dcrat | 25a30e966ad5f1ced4f50d736109a6ea9dc8f53039234efbbfe78bdae4996f3a

Analysis

max time kernel
149s
max time network
151s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
01/11/2022, 01:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
25a30e966ad5f1ced4f50d736109a6ea9dc8f53039234efbbfe78bdae4996f3a.exe
Size 1.3MB
Sample221101-cayc8afag2
SHA256 25a30e966ad5f1ced4f50d736109a6ea9dc8f53039234efbbfe78bdae4996f3a
MD5 cb6cfae8c4d9bd1f12e2c5e3805f136e
SHA1 ae2918a42fdc636391a25aa618c4d897aef07093
SHA512 5307793e3c77ce60e88c67ca72b0fc700bdb717b81b4b5aa0c2d95e0bae747f4f9caf864bfd7b28a806914e3b14dbd341c9ce8beb447603cfa24ea1fe7e9dee9
SSDEEP 24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 54 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3664	756	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2640	756	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4400	756	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3940	756	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4884	756	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4888	756	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4812	756	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4816	756	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4064	756	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4392	756	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3900	756	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3992	756	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3984	756	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2252	756	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4500	756	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4560	756	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4540	756	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4480	756	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4460	756	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4496	756	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4524	756	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4432	756	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4616	756	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3252	756	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4580	756	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4600	756	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3156	756	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4664	756	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4648	756	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2208	756	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	664	756	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	600	756	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4024	756	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4164	756	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	872	756	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	364	756	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	228	756	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3296	756	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	196	756	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	192	756	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3264	756	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2288	756	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4732	756	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2236	756	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4588	756	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	676	756	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4672	756	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1600	756	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4612	756	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1032	756	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1284	756	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1520	756	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2872	756	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1656	756	schtasks.exe	70

DCRat payload 15 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x000900000001ac39-284.dat	dcrat
behavioral1/files/0x000900000001ac39-285.dat	dcrat
behavioral1/memory/3004-286-0x0000000000AA0000-0x0000000000BB0000-memory.dmp	dcrat
behavioral1/files/0x000600000001ac7a-662.dat	dcrat
behavioral1/files/0x000600000001ac7a-661.dat	dcrat
behavioral1/files/0x000600000001ac7a-988.dat	dcrat
behavioral1/files/0x000600000001ac7a-994.dat	dcrat
behavioral1/files/0x000600000001ac7a-1000.dat	dcrat
behavioral1/files/0x000600000001ac7a-1005.dat	dcrat
behavioral1/files/0x000600000001ac7a-1010.dat	dcrat
behavioral1/files/0x000600000001ac7a-1015.dat	dcrat
behavioral1/files/0x000600000001ac7a-1020.dat	dcrat
behavioral1/files/0x000600000001ac7a-1026.dat	dcrat
behavioral1/files/0x000600000001ac7a-1031.dat	dcrat
behavioral1/files/0x000600000001ac7a-1036.dat	dcrat

Executes dropped EXE 12 IoCs

pid	Process
3004	DllCommonsvc.exe
3288	sihost.exe
5344	sihost.exe
5380	sihost.exe
5772	sihost.exe
364	sihost.exe
5808	sihost.exe
2432	sihost.exe
4660	sihost.exe
3976	sihost.exe
4536	sihost.exe
1860	sihost.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in Program Files directory 13 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Windows Multimedia Platform\dllhost.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Multimedia Platform\5940a34987c991	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Portable Devices\5b884080fd4f94	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\spoolsv.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\cc11b995f2a76d	DllCommonsvc.exe
File created	C:\Program Files\Windows Multimedia Platform\dllhost.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Common Files\Services\9e8d7a4ca61bd9	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Portable Devices\fontdrvhost.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\f3b6ecef712a24	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\winlogon.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\it-IT\wininit.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\it-IT\56085415360792	DllCommonsvc.exe
File created	C:\Program Files (x86)\Common Files\Services\RuntimeBroker.exe	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 54 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1520	schtasks.exe
196	schtasks.exe
600	schtasks.exe
228	schtasks.exe
4612	schtasks.exe
4496	schtasks.exe
4588	schtasks.exe
4888	schtasks.exe
2252	schtasks.exe
3900	schtasks.exe
4460	schtasks.exe
4432	schtasks.exe
3264	schtasks.exe
4064	schtasks.exe
1284	schtasks.exe
2236	schtasks.exe
4600	schtasks.exe
4664	schtasks.exe
4540	schtasks.exe
4480	schtasks.exe
664	schtasks.exe
3664	schtasks.exe
4812	schtasks.exe
4500	schtasks.exe
4560	schtasks.exe
2640	schtasks.exe
3940	schtasks.exe
872	schtasks.exe
4732	schtasks.exe
3156	schtasks.exe
4672	schtasks.exe
2208	schtasks.exe
3252	schtasks.exe
192	schtasks.exe
1032	schtasks.exe
4400	schtasks.exe
4164	schtasks.exe
1600	schtasks.exe
2872	schtasks.exe
4884	schtasks.exe
4524	schtasks.exe
3992	schtasks.exe
3296	schtasks.exe
4816	schtasks.exe
676	schtasks.exe
364	schtasks.exe
4580	schtasks.exe
4024	schtasks.exe
4392	schtasks.exe
1656	schtasks.exe
3984	schtasks.exe
4648	schtasks.exe
2288	schtasks.exe
4616	schtasks.exe

Modifies registry class 13 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings	25a30e966ad5f1ced4f50d736109a6ea9dc8f53039234efbbfe78bdae4996f3a.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings	sihost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3004	DllCommonsvc.exe
3004	DllCommonsvc.exe
3004	DllCommonsvc.exe
3004	DllCommonsvc.exe
3004	DllCommonsvc.exe
3004	DllCommonsvc.exe
3004	DllCommonsvc.exe
3004	DllCommonsvc.exe
3004	DllCommonsvc.exe
3004	DllCommonsvc.exe
3004	DllCommonsvc.exe
3004	DllCommonsvc.exe
3004	DllCommonsvc.exe
3004	DllCommonsvc.exe
3004	DllCommonsvc.exe
3004	DllCommonsvc.exe
3004	DllCommonsvc.exe
3004	DllCommonsvc.exe
3004	DllCommonsvc.exe
3004	DllCommonsvc.exe
3004	DllCommonsvc.exe
3004	DllCommonsvc.exe
3004	DllCommonsvc.exe
2648	powershell.exe
2648	powershell.exe
2648	powershell.exe
2644	powershell.exe
2644	powershell.exe
2644	powershell.exe
1440	powershell.exe
1440	powershell.exe
2648	powershell.exe
2644	powershell.exe
1440	powershell.exe
3460	powershell.exe
3460	powershell.exe
2172	powershell.exe
2172	powershell.exe
1508	powershell.exe
1508	powershell.exe
2512	powershell.exe
2512	powershell.exe
1440	powershell.exe
3460	powershell.exe
2704	powershell.exe
2704	powershell.exe
2512	powershell.exe
2016	powershell.exe
2016	powershell.exe
3496	powershell.exe
3496	powershell.exe
3748	powershell.exe
3748	powershell.exe
4552	powershell.exe
4552	powershell.exe
2704	powershell.exe
1148	powershell.exe
1148	powershell.exe
3344	powershell.exe
3344	powershell.exe
2172	powershell.exe
3780	powershell.exe
3780	powershell.exe
1508	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3004	DllCommonsvc.exe
Token: SeDebugPrivilege	2648	powershell.exe
Token: SeDebugPrivilege	2644	powershell.exe
Token: SeDebugPrivilege	1440	powershell.exe
Token: SeDebugPrivilege	3460	powershell.exe
Token: SeDebugPrivilege	2172	powershell.exe
Token: SeDebugPrivilege	1508	powershell.exe
Token: SeDebugPrivilege	2512	powershell.exe
Token: SeDebugPrivilege	2704	powershell.exe
Token: SeDebugPrivilege	2016	powershell.exe
Token: SeDebugPrivilege	3496	powershell.exe
Token: SeDebugPrivilege	3748	powershell.exe
Token: SeDebugPrivilege	4552	powershell.exe
Token: SeDebugPrivilege	1148	powershell.exe
Token: SeDebugPrivilege	3344	powershell.exe
Token: SeDebugPrivilege	3780	powershell.exe
Token: SeDebugPrivilege	3472	powershell.exe
Token: SeDebugPrivilege	3336	powershell.exe
Token: SeDebugPrivilege	4388	powershell.exe
Token: SeDebugPrivilege	4832	powershell.exe
Token: SeIncreaseQuotaPrivilege	2644	powershell.exe
Token: SeSecurityPrivilege	2644	powershell.exe
Token: SeTakeOwnershipPrivilege	2644	powershell.exe
Token: SeLoadDriverPrivilege	2644	powershell.exe
Token: SeSystemProfilePrivilege	2644	powershell.exe
Token: SeSystemtimePrivilege	2644	powershell.exe
Token: SeProfSingleProcessPrivilege	2644	powershell.exe
Token: SeIncBasePriorityPrivilege	2644	powershell.exe
Token: SeCreatePagefilePrivilege	2644	powershell.exe
Token: SeBackupPrivilege	2644	powershell.exe
Token: SeRestorePrivilege	2644	powershell.exe
Token: SeShutdownPrivilege	2644	powershell.exe
Token: SeDebugPrivilege	2644	powershell.exe
Token: SeSystemEnvironmentPrivilege	2644	powershell.exe
Token: SeRemoteShutdownPrivilege	2644	powershell.exe
Token: SeUndockPrivilege	2644	powershell.exe
Token: SeManageVolumePrivilege	2644	powershell.exe
Token: 33	2644	powershell.exe
Token: 34	2644	powershell.exe
Token: 35	2644	powershell.exe
Token: 36	2644	powershell.exe
Token: SeIncreaseQuotaPrivilege	2648	powershell.exe
Token: SeSecurityPrivilege	2648	powershell.exe
Token: SeTakeOwnershipPrivilege	2648	powershell.exe
Token: SeLoadDriverPrivilege	2648	powershell.exe
Token: SeSystemProfilePrivilege	2648	powershell.exe
Token: SeSystemtimePrivilege	2648	powershell.exe
Token: SeProfSingleProcessPrivilege	2648	powershell.exe
Token: SeIncBasePriorityPrivilege	2648	powershell.exe
Token: SeCreatePagefilePrivilege	2648	powershell.exe
Token: SeBackupPrivilege	2648	powershell.exe
Token: SeRestorePrivilege	2648	powershell.exe
Token: SeShutdownPrivilege	2648	powershell.exe
Token: SeDebugPrivilege	2648	powershell.exe
Token: SeSystemEnvironmentPrivilege	2648	powershell.exe
Token: SeRemoteShutdownPrivilege	2648	powershell.exe
Token: SeUndockPrivilege	2648	powershell.exe
Token: SeManageVolumePrivilege	2648	powershell.exe
Token: 33	2648	powershell.exe
Token: 34	2648	powershell.exe
Token: 35	2648	powershell.exe
Token: 36	2648	powershell.exe
Token: SeIncreaseQuotaPrivilege	1440	powershell.exe
Token: SeSecurityPrivilege	1440	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1788 wrote to memory of 4704	1788	25a30e966ad5f1ced4f50d736109a6ea9dc8f53039234efbbfe78bdae4996f3a.exe	66
PID 1788 wrote to memory of 4704	1788	25a30e966ad5f1ced4f50d736109a6ea9dc8f53039234efbbfe78bdae4996f3a.exe	66
PID 1788 wrote to memory of 4704	1788	25a30e966ad5f1ced4f50d736109a6ea9dc8f53039234efbbfe78bdae4996f3a.exe	66
PID 4704 wrote to memory of 3544	4704	WScript.exe	67
PID 4704 wrote to memory of 3544	4704	WScript.exe	67
PID 4704 wrote to memory of 3544	4704	WScript.exe	67
PID 3544 wrote to memory of 3004	3544	cmd.exe	69
PID 3544 wrote to memory of 3004	3544	cmd.exe	69
PID 3004 wrote to memory of 2648	3004	DllCommonsvc.exe	125
PID 3004 wrote to memory of 2648	3004	DllCommonsvc.exe	125
PID 3004 wrote to memory of 2644	3004	DllCommonsvc.exe	150
PID 3004 wrote to memory of 2644	3004	DllCommonsvc.exe	150
PID 3004 wrote to memory of 1440	3004	DllCommonsvc.exe	131
PID 3004 wrote to memory of 1440	3004	DllCommonsvc.exe	131
PID 3004 wrote to memory of 3460	3004	DllCommonsvc.exe	126
PID 3004 wrote to memory of 3460	3004	DllCommonsvc.exe	126
PID 3004 wrote to memory of 1508	3004	DllCommonsvc.exe	128
PID 3004 wrote to memory of 1508	3004	DllCommonsvc.exe	128
PID 3004 wrote to memory of 2172	3004	DllCommonsvc.exe	133
PID 3004 wrote to memory of 2172	3004	DllCommonsvc.exe	133
PID 3004 wrote to memory of 2512	3004	DllCommonsvc.exe	134
PID 3004 wrote to memory of 2512	3004	DllCommonsvc.exe	134
PID 3004 wrote to memory of 2704	3004	DllCommonsvc.exe	135
PID 3004 wrote to memory of 2704	3004	DllCommonsvc.exe	135
PID 3004 wrote to memory of 2016	3004	DllCommonsvc.exe	136
PID 3004 wrote to memory of 2016	3004	DllCommonsvc.exe	136
PID 3004 wrote to memory of 3496	3004	DllCommonsvc.exe	137
PID 3004 wrote to memory of 3496	3004	DllCommonsvc.exe	137
PID 3004 wrote to memory of 3748	3004	DllCommonsvc.exe	138
PID 3004 wrote to memory of 3748	3004	DllCommonsvc.exe	138
PID 3004 wrote to memory of 4552	3004	DllCommonsvc.exe	140
PID 3004 wrote to memory of 4552	3004	DllCommonsvc.exe	140
PID 3004 wrote to memory of 1148	3004	DllCommonsvc.exe	141
PID 3004 wrote to memory of 1148	3004	DllCommonsvc.exe	141
PID 3004 wrote to memory of 3344	3004	DllCommonsvc.exe	144
PID 3004 wrote to memory of 3344	3004	DllCommonsvc.exe	144
PID 3004 wrote to memory of 3780	3004	DllCommonsvc.exe	162
PID 3004 wrote to memory of 3780	3004	DllCommonsvc.exe	162
PID 3004 wrote to memory of 3472	3004	DllCommonsvc.exe	153
PID 3004 wrote to memory of 3472	3004	DllCommonsvc.exe	153
PID 3004 wrote to memory of 3336	3004	DllCommonsvc.exe	154
PID 3004 wrote to memory of 3336	3004	DllCommonsvc.exe	154
PID 3004 wrote to memory of 4832	3004	DllCommonsvc.exe	155
PID 3004 wrote to memory of 4832	3004	DllCommonsvc.exe	155
PID 3004 wrote to memory of 4388	3004	DllCommonsvc.exe	156
PID 3004 wrote to memory of 4388	3004	DllCommonsvc.exe	156
PID 3004 wrote to memory of 4676	3004	DllCommonsvc.exe	163
PID 3004 wrote to memory of 4676	3004	DllCommonsvc.exe	163
PID 4676 wrote to memory of 4696	4676	cmd.exe	165
PID 4676 wrote to memory of 4696	4676	cmd.exe	165
PID 4676 wrote to memory of 3288	4676	cmd.exe	167
PID 4676 wrote to memory of 3288	4676	cmd.exe	167
PID 3288 wrote to memory of 5488	3288	sihost.exe	168
PID 3288 wrote to memory of 5488	3288	sihost.exe	168
PID 5488 wrote to memory of 5620	5488	cmd.exe	170
PID 5488 wrote to memory of 5620	5488	cmd.exe	170
PID 5488 wrote to memory of 5344	5488	cmd.exe	171
PID 5488 wrote to memory of 5344	5488	cmd.exe	171
PID 5344 wrote to memory of 5444	5344	sihost.exe	172
PID 5344 wrote to memory of 5444	5344	sihost.exe	172
PID 5444 wrote to memory of 5248	5444	cmd.exe	174
PID 5444 wrote to memory of 5248	5444	cmd.exe	174
PID 5444 wrote to memory of 5380	5444	cmd.exe	175
PID 5444 wrote to memory of 5380	5444	cmd.exe	175

C:\Users\Admin\AppData\Local\Temp\25a30e966ad5f1ced4f50d736109a6ea9dc8f53039234efbbfe78bdae4996f3a.exe
"C:\Users\Admin\AppData\Local\Temp\25a30e966ad5f1ced4f50d736109a6ea9dc8f53039234efbbfe78bdae4996f3a.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1788
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4704
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3544
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3004
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2648
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\spoolsv.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3460
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\System.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1508
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Common Files\Services\RuntimeBroker.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1440
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Portable Devices\fontdrvhost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2172
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Start Menu\dllhost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2512
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\DllCommonsvc.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2704
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\spoolsv.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2016
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\Idle.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3496
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\winlogon.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3748
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\dwm.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4552
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\sihost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1148
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Defender Advanced Threat Protection\it-IT\wininit.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3344
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Multimedia Platform\dllhost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2644
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\.oracle_jre_usage\explorer.exe'
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3472
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\conhost.exe'
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3336
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\smss.exe'
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4832
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\sppsvc.exe'
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4388
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\SearchUI.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3780
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Q1IAg9p0i7.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4676
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:4696
      - C:\providercommon\sihost.exe
        
        "C:\providercommon\sihost.exe"
        6⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3288
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\xm2kK1SIVO.bat"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:5488
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:5620
        
        C:\providercommon\sihost.exe
        
        "C:\providercommon\sihost.exe"
        8⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5344
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\L9j9zErPDE.bat"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:5444
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:5248
        
        C:\providercommon\sihost.exe
        
        "C:\providercommon\sihost.exe"
        10⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5380
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ZAtO29mfgG.bat"
        11⤵
        
        PID:5684
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:5740
        
        C:\providercommon\sihost.exe
        
        "C:\providercommon\sihost.exe"
        12⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5772
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\JDh6J9oWuS.bat"
        13⤵
        
        PID:5948
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        14⤵
        
        PID:536
        
        C:\providercommon\sihost.exe
        
        "C:\providercommon\sihost.exe"
        14⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:364
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\iu0amT0ExO.bat"
        15⤵
        
        PID:6064
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        16⤵
        
        PID:316
        
        C:\providercommon\sihost.exe
        
        "C:\providercommon\sihost.exe"
        16⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5808
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ELd0wzhjGt.bat"
        17⤵
        
        PID:2576
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        18⤵
        
        PID:2512
        
        C:\providercommon\sihost.exe
        
        "C:\providercommon\sihost.exe"
        18⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2432
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ZAtO29mfgG.bat"
        19⤵
        
        PID:3300
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        20⤵
        
        PID:2644
        
        C:\providercommon\sihost.exe
        
        "C:\providercommon\sihost.exe"
        20⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4660
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\T7KIMELUbd.bat"
        21⤵
        
        PID:6104
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        22⤵
        
        PID:2880
        
        C:\providercommon\sihost.exe
        
        "C:\providercommon\sihost.exe"
        22⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3976
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\T7KIMELUbd.bat"
        23⤵
        
        PID:2168
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        24⤵
        
        PID:4900
        
        C:\providercommon\sihost.exe
        
        "C:\providercommon\sihost.exe"
        24⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4536
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\MKE9IzBoeI.bat"
        25⤵
        
        PID:4916
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        26⤵
        
        PID:1916
        
        C:\providercommon\sihost.exe
        
        "C:\providercommon\sihost.exe"
        26⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1860
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\2pbp0wsTa1.bat"
        27⤵
        
        PID:2736
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        28⤵
        
        PID:3324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Multimedia Platform\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\Windows Multimedia Platform\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Multimedia Platform\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Common Files\Services\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\Services\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Common Files\Services\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 9 /tr "'C:\providercommon\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\providercommon\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 12 /tr "'C:\providercommon\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 11 /tr "'C:\odt\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\odt\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 8 /tr "'C:\odt\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Portable Devices\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2252

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Portable Devices\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4500

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Users\Default\Start Menu\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Default\Start Menu\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Users\Default\Start Menu\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 13 /tr "'C:\odt\DllCommonsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\odt\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 9 /tr "'C:\odt\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3252

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\providercommon\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\providercommon\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\providercommon\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\Users\Public\Videos\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Users\Public\Videos\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 8 /tr "'C:\Users\Public\Videos\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 10 /tr "'C:\providercommon\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4164

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\providercommon\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 14 /tr "'C:\providercommon\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:364

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Defender Advanced Threat Protection\it-IT\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files\Windows Defender Advanced Threat Protection\it-IT\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3296

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Defender Advanced Threat Protection\it-IT\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:196

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchUIS" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\SearchUI.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:192

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchUI" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\SearchUI.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3264

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchUIS" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\SearchUI.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2288

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\.oracle_jre_usage\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Users\Admin\.oracle_jre_usage\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\.oracle_jre_usage\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 11 /tr "'C:\providercommon\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\providercommon\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 14 /tr "'C:\providercommon\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 12 /tr "'C:\providercommon\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\providercommon\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 10 /tr "'C:\providercommon\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1656

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Web Service

T1102

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 fdd7d9def6f9f0c0f2e60dbc8a2d1999071cd7d3095e9e087bb1cda7a614ac3c
MD5 8592ba100a78835a6b94d5949e13dfc1
SHA1 63e901200ab9a57c7dd4c078d7f75dcd3b357020
SHA512 87f98e6cb61b2a2a7d65710c4d33881d89715eb7a06e00d492259f35c3902498baabffc5886be0ec5a14312ad4c262e3fc40cd3a5cb91701af0fb229726b88c3
MD5 SHA1 SHA512

Submit Download

sihost.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\sihost.exe.log
Size 1KB
SHA256 375076241775962f3edc08a8c72832a00920b427a4f3332528d91d21e909fa12
MD5 d63ff49d7c92016feb39812e4db10419
SHA1 2307d5e35ca9864ffefc93acf8573ea995ba189b
SHA512 00f8c8d0336d6575b956876183199624d6f4d2056f2c0aa633a6f17c516f22ee648062d9bc419254d84c459323e9424f0da8aed9dd4e16c2926e5ba30e797d8a
MD5 SHA1 SHA512

Submit Download