dcrat | bea63bea228e90f03925bd55ce869d6184cdeef9920e1390e6c9eaa37e946697

Analysis

max time kernel
150s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
01/11/2022, 01:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bea63bea228e90f03925bd55ce869d6184cdeef9920e1390e6c9eaa37e946697.exe
Size 1.3MB
Sample221101-cbemhagack
SHA256 bea63bea228e90f03925bd55ce869d6184cdeef9920e1390e6c9eaa37e946697
MD5 7fbecde0cd3ee62936f18b741302c01c
SHA1 f400947018e502902749900aaf957e8a50065e69
SHA512 13929bf3e4b8856705672acfb51177f0b3140a2ed0832ce9319bdbb16365367a6858e6dd6bbcc520bced3852721395055a059615449e34688d360c4264871ea8
SSDEEP 24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 45 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4392	1664	schtasks.exe	12
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3944	1664	schtasks.exe	12
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4420	1664	schtasks.exe	12
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5116	1664	schtasks.exe	12
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4404	1664	schtasks.exe	12
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2092	1664	schtasks.exe	12
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2996	1664	schtasks.exe	12
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1532	1664	schtasks.exe	12
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4156	1664	schtasks.exe	12
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4560	1664	schtasks.exe	12
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3472	1664	schtasks.exe	12
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4524	1664	schtasks.exe	12
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2336	1664	schtasks.exe	12
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1128	1664	schtasks.exe	12
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4640	1664	schtasks.exe	12
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3144	1664	schtasks.exe	12
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2220	1664	schtasks.exe	12
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3120	1664	schtasks.exe	12
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	968	1664	schtasks.exe	12
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3332	1664	schtasks.exe	12
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1960	1664	schtasks.exe	12
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	640	1664	schtasks.exe	12
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4764	1664	schtasks.exe	12
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	548	1664	schtasks.exe	12
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4372	1664	schtasks.exe	12
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5000	1664	schtasks.exe	12
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4116	1664	schtasks.exe	12
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4292	1664	schtasks.exe	12
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	380	1664	schtasks.exe	12
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1152	1664	schtasks.exe	12
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2456	1664	schtasks.exe	12
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4992	1664	schtasks.exe	12
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4768	1664	schtasks.exe	12
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4584	1664	schtasks.exe	12
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1304	1664	schtasks.exe	12
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4020	1664	schtasks.exe	12
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4440	1664	schtasks.exe	12
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2060	1664	schtasks.exe	12
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3972	1664	schtasks.exe	12
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1084	1664	schtasks.exe	12
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3716	1664	schtasks.exe	12
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1708	1664	schtasks.exe	12
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1876	1664	schtasks.exe	12
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3836	1664	schtasks.exe	12
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	972	1664	schtasks.exe	12

DCRat payload 13 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0002000000022e4a-137.dat	dcrat
behavioral1/files/0x0002000000022e4a-138.dat	dcrat
behavioral1/memory/3556-139-0x0000000000EF0000-0x0000000001000000-memory.dmp	dcrat
behavioral1/files/0x0001000000022e6e-211.dat	dcrat
behavioral1/files/0x0001000000022e6e-212.dat	dcrat
behavioral1/files/0x0001000000022e6e-219.dat	dcrat
behavioral1/files/0x0001000000022e6e-227.dat	dcrat
behavioral1/files/0x0001000000022e6e-234.dat	dcrat
behavioral1/files/0x0001000000022e6e-241.dat	dcrat
behavioral1/files/0x0001000000022e6e-248.dat	dcrat
behavioral1/files/0x0001000000022e6e-255.dat	dcrat
behavioral1/files/0x0001000000022e6e-262.dat	dcrat
behavioral1/files/0x0001000000022e6e-269.dat	dcrat

Executes dropped EXE 10 IoCs

pid	Process
3556	DllCommonsvc.exe
5928	cmd.exe
868	cmd.exe
1308	cmd.exe
4300	cmd.exe
1624	cmd.exe
840	cmd.exe
3144	cmd.exe
4640	cmd.exe
4316	cmd.exe

Checks computer location settings 2 TTPs 11 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	bea63bea228e90f03925bd55ce869d6184cdeef9920e1390e6c9eaa37e946697.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	cmd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in Program Files directory 15 IoCs

description	ioc	Process
File created	C:\Program Files\VideoLAN\VLC\hrtfs\csrss.exe	DllCommonsvc.exe
File created	C:\Program Files\VideoLAN\VLC\hrtfs\886983d96e3d3e	DllCommonsvc.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\5940a34987c991	DllCommonsvc.exe
File created	C:\Program Files (x86)\Google\Temp\6203df4a6bafc7	DllCommonsvc.exe
File created	C:\Program Files\Windows Multimedia Platform\sihost.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows NT\Accessories\en-US\cmd.exe	DllCommonsvc.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\RuntimeBroker.exe	DllCommonsvc.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\9e8d7a4ca61bd9	DllCommonsvc.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\dllhost.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Google\Temp\lsass.exe	DllCommonsvc.exe
File opened for modification	C:\Program Files\Windows Multimedia Platform\sihost.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Multimedia Platform\66fc9ff0ee96c2	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows NT\Accessories\en-US\ebf1f9fa8afd6d	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Mail\SppExtComObj.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Mail\e1ef82546f0b02	DllCommonsvc.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Boot\csrss.exe	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 45 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1084	schtasks.exe
3836	schtasks.exe
1532	schtasks.exe
4764	schtasks.exe
2456	schtasks.exe
4992	schtasks.exe
4768	schtasks.exe
4020	schtasks.exe
972	schtasks.exe
4156	schtasks.exe
3472	schtasks.exe
4640	schtasks.exe
3332	schtasks.exe
1304	schtasks.exe
1708	schtasks.exe
4404	schtasks.exe
1152	schtasks.exe
3972	schtasks.exe
5116	schtasks.exe
2220	schtasks.exe
548	schtasks.exe
4372	schtasks.exe
4116	schtasks.exe
4440	schtasks.exe
3144	schtasks.exe
3120	schtasks.exe
4584	schtasks.exe
3716	schtasks.exe
1128	schtasks.exe
1960	schtasks.exe
4292	schtasks.exe
4392	schtasks.exe
4420	schtasks.exe
968	schtasks.exe
640	schtasks.exe
1876	schtasks.exe
5000	schtasks.exe
380	schtasks.exe
3944	schtasks.exe
2092	schtasks.exe
2996	schtasks.exe
4560	schtasks.exe
4524	schtasks.exe
2336	schtasks.exe
2060	schtasks.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	bea63bea228e90f03925bd55ce869d6184cdeef9920e1390e6c9eaa37e946697.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3556	DllCommonsvc.exe
3556	DllCommonsvc.exe
3556	DllCommonsvc.exe
3556	DllCommonsvc.exe
3556	DllCommonsvc.exe
1356	powershell.exe
1356	powershell.exe
4144	powershell.exe
4144	powershell.exe
3500	powershell.exe
3500	powershell.exe
3804	powershell.exe
3804	powershell.exe
4464	powershell.exe
4464	powershell.exe
4596	powershell.exe
4596	powershell.exe
4632	powershell.exe
4632	powershell.exe
3100	powershell.exe
3100	powershell.exe
1188	powershell.exe
1188	powershell.exe
1440	powershell.exe
1440	powershell.exe
4412	powershell.exe
4412	powershell.exe
5028	powershell.exe
5028	powershell.exe
768	powershell.exe
768	powershell.exe
4512	powershell.exe
4512	powershell.exe
3860	powershell.exe
3860	powershell.exe
3088	powershell.exe
3088	powershell.exe
1356	powershell.exe
1356	powershell.exe
4596	powershell.exe
4596	powershell.exe
3804	powershell.exe
3804	powershell.exe
3500	powershell.exe
3500	powershell.exe
4144	powershell.exe
4144	powershell.exe
4464	powershell.exe
4464	powershell.exe
1188	powershell.exe
1188	powershell.exe
4632	powershell.exe
4632	powershell.exe
3100	powershell.exe
3100	powershell.exe
4412	powershell.exe
1440	powershell.exe
768	powershell.exe
5028	powershell.exe
3860	powershell.exe
3088	powershell.exe
4512	powershell.exe
5928	cmd.exe
868	cmd.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: SeDebugPrivilege	3556	DllCommonsvc.exe
Token: SeDebugPrivilege	1356	powershell.exe
Token: SeDebugPrivilege	4144	powershell.exe
Token: SeDebugPrivilege	3500	powershell.exe
Token: SeDebugPrivilege	4464	powershell.exe
Token: SeDebugPrivilege	3804	powershell.exe
Token: SeDebugPrivilege	4596	powershell.exe
Token: SeDebugPrivilege	4632	powershell.exe
Token: SeDebugPrivilege	3100	powershell.exe
Token: SeDebugPrivilege	1188	powershell.exe
Token: SeDebugPrivilege	1440	powershell.exe
Token: SeDebugPrivilege	4412	powershell.exe
Token: SeDebugPrivilege	5028	powershell.exe
Token: SeDebugPrivilege	768	powershell.exe
Token: SeDebugPrivilege	4512	powershell.exe
Token: SeDebugPrivilege	3860	powershell.exe
Token: SeDebugPrivilege	3088	powershell.exe
Token: SeDebugPrivilege	5928	cmd.exe
Token: SeDebugPrivilege	868	cmd.exe
Token: SeDebugPrivilege	1308	cmd.exe
Token: SeDebugPrivilege	4300	cmd.exe
Token: SeDebugPrivilege	1624	cmd.exe
Token: SeDebugPrivilege	840	cmd.exe
Token: SeDebugPrivilege	3144	cmd.exe
Token: SeDebugPrivilege	4640	cmd.exe
Token: SeDebugPrivilege	4316	cmd.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3868 wrote to memory of 4568	3868	bea63bea228e90f03925bd55ce869d6184cdeef9920e1390e6c9eaa37e946697.exe	81
PID 3868 wrote to memory of 4568	3868	bea63bea228e90f03925bd55ce869d6184cdeef9920e1390e6c9eaa37e946697.exe	81
PID 3868 wrote to memory of 4568	3868	bea63bea228e90f03925bd55ce869d6184cdeef9920e1390e6c9eaa37e946697.exe	81
PID 4568 wrote to memory of 772	4568	WScript.exe	85
PID 4568 wrote to memory of 772	4568	WScript.exe	85
PID 4568 wrote to memory of 772	4568	WScript.exe	85
PID 772 wrote to memory of 3556	772	cmd.exe	87
PID 772 wrote to memory of 3556	772	cmd.exe	87
PID 3556 wrote to memory of 4144	3556	DllCommonsvc.exe	134
PID 3556 wrote to memory of 4144	3556	DllCommonsvc.exe	134
PID 3556 wrote to memory of 1356	3556	DllCommonsvc.exe	135
PID 3556 wrote to memory of 1356	3556	DllCommonsvc.exe	135
PID 3556 wrote to memory of 3804	3556	DllCommonsvc.exe	138
PID 3556 wrote to memory of 3804	3556	DllCommonsvc.exe	138
PID 3556 wrote to memory of 4464	3556	DllCommonsvc.exe	139
PID 3556 wrote to memory of 4464	3556	DllCommonsvc.exe	139
PID 3556 wrote to memory of 4632	3556	DllCommonsvc.exe	147
PID 3556 wrote to memory of 4632	3556	DllCommonsvc.exe	147
PID 3556 wrote to memory of 4596	3556	DllCommonsvc.exe	142
PID 3556 wrote to memory of 4596	3556	DllCommonsvc.exe	142
PID 3556 wrote to memory of 1188	3556	DllCommonsvc.exe	145
PID 3556 wrote to memory of 1188	3556	DllCommonsvc.exe	145
PID 3556 wrote to memory of 3500	3556	DllCommonsvc.exe	144
PID 3556 wrote to memory of 3500	3556	DllCommonsvc.exe	144
PID 3556 wrote to memory of 3100	3556	DllCommonsvc.exe	148
PID 3556 wrote to memory of 3100	3556	DllCommonsvc.exe	148
PID 3556 wrote to memory of 1440	3556	DllCommonsvc.exe	150
PID 3556 wrote to memory of 1440	3556	DllCommonsvc.exe	150
PID 3556 wrote to memory of 4412	3556	DllCommonsvc.exe	151
PID 3556 wrote to memory of 4412	3556	DllCommonsvc.exe	151
PID 3556 wrote to memory of 768	3556	DllCommonsvc.exe	153
PID 3556 wrote to memory of 768	3556	DllCommonsvc.exe	153
PID 3556 wrote to memory of 5028	3556	DllCommonsvc.exe	164
PID 3556 wrote to memory of 5028	3556	DllCommonsvc.exe	164
PID 3556 wrote to memory of 3860	3556	DllCommonsvc.exe	161
PID 3556 wrote to memory of 3860	3556	DllCommonsvc.exe	161
PID 3556 wrote to memory of 4512	3556	DllCommonsvc.exe	156
PID 3556 wrote to memory of 4512	3556	DllCommonsvc.exe	156
PID 3556 wrote to memory of 3088	3556	DllCommonsvc.exe	158
PID 3556 wrote to memory of 3088	3556	DllCommonsvc.exe	158
PID 3556 wrote to memory of 4584	3556	DllCommonsvc.exe	165
PID 3556 wrote to memory of 4584	3556	DllCommonsvc.exe	165
PID 4584 wrote to memory of 5456	4584	cmd.exe	170
PID 4584 wrote to memory of 5456	4584	cmd.exe	170
PID 4584 wrote to memory of 5928	4584	cmd.exe	172
PID 4584 wrote to memory of 5928	4584	cmd.exe	172
PID 5928 wrote to memory of 6064	5928	cmd.exe	173
PID 5928 wrote to memory of 6064	5928	cmd.exe	173
PID 6064 wrote to memory of 6124	6064	cmd.exe	175
PID 6064 wrote to memory of 6124	6064	cmd.exe	175
PID 6064 wrote to memory of 868	6064	cmd.exe	176
PID 6064 wrote to memory of 868	6064	cmd.exe	176
PID 868 wrote to memory of 2992	868	cmd.exe	177
PID 868 wrote to memory of 2992	868	cmd.exe	177
PID 2992 wrote to memory of 5256	2992	cmd.exe	179
PID 2992 wrote to memory of 5256	2992	cmd.exe	179
PID 2992 wrote to memory of 1308	2992	cmd.exe	180
PID 2992 wrote to memory of 1308	2992	cmd.exe	180
PID 1308 wrote to memory of 5588	1308	cmd.exe	181
PID 1308 wrote to memory of 5588	1308	cmd.exe	181
PID 5588 wrote to memory of 5260	5588	cmd.exe	183
PID 5588 wrote to memory of 5260	5588	cmd.exe	183
PID 5588 wrote to memory of 4300	5588	cmd.exe	184
PID 5588 wrote to memory of 4300	5588	cmd.exe	184

C:\Users\Admin\AppData\Local\Temp\bea63bea228e90f03925bd55ce869d6184cdeef9920e1390e6c9eaa37e946697.exe
"C:\Users\Admin\AppData\Local\Temp\bea63bea228e90f03925bd55ce869d6184cdeef9920e1390e6c9eaa37e946697.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3868
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:4568
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:772
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Checks computer location settings
      Drops file in Program Files directory
      Drops file in Windows directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3556
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4144
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Multimedia Platform\sihost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1356
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\RuntimeBroker.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3804
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\dllhost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4464
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\WindowsHolographicDevices\SpatialStore\services.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4596
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\VideoLAN\VLC\hrtfs\csrss.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3500
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\wininit.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1188
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Microsoft Office\PackageManifests\RuntimeBroker.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4632
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\csrss.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3100
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\services.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1440
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows NT\Accessories\en-US\cmd.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4412
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Mail\SppExtComObj.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:768
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Google\Temp\lsass.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4512
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\backgroundTaskHost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3088
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\dllhost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3860
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\System.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5028
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\4MKplksNno.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4584
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:5456
      - C:\Program Files (x86)\Windows NT\Accessories\en-US\cmd.exe
        
        "C:\Program Files (x86)\Windows NT\Accessories\en-US\cmd.exe"
        6⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5928
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\79RMekxjZd.bat"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:6064
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:6124
        
        C:\Program Files (x86)\Windows NT\Accessories\en-US\cmd.exe
        
        "C:\Program Files (x86)\Windows NT\Accessories\en-US\cmd.exe"
        8⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:868
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Bp0TjAk7l7.bat"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:2992
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:5256
        
        C:\Program Files (x86)\Windows NT\Accessories\en-US\cmd.exe
        
        "C:\Program Files (x86)\Windows NT\Accessories\en-US\cmd.exe"
        10⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1308
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\iMm147yiIR.bat"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:5588
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:5260
        
        C:\Program Files (x86)\Windows NT\Accessories\en-US\cmd.exe
        
        "C:\Program Files (x86)\Windows NT\Accessories\en-US\cmd.exe"
        12⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:4300
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\vIn8vbLsXf.bat"
        13⤵
        
        PID:4176
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        14⤵
        
        PID:3564
        
        C:\Program Files (x86)\Windows NT\Accessories\en-US\cmd.exe
        
        "C:\Program Files (x86)\Windows NT\Accessories\en-US\cmd.exe"
        14⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:1624
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\sWs9jrlB8v.bat"
        15⤵
        
        PID:5672
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        16⤵
        
        PID:4076
        
        C:\Program Files (x86)\Windows NT\Accessories\en-US\cmd.exe
        
        "C:\Program Files (x86)\Windows NT\Accessories\en-US\cmd.exe"
        16⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:840
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Jobc5AEC9X.bat"
        17⤵
        
        PID:3196
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        18⤵
        
        PID:4500
        
        C:\Program Files (x86)\Windows NT\Accessories\en-US\cmd.exe
        
        "C:\Program Files (x86)\Windows NT\Accessories\en-US\cmd.exe"
        18⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:3144
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Pi2dGiCBJ7.bat"
        19⤵
        
        PID:3996
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        20⤵
        
        PID:4576
        
        C:\Program Files (x86)\Windows NT\Accessories\en-US\cmd.exe
        
        "C:\Program Files (x86)\Windows NT\Accessories\en-US\cmd.exe"
        20⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:4640
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\djCrJd6RmA.bat"
        21⤵
        
        PID:572
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        22⤵
        
        PID:5424
        
        C:\Program Files (x86)\Windows NT\Accessories\en-US\cmd.exe
        
        "C:\Program Files (x86)\Windows NT\Accessories\en-US\cmd.exe"
        22⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Multimedia Platform\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Program Files\Windows Multimedia Platform\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Multimedia Platform\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4420

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\providercommon\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\providercommon\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\providercommon\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\odt\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\odt\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\odt\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Program Files\Microsoft Office\PackageManifests\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\PackageManifests\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Program Files\Microsoft Office\PackageManifests\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\WindowsHolographicDevices\SpatialStore\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2336

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Users\All Users\WindowsHolographicDevices\SpatialStore\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1128

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\WindowsHolographicDevices\SpatialStore\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\odt\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\odt\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 9 /tr "'C:\odt\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3120

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Program Files\VideoLAN\VLC\hrtfs\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\VLC\hrtfs\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3332

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Program Files\VideoLAN\VLC\hrtfs\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 6 /tr "'C:\odt\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\odt\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 13 /tr "'C:\odt\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1152

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Mail\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2456

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Mail\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Users\All Users\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 11 /tr "'C:\Users\All Users\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4440

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Google\Temp\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\Temp\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Google\Temp\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 8 /tr "'C:\providercommon\backgroundTaskHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\providercommon\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 12 /tr "'C:\providercommon\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:972

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Web Service

T1102

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cmd.exe

Path C:\Program Files (x86)\Windows NT\Accessories\en-US\cmd.exe
Size 1.0MB
SHA256 b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
MD5 bd31e94b4143c4ce49c17d3af46bcad0
SHA1 f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA512 f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
SSDEEP 24576:jTnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:HnzV/q+DnsXg
MD5 SHA1 SHA512 SSDEEP

Submit Download

cmd.exe

Path C:\Program Files (x86)\Windows NT\Accessories\en-US\cmd.exe
Size 1.0MB
SHA256 b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
MD5 bd31e94b4143c4ce49c17d3af46bcad0
SHA1 f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA512 f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
SSDEEP 24576:jTnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:HnzV/q+DnsXg
MD5 SHA1 SHA512 SSDEEP

Submit Download

cmd.exe

Path C:\Program Files (x86)\Windows NT\Accessories\en-US\cmd.exe
Size 1.0MB
SHA256 b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
MD5 bd31e94b4143c4ce49c17d3af46bcad0
SHA1 f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA512 f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
SSDEEP 24576:jTnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:HnzV/q+DnsXg
MD5 SHA1 SHA512 SSDEEP

Submit Download

cmd.exe

Path C:\Program Files (x86)\Windows NT\Accessories\en-US\cmd.exe
Size 1.0MB
SHA256 b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
MD5 bd31e94b4143c4ce49c17d3af46bcad0
SHA1 f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA512 f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
SSDEEP 24576:jTnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:HnzV/q+DnsXg
MD5 SHA1 SHA512 SSDEEP

Submit Download

cmd.exe

Path C:\Program Files (x86)\Windows NT\Accessories\en-US\cmd.exe
Size 1.0MB
SHA256 b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
MD5 bd31e94b4143c4ce49c17d3af46bcad0
SHA1 f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA512 f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
SSDEEP 24576:jTnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:HnzV/q+DnsXg
MD5 SHA1 SHA512 SSDEEP

Submit Download

cmd.exe

Path C:\Program Files (x86)\Windows NT\Accessories\en-US\cmd.exe
Size 1.0MB
SHA256 b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
MD5 bd31e94b4143c4ce49c17d3af46bcad0
SHA1 f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA512 f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
SSDEEP 24576:jTnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:HnzV/q+DnsXg
MD5 SHA1 SHA512 SSDEEP

Submit Download

cmd.exe

Path C:\Program Files (x86)\Windows NT\Accessories\en-US\cmd.exe
Size 1.0MB
SHA256 b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
MD5 bd31e94b4143c4ce49c17d3af46bcad0
SHA1 f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA512 f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
SSDEEP 24576:jTnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:HnzV/q+DnsXg
MD5 SHA1 SHA512 SSDEEP

Submit Download

cmd.exe

Path C:\Program Files (x86)\Windows NT\Accessories\en-US\cmd.exe
Size 1.0MB
SHA256 b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
MD5 bd31e94b4143c4ce49c17d3af46bcad0
SHA1 f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA512 f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
SSDEEP 24576:jTnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:HnzV/q+DnsXg
MD5 SHA1 SHA512 SSDEEP

Submit Download

cmd.exe

Path C:\Program Files (x86)\Windows NT\Accessories\en-US\cmd.exe
Size 1.0MB
SHA256 b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
MD5 bd31e94b4143c4ce49c17d3af46bcad0
SHA1 f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA512 f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
SSDEEP 24576:jTnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:HnzV/q+DnsXg
MD5 SHA1 SHA512 SSDEEP

Submit Download

cmd.exe

Path C:\Program Files (x86)\Windows NT\Accessories\en-US\cmd.exe
Size 1.0MB
SHA256 b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
MD5 bd31e94b4143c4ce49c17d3af46bcad0
SHA1 f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA512 f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
SSDEEP 24576:jTnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:HnzV/q+DnsXg
MD5 SHA1 SHA512 SSDEEP

Submit Download

cmd.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\cmd.exe.log
Size 1KB
SHA256 ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
MD5 baf55b95da4a601229647f25dad12878
SHA1 abc16954ebfd213733c4493fc1910164d825cac8
SHA512 24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
MD5 SHA1 SHA512

Submit Download