628	2936	schtasks.exe	50
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	820	2936	schtasks.exe	50
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4884	2936	schtasks.exe	50
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1284	2936	schtasks.exe	50
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2604	2936	schtasks.exe	50
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4656	2936	schtasks.exe	50
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4540	2936	schtasks.exe	50
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	536	2936	schtasks.exe	50
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1652	2936	schtasks.exe	50
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2352	2936	schtasks.exe	50
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2296	2936	schtasks.exe	50
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3944	2936	schtasks.exe	50
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	920	2936	schtasks.exe	50
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4880	2936	schtasks.exe	50
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4084	2936	schtasks.exe	50
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1020	2936	schtasks.exe	50
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	508	2936	schtasks.exe	50

DCRat payload 14 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0002000000022e0c-137.dat	dcrat
behavioral1/files/0x0002000000022e0c-138.dat	dcrat
behavioral1/memory/2364-139-0x0000000000BC0000-0x0000000000CD0000-memory.dmp	dcrat
behavioral1/files/0x0001000000022e3a-164.dat	dcrat
behavioral1/files/0x0001000000022e3a-163.dat	dcrat
behavioral1/files/0x0001000000022e3a-220.dat	dcrat
behavioral1/files/0x0001000000022e3a-228.dat	dcrat
behavioral1/files/0x0001000000022e3a-235.dat	dcrat
behavioral1/files/0x0001000000022e3a-242.dat	dcrat
behavioral1/files/0x0001000000022e3a-249.dat	dcrat
behavioral1/files/0x0001000000022e3a-256.dat	dcrat
behavioral1/files/0x0001000000022e3a-263.dat	dcrat
behavioral1/files/0x0001000000022e3a-270.dat	dcrat
behavioral1/files/0x0001000000022e3a-277.dat	dcrat

Executes dropped EXE 11 IoCs

pid	Process
2364	DllCommonsvc.exe
672	RuntimeBroker.exe
6032	RuntimeBroker.exe
2364	RuntimeBroker.exe
2552	RuntimeBroker.exe
3184	RuntimeBroker.exe
4568	RuntimeBroker.exe
5292	RuntimeBroker.exe
2004	RuntimeBroker.exe
5820	RuntimeBroker.exe
4332	RuntimeBroker.exe

Checks computer location settings 2 TTPs 13 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	bee0b32350449cb47b2e50e57e0e09fe146e58a765974db35aa07f0007c4bc76.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\csrss.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft\886983d96e3d3e	DllCommonsvc.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\DigitalLocker\en-US\lsass.exe	DllCommonsvc.exe
File created	C:\Windows\DigitalLocker\en-US\6203df4a6bafc7	DllCommonsvc.exe
File created	C:\Windows\en-US\DllCommonsvc.exe	DllCommonsvc.exe
File created	C:\Windows\en-US\a76d7bf15d8370	DllCommonsvc.exe
File created	C:\Windows\Panther\UnattendGC\RuntimeBroker.exe	DllCommonsvc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\RuntimeBroker.exe	DllCommonsvc.exe
File created	C:\Windows\Panther\UnattendGC\9e8d7a4ca61bd9	DllCommonsvc.exe
File created	C:\Windows\servicing\InboxFodMetadataCache\csrss.exe	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 48 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4304	schtasks.exe
2864	schtasks.exe
4884	schtasks.exe
4084	schtasks.exe
3464	schtasks.exe
2784	schtasks.exe
4540	schtasks.exe
3964	schtasks.exe
3588	schtasks.exe
2312	schtasks.exe
1872	schtasks.exe
432	schtasks.exe
212	schtasks.exe
4900	schtasks.exe
3560	schtasks.exe
536	schtasks.exe
2352	schtasks.exe
1020	schtasks.exe
1828	schtasks.exe
3456	schtasks.exe
2296	schtasks.exe
3944	schtasks.exe
1092	schtasks.exe
4388	schtasks.exe
4628	schtasks.exe
820	schtasks.exe
1284	schtasks.exe
920	schtasks.exe
1048	schtasks.exe
4396	schtasks.exe
3816	schtasks.exe
1136	schtasks.exe
5060	schtasks.exe
4228	schtasks.exe
1816	schtasks.exe
3108	schtasks.exe
1412	schtasks.exe
672	schtasks.exe
2604	schtasks.exe
4880	schtasks.exe
508	schtasks.exe
3660	schtasks.exe
4544	schtasks.exe
4236	schtasks.exe
2036	schtasks.exe
4348	schtasks.exe
4656	schtasks.exe
1652	schtasks.exe

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	bee0b32350449cb47b2e50e57e0e09fe146e58a765974db35aa07f0007c4bc76.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	RuntimeBroker.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2364	DllCommonsvc.exe
2364	DllCommonsvc.exe
2364	DllCommonsvc.exe
2364	DllCommonsvc.exe
2364	DllCommonsvc.exe
2364	DllCommonsvc.exe
2364	DllCommonsvc.exe
1536	powershell.exe
1536	powershell.exe
448	powershell.exe
448	powershell.exe
2464	powershell.exe
2464	powershell.exe
4552	powershell.exe
4552	powershell.exe
1332	powershell.exe
1332	powershell.exe
1148	powershell.exe
1148	powershell.exe
4308	powershell.exe
4308	powershell.exe
2196	powershell.exe
2196	powershell.exe
4704	powershell.exe
4704	powershell.exe
400	powershell.exe
400	powershell.exe
1516	powershell.exe
1516	powershell.exe
2088	powershell.exe
2088	powershell.exe
3128	powershell.exe
3128	powershell.exe
4952	powershell.exe
4952	powershell.exe
4872	powershell.exe
4872	powershell.exe
4804	powershell.exe
4804	powershell.exe
348	powershell.exe
348	powershell.exe
672	RuntimeBroker.exe
672	RuntimeBroker.exe
1536	powershell.exe
1536	powershell.exe
448	powershell.exe
448	powershell.exe
2464	powershell.exe
2464	powershell.exe
4552	powershell.exe
4552	powershell.exe
1332	powershell.exe
1332	powershell.exe
1148	powershell.exe
1148	powershell.exe
4308	powershell.exe
4308	powershell.exe
2196	powershell.exe
2196	powershell.exe
4704	powershell.exe
4704	powershell.exe
400	powershell.exe
400	powershell.exe
1516	powershell.exe

Suspicious use of AdjustPrivilegeToken 28 IoCs

description	pid	Process
Token: SeDebugPrivilege	2364	DllCommonsvc.exe
Token: SeDebugPrivilege	1536	powershell.exe
Token: SeDebugPrivilege	448	powershell.exe
Token: SeDebugPrivilege	2464	powershell.exe
Token: SeDebugPrivilege	4552	powershell.exe
Token: SeDebugPrivilege	1332	powershell.exe
Token: SeDebugPrivilege	1148	powershell.exe
Token: SeDebugPrivilege	4308	powershell.exe
Token: SeDebugPrivilege	2196	powershell.exe
Token: SeDebugPrivilege	4704	powershell.exe
Token: SeDebugPrivilege	400	powershell.exe
Token: SeDebugPrivilege	1516	powershell.exe
Token: SeDebugPrivilege	2088	powershell.exe
Token: SeDebugPrivilege	3128	powershell.exe
Token: SeDebugPrivilege	4952	powershell.exe
Token: SeDebugPrivilege	4872	powershell.exe
Token: SeDebugPrivilege	4804	powershell.exe
Token: SeDebugPrivilege	348	powershell.exe
Token: SeDebugPrivilege	672	RuntimeBroker.exe
Token: SeDebugPrivilege	6032	RuntimeBroker.exe
Token: SeDebugPrivilege	2364	RuntimeBroker.exe
Token: SeDebugPrivilege	2552	RuntimeBroker.exe
Token: SeDebugPrivilege	3184	RuntimeBroker.exe
Token: SeDebugPrivilege	4568	RuntimeBroker.exe
Token: SeDebugPrivilege	5292	RuntimeBroker.exe
Token: SeDebugPrivilege	2004	RuntimeBroker.exe
Token: SeDebugPrivilege	5820	RuntimeBroker.exe
Token: SeDebugPrivilege	4332	RuntimeBroker.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 4024	1628	bee0b32350449cb47b2e50e57e0e09fe146e58a765974db35aa07f0007c4bc76.exe	80
PID 1628 wrote to memory of 4024	1628	bee0b32350449cb47b2e50e57e0e09fe146e58a765974db35aa07f0007c4bc76.exe	80
PID 1628 wrote to memory of 4024	1628	bee0b32350449cb47b2e50e57e0e09fe146e58a765974db35aa07f0007c4bc76.exe	80
PID 4024 wrote to memory of 3092	4024	WScript.exe	84
PID 4024 wrote to memory of 3092	4024	WScript.exe	84
PID 4024 wrote to memory of 3092	4024	WScript.exe	84
PID 3092 wrote to memory of 2364	3092	cmd.exe	86
PID 3092 wrote to memory of 2364	3092	cmd.exe	86
PID 2364 wrote to memory of 448	2364	DllCommonsvc.exe	136
PID 2364 wrote to memory of 448	2364	DllCommonsvc.exe	136
PID 2364 wrote to memory of 1536	2364	DllCommonsvc.exe	137
PID 2364 wrote to memory of 1536	2364	DllCommonsvc.exe	137
PID 2364 wrote to memory of 2464	2364	DllCommonsvc.exe	138
PID 2364 wrote to memory of 2464	2364	DllCommonsvc.exe	138
PID 2364 wrote to memory of 4552	2364	DllCommonsvc.exe	140
PID 2364 wrote to memory of 4552	2364	DllCommonsvc.exe	140
PID 2364 wrote to memory of 1332	2364	DllCommonsvc.exe	141
PID 2364 wrote to memory of 1332	2364	DllCommonsvc.exe	141
PID 2364 wrote to memory of 1148	2364	DllCommonsvc.exe	143
PID 2364 wrote to memory of 1148	2364	DllCommonsvc.exe	143
PID 2364 wrote to memory of 2196	2364	DllCommonsvc.exe	144
PID 2364 wrote to memory of 2196	2364	DllCommonsvc.exe	144
PID 2364 wrote to memory of 4308	2364	DllCommonsvc.exe	146
PID 2364 wrote to memory of 4308	2364	DllCommonsvc.exe	146
PID 2364 wrote to memory of 4704	2364	DllCommonsvc.exe	154
PID 2364 wrote to memory of 4704	2364	DllCommonsvc.exe	154
PID 2364 wrote to memory of 400	2364	DllCommonsvc.exe	153
PID 2364 wrote to memory of 400	2364	DllCommonsvc.exe	153
PID 2364 wrote to memory of 1516	2364	DllCommonsvc.exe	150
PID 2364 wrote to memory of 1516	2364	DllCommonsvc.exe	150
PID 2364 wrote to memory of 2088	2364	DllCommonsvc.exe	152
PID 2364 wrote to memory of 2088	2364	DllCommonsvc.exe	152
PID 2364 wrote to memory of 3128	2364	DllCommonsvc.exe	158
PID 2364 wrote to memory of 3128	2364	DllCommonsvc.exe	158
PID 2364 wrote to memory of 4952	2364	DllCommonsvc.exe	159
PID 2364 wrote to memory of 4952	2364	DllCommonsvc.exe	159
PID 2364 wrote to memory of 4804	2364	DllCommonsvc.exe	160
PID 2364 wrote to memory of 4804	2364	DllCommonsvc.exe	160
PID 2364 wrote to memory of 4872	2364	DllCommonsvc.exe	162
PID 2364 wrote to memory of 4872	2364	DllCommonsvc.exe	162
PID 2364 wrote to memory of 348	2364	DllCommonsvc.exe	163
PID 2364 wrote to memory of 348	2364	DllCommonsvc.exe	163
PID 2364 wrote to memory of 672	2364	DllCommonsvc.exe	168
PID 2364 wrote to memory of 672	2364	DllCommonsvc.exe	168
PID 672 wrote to memory of 5580	672	RuntimeBroker.exe	173
PID 672 wrote to memory of 5580	672	RuntimeBroker.exe	173
PID 5580 wrote to memory of 5636	5580	cmd.exe	175
PID 5580 wrote to memory of 5636	5580	cmd.exe	175
PID 5580 wrote to memory of 6032	5580	cmd.exe	177
PID 5580 wrote to memory of 6032	5580	cmd.exe	177
PID 6032 wrote to memory of 2212	6032	RuntimeBroker.exe	178
PID 6032 wrote to memory of 2212	6032	RuntimeBroker.exe	178
PID 2212 wrote to memory of 3996	2212	cmd.exe	180
PID 2212 wrote to memory of 3996	2212	cmd.exe	180
PID 2212 wrote to memory of 2364	2212	cmd.exe	181
PID 2212 wrote to memory of 2364	2212	cmd.exe	181
PID 2364 wrote to memory of 1484	2364	RuntimeBroker.exe	182
PID 2364 wrote to memory of 1484	2364	RuntimeBroker.exe	182
PID 1484 wrote to memory of 5632	1484	cmd.exe	184
PID 1484 wrote to memory of 5632	1484	cmd.exe	184
PID 1484 wrote to memory of 2552	1484	cmd.exe	185
PID 1484 wrote to memory of 2552	1484	cmd.exe	185
PID 2552 wrote to memory of 2408	2552	RuntimeBroker.exe	186
PID 2552 wrote to memory of 2408	2552	RuntimeBroker.exe	186

C:\Users\Admin\AppData\Local\Temp\bee0b32350449cb47b2e50e57e0e09fe146e58a765974db35aa07f0007c4bc76.exe
"C:\Users\Admin\AppData\Local\Temp\bee0b32350449cb47b2e50e57e0e09fe146e58a765974db35aa07f0007c4bc76.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:4024
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3092
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Checks computer location settings
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2364
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:448
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Panther\UnattendGC\RuntimeBroker.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1536
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\DllCommonsvc.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2464
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\DigitalLocker\en-US\lsass.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4552
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\System.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1332
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\conhost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1148
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\dllhost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2196
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\fontdrvhost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4308
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\OfficeClickToRun.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1516
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\RuntimeBroker.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2088
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\winlogon.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:400
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\csrss.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4704
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\en-US\DllCommonsvc.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3128
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\RuntimeBroker.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4952
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft\csrss.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4804
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Local Settings\services.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4872
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Cookies\RuntimeBroker.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:348
    - - C:\odt\RuntimeBroker.exe
        
        "C:\odt\RuntimeBroker.exe"
        5⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:672
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\yXZnhMCmO6.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:5580
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:5636
        
        C:\odt\RuntimeBroker.exe
        
        "C:\odt\RuntimeBroker.exe"
        7⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:6032
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\M2NHsv551y.bat"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:2212
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:3996
        
        C:\odt\RuntimeBroker.exe
        
        "C:\odt\RuntimeBroker.exe"
        9⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2364
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\yXZnhMCmO6.bat"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:1484
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:5632
        
        C:\odt\RuntimeBroker.exe
        
        "C:\odt\RuntimeBroker.exe"
        11⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2552
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\vkfoWdc5zM.bat"
        12⤵
        
        PID:2408
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:5672
        
        C:\odt\RuntimeBroker.exe
        
        "C:\odt\RuntimeBroker.exe"
        13⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:3184
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\kp2dTY47HA.bat"
        14⤵
        
        PID:5536
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        15⤵
        
        PID:3588
        
        C:\odt\RuntimeBroker.exe
        
        "C:\odt\RuntimeBroker.exe"
        15⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:4568
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\GQn77QEoUi.bat"
        16⤵
        
        PID:4084
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        17⤵
        
        PID:4888
        
        C:\odt\RuntimeBroker.exe
        
        "C:\odt\RuntimeBroker.exe"
        17⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:5292
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\rd8mWnFnEV.bat"
        18⤵
        
        PID:2200
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        19⤵
        
        PID:1148
        
        C:\odt\RuntimeBroker.exe
        
        "C:\odt\RuntimeBroker.exe"
        19⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:2004
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\EOPCJ2Obyf.bat"
        20⤵
        
        PID:2304
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        21⤵
        
        PID:4440
        
        C:\odt\RuntimeBroker.exe
        
        "C:\odt\RuntimeBroker.exe"
        21⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:5820
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\gyyX5OxKdc.bat"
        22⤵
        
        PID:624
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        23⤵
        
        PID:4804
        
        C:\odt\RuntimeBroker.exe
        
        "C:\odt\RuntimeBroker.exe"
        23⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:4332
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\QLPJAVlmCt.bat"
        24⤵
        
        PID:3068
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        25⤵
        
        PID:5412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Windows\Panther\UnattendGC\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\Panther\UnattendGC\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Windows\Panther\UnattendGC\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\DllCommonsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 10 /tr "'C:\Windows\DigitalLocker\en-US\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:212

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\DigitalLocker\en-US\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\Windows\DigitalLocker\en-US\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 13 /tr "'C:\providercommon\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\providercommon\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 8 /tr "'C:\providercommon\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 7 /tr "'C:\odt\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2312

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\odt\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1136

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 9 /tr "'C:\odt\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\odt\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\odt\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\odt\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\odt\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\odt\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\odt\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\providercommon\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\providercommon\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3456

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\providercommon\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\providercommon\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\providercommon\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\providercommon\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 7 /tr "'C:\odt\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\odt\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 11 /tr "'C:\odt\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Default User\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 11 /tr "'C:\Windows\en-US\DllCommonsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\Windows\en-US\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 5 /tr "'C:\Windows\en-US\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\odt\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\odt\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\odt\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Microsoft\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Microsoft\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2296

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\Local Settings\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Users\Admin\Local Settings\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\Local Settings\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Users\Default\Cookies\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Default\Cookies\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Users\Default\Cookies\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:508

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Web Service

T1102

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RuntimeBroker.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\RuntimeBroker.exe.log
Size 1KB
SHA256 ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
MD5 baf55b95da4a601229647f25dad12878
SHA1 abc16954ebfd213733c4493fc1910164d825cac8
SHA512 24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
MD5 SHA1 SHA512

Submit Download