Analysis
-
max time kernel
141s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
01/11/2022, 10:39
Behavioral task
behavioral1
Sample
4c95baeb517bf5578a2c90d624727134ac2f8aeed7b032821dd564937926fe30.exe
Resource
win10v2004-20220901-en
General
-
Target
4c95baeb517bf5578a2c90d624727134ac2f8aeed7b032821dd564937926fe30.exe
-
Size
1.3MB
-
MD5
36bd1f729c2d22d40437d7dfaf00e34b
-
SHA1
3463ce26689fc9cc7e20a744dc333afaf5c1ef59
-
SHA256
4c95baeb517bf5578a2c90d624727134ac2f8aeed7b032821dd564937926fe30
-
SHA512
67c4ab1ba266993de5596ae5321a6a2b55cadf792c136935efd90cc153883e41a3982e719aeab1176e7a57aa4c3be41880e55f87d6e78b81427126771c653d65
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process 48 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2340 2164 schtasks.exe 41 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1096 2164 schtasks.exe 41 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1120 2164 schtasks.exe 41 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3960 2164 schtasks.exe 41 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4536 2164 schtasks.exe 41 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4856 2164 schtasks.exe 41 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3908 2164 schtasks.exe 41 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5112 2164 schtasks.exe 41 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4504 2164 schtasks.exe 41 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4528 2164 schtasks.exe 41 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4320 2164 schtasks.exe 41 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4476 2164 schtasks.exe 41 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4560 2164 schtasks.exe 41 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2152 2164 schtasks.exe 41 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2352 2164 schtasks.exe 41 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1348 2164 schtasks.exe 41 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2716 2164 schtasks.exe 41 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2232 2164 schtasks.exe 41 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4188 2164 schtasks.exe 41 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4360 2164 schtasks.exe 41 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1972 2164 schtasks.exe 41 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1792 2164 schtasks.exe 41 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3624 2164 schtasks.exe 41 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4608 2164 schtasks.exe 41 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1876 2164 schtasks.exe 41 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4716 2164 schtasks.exe 41 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4972 2164 schtasks.exe 41 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2644 2164 schtasks.exe 41 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1088 2164 schtasks.exe 41 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1280 2164 schtasks.exe 41 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1796 2164 schtasks.exe 41 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1556 2164 schtasks.exe 41 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3492 2164 schtasks.exe 41 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2664 2164 schtasks.exe 41 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3472 2164 schtasks.exe 41 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3208 2164 schtasks.exe 41 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4572 2164 schtasks.exe 41 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2608 2164 schtasks.exe 41 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3016 2164 schtasks.exe 41 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3236 2164 schtasks.exe 41 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1092 2164 schtasks.exe 41 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1536 2164 schtasks.exe 41 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1256 2164 schtasks.exe 41 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4324 2164 schtasks.exe 41 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3836 2164 schtasks.exe 41 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 484 2164 schtasks.exe 41 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4192 2164 schtasks.exe 41 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5052 2164 schtasks.exe 41 -
resource yara_rule behavioral1/files/0x0001000000022e00-137.dat dcrat behavioral1/files/0x0001000000022e00-138.dat dcrat behavioral1/memory/2916-139-0x00000000002D0000-0x00000000003E0000-memory.dmp dcrat behavioral1/files/0x0001000000022e09-215.dat dcrat behavioral1/files/0x0001000000022e09-216.dat dcrat behavioral1/files/0x0001000000022e09-223.dat dcrat behavioral1/files/0x0001000000022e09-231.dat dcrat behavioral1/files/0x0001000000022e09-238.dat dcrat behavioral1/files/0x0001000000022e09-245.dat dcrat behavioral1/files/0x0001000000022e09-252.dat dcrat behavioral1/files/0x0001000000022e09-259.dat dcrat behavioral1/files/0x0001000000022e09-266.dat dcrat behavioral1/files/0x0001000000022e09-273.dat dcrat behavioral1/files/0x0001000000022e09-280.dat dcrat -
Executes dropped EXE 11 IoCs
pid Process 2916 DllCommonsvc.exe 3864 conhost.exe 728 conhost.exe 3976 conhost.exe 3424 conhost.exe 1536 conhost.exe 5524 conhost.exe 4444 conhost.exe 5744 conhost.exe 796 conhost.exe 4544 conhost.exe -
Checks computer location settings 2 TTPs 12 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation conhost.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation conhost.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation conhost.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation conhost.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation 4c95baeb517bf5578a2c90d624727134ac2f8aeed7b032821dd564937926fe30.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation DllCommonsvc.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation conhost.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation conhost.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation conhost.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation conhost.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation conhost.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Drops file in Program Files directory 11 IoCs
description ioc Process File created C:\Program Files (x86)\WindowsPowerShell\Configuration\Registration\66fc9ff0ee96c2 DllCommonsvc.exe File created C:\Program Files\MSBuild\5b884080fd4f94 DllCommonsvc.exe File created C:\Program Files (x86)\Windows Portable Devices\OfficeClickToRun.exe DllCommonsvc.exe File created C:\Program Files (x86)\Windows Portable Devices\e6c9b481da804f DllCommonsvc.exe File created C:\Program Files (x86)\WindowsPowerShell\Configuration\Registration\sihost.exe DllCommonsvc.exe File created C:\Program Files (x86)\Windows Media Player\en-US\088424020bedd6 DllCommonsvc.exe File created C:\Program Files\MSBuild\fontdrvhost.exe DllCommonsvc.exe File created C:\Program Files (x86)\Internet Explorer\SIGNUP\winlogon.exe DllCommonsvc.exe File created C:\Program Files (x86)\Internet Explorer\SIGNUP\cc11b995f2a76d DllCommonsvc.exe File created C:\Program Files\ModifiableWindowsApps\dllhost.exe DllCommonsvc.exe File created C:\Program Files (x86)\Windows Media Player\en-US\conhost.exe DllCommonsvc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 48 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3960 schtasks.exe 2152 schtasks.exe 4188 schtasks.exe 1972 schtasks.exe 1876 schtasks.exe 1536 schtasks.exe 1096 schtasks.exe 4528 schtasks.exe 2232 schtasks.exe 2644 schtasks.exe 1280 schtasks.exe 3492 schtasks.exe 4504 schtasks.exe 4972 schtasks.exe 1556 schtasks.exe 3908 schtasks.exe 3624 schtasks.exe 1796 schtasks.exe 1256 schtasks.exe 5052 schtasks.exe 1120 schtasks.exe 3208 schtasks.exe 4324 schtasks.exe 3836 schtasks.exe 484 schtasks.exe 4192 schtasks.exe 5112 schtasks.exe 4320 schtasks.exe 1348 schtasks.exe 1088 schtasks.exe 2664 schtasks.exe 3472 schtasks.exe 4572 schtasks.exe 2340 schtasks.exe 4476 schtasks.exe 2352 schtasks.exe 2716 schtasks.exe 4360 schtasks.exe 4716 schtasks.exe 2608 schtasks.exe 3236 schtasks.exe 1092 schtasks.exe 4536 schtasks.exe 4856 schtasks.exe 4560 schtasks.exe 1792 schtasks.exe 4608 schtasks.exe 3016 schtasks.exe -
Modifies registry class 11 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings conhost.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings conhost.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings conhost.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings conhost.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings conhost.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings conhost.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings conhost.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings 4c95baeb517bf5578a2c90d624727134ac2f8aeed7b032821dd564937926fe30.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings DllCommonsvc.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings conhost.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings conhost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2916 DllCommonsvc.exe 2916 DllCommonsvc.exe 2916 DllCommonsvc.exe 2916 DllCommonsvc.exe 2916 DllCommonsvc.exe 2916 DllCommonsvc.exe 2916 DllCommonsvc.exe 2916 DllCommonsvc.exe 2916 DllCommonsvc.exe 2916 DllCommonsvc.exe 2916 DllCommonsvc.exe 2916 DllCommonsvc.exe 2916 DllCommonsvc.exe 2916 DllCommonsvc.exe 2916 DllCommonsvc.exe 2916 DllCommonsvc.exe 2916 DllCommonsvc.exe 2916 DllCommonsvc.exe 2916 DllCommonsvc.exe 2916 DllCommonsvc.exe 2916 DllCommonsvc.exe 3956 powershell.exe 3956 powershell.exe 4808 powershell.exe 4808 powershell.exe 4048 powershell.exe 4048 powershell.exe 2316 powershell.exe 2316 powershell.exe 1632 powershell.exe 1632 powershell.exe 3748 powershell.exe 3748 powershell.exe 4004 powershell.exe 4004 powershell.exe 2832 powershell.exe 2832 powershell.exe 5004 powershell.exe 5004 powershell.exe 1288 powershell.exe 1288 powershell.exe 796 powershell.exe 796 powershell.exe 4712 powershell.exe 4712 powershell.exe 2292 powershell.exe 2292 powershell.exe 1120 powershell.exe 1120 powershell.exe 4692 powershell.exe 4692 powershell.exe 4584 powershell.exe 4584 powershell.exe 5104 powershell.exe 5104 powershell.exe 3956 powershell.exe 3956 powershell.exe 4048 powershell.exe 4048 powershell.exe 5104 powershell.exe 4808 powershell.exe 4808 powershell.exe 2316 powershell.exe 2316 powershell.exe -
Suspicious use of AdjustPrivilegeToken 28 IoCs
description pid Process Token: SeDebugPrivilege 2916 DllCommonsvc.exe Token: SeDebugPrivilege 3956 powershell.exe Token: SeDebugPrivilege 4808 powershell.exe Token: SeDebugPrivilege 4048 powershell.exe Token: SeDebugPrivilege 2316 powershell.exe Token: SeDebugPrivilege 1632 powershell.exe Token: SeDebugPrivilege 3748 powershell.exe Token: SeDebugPrivilege 4004 powershell.exe Token: SeDebugPrivilege 2832 powershell.exe Token: SeDebugPrivilege 5004 powershell.exe Token: SeDebugPrivilege 1288 powershell.exe Token: SeDebugPrivilege 796 powershell.exe Token: SeDebugPrivilege 4712 powershell.exe Token: SeDebugPrivilege 2292 powershell.exe Token: SeDebugPrivilege 1120 powershell.exe Token: SeDebugPrivilege 4692 powershell.exe Token: SeDebugPrivilege 4584 powershell.exe Token: SeDebugPrivilege 5104 powershell.exe Token: SeDebugPrivilege 3864 conhost.exe Token: SeDebugPrivilege 728 conhost.exe Token: SeDebugPrivilege 3976 conhost.exe Token: SeDebugPrivilege 3424 conhost.exe Token: SeDebugPrivilege 1536 conhost.exe Token: SeDebugPrivilege 5524 conhost.exe Token: SeDebugPrivilege 4444 conhost.exe Token: SeDebugPrivilege 5744 conhost.exe Token: SeDebugPrivilege 796 conhost.exe Token: SeDebugPrivilege 4544 conhost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3008 wrote to memory of 2032 3008 4c95baeb517bf5578a2c90d624727134ac2f8aeed7b032821dd564937926fe30.exe 82 PID 3008 wrote to memory of 2032 3008 4c95baeb517bf5578a2c90d624727134ac2f8aeed7b032821dd564937926fe30.exe 82 PID 3008 wrote to memory of 2032 3008 4c95baeb517bf5578a2c90d624727134ac2f8aeed7b032821dd564937926fe30.exe 82 PID 2032 wrote to memory of 4744 2032 WScript.exe 86 PID 2032 wrote to memory of 4744 2032 WScript.exe 86 PID 2032 wrote to memory of 4744 2032 WScript.exe 86 PID 4744 wrote to memory of 2916 4744 cmd.exe 88 PID 4744 wrote to memory of 2916 4744 cmd.exe 88 PID 2916 wrote to memory of 3956 2916 DllCommonsvc.exe 138 PID 2916 wrote to memory of 3956 2916 DllCommonsvc.exe 138 PID 2916 wrote to memory of 4808 2916 DllCommonsvc.exe 140 PID 2916 wrote to memory of 4808 2916 DllCommonsvc.exe 140 PID 2916 wrote to memory of 4048 2916 DllCommonsvc.exe 142 PID 2916 wrote to memory of 4048 2916 DllCommonsvc.exe 142 PID 2916 wrote to memory of 2316 2916 DllCommonsvc.exe 143 PID 2916 wrote to memory of 2316 2916 DllCommonsvc.exe 143 PID 2916 wrote to memory of 2832 2916 DllCommonsvc.exe 144 PID 2916 wrote to memory of 2832 2916 DllCommonsvc.exe 144 PID 2916 wrote to memory of 5004 2916 DllCommonsvc.exe 145 PID 2916 wrote to memory of 5004 2916 DllCommonsvc.exe 145 PID 2916 wrote to memory of 4004 2916 DllCommonsvc.exe 149 PID 2916 wrote to memory of 4004 2916 DllCommonsvc.exe 149 PID 2916 wrote to memory of 1632 2916 DllCommonsvc.exe 150 PID 2916 wrote to memory of 1632 2916 DllCommonsvc.exe 150 PID 2916 wrote to memory of 3748 2916 DllCommonsvc.exe 151 PID 2916 wrote to memory of 3748 2916 DllCommonsvc.exe 151 PID 2916 wrote to memory of 1288 2916 DllCommonsvc.exe 153 PID 2916 wrote to memory of 1288 2916 DllCommonsvc.exe 153 PID 2916 wrote to memory of 796 2916 DllCommonsvc.exe 155 PID 2916 wrote to memory of 796 2916 DllCommonsvc.exe 155 PID 2916 wrote to memory of 4712 2916 DllCommonsvc.exe 157 PID 2916 wrote to memory of 4712 2916 DllCommonsvc.exe 157 PID 2916 wrote to memory of 2292 2916 DllCommonsvc.exe 167 PID 2916 wrote to memory of 2292 2916 DllCommonsvc.exe 167 PID 2916 wrote to memory of 1120 2916 DllCommonsvc.exe 161 PID 2916 wrote to memory of 1120 2916 DllCommonsvc.exe 161 PID 2916 wrote to memory of 4692 2916 DllCommonsvc.exe 166 PID 2916 wrote to memory of 4692 2916 DllCommonsvc.exe 166 PID 2916 wrote to memory of 4584 2916 DllCommonsvc.exe 164 PID 2916 wrote to memory of 4584 2916 DllCommonsvc.exe 164 PID 2916 wrote to memory of 5104 2916 DllCommonsvc.exe 169 PID 2916 wrote to memory of 5104 2916 DllCommonsvc.exe 169 PID 2916 wrote to memory of 5052 2916 DllCommonsvc.exe 173 PID 2916 wrote to memory of 5052 2916 DllCommonsvc.exe 173 PID 5052 wrote to memory of 5748 5052 cmd.exe 176 PID 5052 wrote to memory of 5748 5052 cmd.exe 176 PID 5052 wrote to memory of 3864 5052 cmd.exe 178 PID 5052 wrote to memory of 3864 5052 cmd.exe 178 PID 3864 wrote to memory of 5300 3864 conhost.exe 179 PID 3864 wrote to memory of 5300 3864 conhost.exe 179 PID 5300 wrote to memory of 2240 5300 cmd.exe 181 PID 5300 wrote to memory of 2240 5300 cmd.exe 181 PID 5300 wrote to memory of 728 5300 cmd.exe 182 PID 5300 wrote to memory of 728 5300 cmd.exe 182 PID 728 wrote to memory of 924 728 conhost.exe 183 PID 728 wrote to memory of 924 728 conhost.exe 183 PID 924 wrote to memory of 5804 924 cmd.exe 185 PID 924 wrote to memory of 5804 924 cmd.exe 185 PID 924 wrote to memory of 3976 924 cmd.exe 186 PID 924 wrote to memory of 3976 924 cmd.exe 186 PID 3976 wrote to memory of 5892 3976 conhost.exe 187 PID 3976 wrote to memory of 5892 3976 conhost.exe 187 PID 5892 wrote to memory of 5464 5892 cmd.exe 189 PID 5892 wrote to memory of 5464 5892 cmd.exe 189
Processes
-
C:\Users\Admin\AppData\Local\Temp\4c95baeb517bf5578a2c90d624727134ac2f8aeed7b032821dd564937926fe30.exe"C:\Users\Admin\AppData\Local\Temp\4c95baeb517bf5578a2c90d624727134ac2f8aeed7b032821dd564937926fe30.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\providercommon\DllCommonsvc.exe"C:\providercommon\DllCommonsvc.exe"4⤵
- Executes dropped EXE
- Checks computer location settings
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3956
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\WmiPrvSE.exe'5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4808
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\WindowsPowerShell\Configuration\Registration\sihost.exe'5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4048
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\conhost.exe'5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2316
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Music\cmd.exe'5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2832
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Media Player\en-US\conhost.exe'5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5004
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\MSBuild\fontdrvhost.exe'5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4004
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\OfficeClickToRun.exe'5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1632
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\RuntimeBroker.exe'5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3748
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\conhost.exe'5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1288
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Portable Devices\OfficeClickToRun.exe'5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:796
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Internet Explorer\SIGNUP\winlogon.exe'5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4712
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\dwm.exe'5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1120
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\dllhost.exe'5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4584
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\upfc.exe'5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4692
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\dwm.exe'5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2292
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\DllCommonsvc.exe'5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5104
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\j9zErPDE6Z.bat"5⤵
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:26⤵PID:5748
-
-
C:\Users\Admin\conhost.exe"C:\Users\Admin\conhost.exe"6⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3864 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\00vfQAbtTV.bat"7⤵
- Suspicious use of WriteProcessMemory
PID:5300 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:28⤵PID:2240
-
-
C:\Users\Admin\conhost.exe"C:\Users\Admin\conhost.exe"8⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:728 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\HZWv28qLDz.bat"9⤵
- Suspicious use of WriteProcessMemory
PID:924 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:210⤵PID:5804
-
-
C:\Users\Admin\conhost.exe"C:\Users\Admin\conhost.exe"10⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3976 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\qwBPskakqG.bat"11⤵
- Suspicious use of WriteProcessMemory
PID:5892 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:212⤵PID:5464
-
-
C:\Users\Admin\conhost.exe"C:\Users\Admin\conhost.exe"12⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3424 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\qwBPskakqG.bat"13⤵PID:5936
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:214⤵PID:3788
-
-
C:\Users\Admin\conhost.exe"C:\Users\Admin\conhost.exe"14⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1536 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\4yKdveU0JJ.bat"15⤵PID:5960
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:216⤵PID:1336
-
-
C:\Users\Admin\conhost.exe"C:\Users\Admin\conhost.exe"16⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:5524 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\BcIiUXCUMc.bat"17⤵PID:1836
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:218⤵PID:4432
-
-
C:\Users\Admin\conhost.exe"C:\Users\Admin\conhost.exe"18⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4444 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\4rzlnKig63.bat"19⤵PID:5692
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:220⤵PID:3048
-
-
C:\Users\Admin\conhost.exe"C:\Users\Admin\conhost.exe"20⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:5744 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\fBgHK1Vy37.bat"21⤵PID:3492
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:222⤵PID:4048
-
-
C:\Users\Admin\conhost.exe"C:\Users\Admin\conhost.exe"22⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:796 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\0rnbwo7iYS.bat"23⤵PID:3548
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:224⤵PID:3216
-
-
C:\Users\Admin\conhost.exe"C:\Users\Admin\conhost.exe"24⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4544
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\WmiPrvSE.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2340
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\WmiPrvSE.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1096
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\WmiPrvSE.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1120
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihosts" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\Registration\sihost.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3960
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\Registration\sihost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4536
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihosts" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\Registration\sihost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4856
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\conhost.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3908
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Users\Admin\conhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5112
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\conhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4504
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "cmdc" /sc MINUTE /mo 10 /tr "'C:\Users\Default\Music\cmd.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4528
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Users\Default\Music\cmd.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4320
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "cmdc" /sc MINUTE /mo 13 /tr "'C:\Users\Default\Music\cmd.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4476
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Media Player\en-US\conhost.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4560
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\en-US\conhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2152
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Media Player\en-US\conhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2352
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\Program Files\MSBuild\fontdrvhost.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1348
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files\MSBuild\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2716
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\Program Files\MSBuild\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2232
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\OfficeClickToRun.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4188
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\OfficeClickToRun.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4360
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\OfficeClickToRun.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1972
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\odt\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1792
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\odt\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3624
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\odt\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4608
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 12 /tr "'C:\providercommon\conhost.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1876
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\providercommon\conhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4716
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 7 /tr "'C:\providercommon\conhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4972
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Portable Devices\OfficeClickToRun.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2644
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\OfficeClickToRun.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1088
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Portable Devices\OfficeClickToRun.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1280
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Internet Explorer\SIGNUP\winlogon.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1796
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\SIGNUP\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1556
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Internet Explorer\SIGNUP\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3492
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 12 /tr "'C:\odt\dwm.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2664
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\odt\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3472
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 7 /tr "'C:\odt\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3208
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\odt\dwm.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4572
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\odt\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2608
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\odt\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3016
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "upfcu" /sc MINUTE /mo 12 /tr "'C:\providercommon\upfc.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3236
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\providercommon\upfc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1092
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "upfcu" /sc MINUTE /mo 14 /tr "'C:\providercommon\upfc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1536
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\providercommon\dllhost.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1256
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\providercommon\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4324
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\providercommon\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3836
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\DllCommonsvc.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:484
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\DllCommonsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4192
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\DllCommonsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5052
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5baf55b95da4a601229647f25dad12878
SHA1abc16954ebfd213733c4493fc1910164d825cac8
SHA256ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
SHA51224f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD5ecceac16628651c18879d836acfcb062
SHA1420502b3e5220a01586c59504e94aa1ee11982c9
SHA25658238de09a8817ed9f894ed8e5bf06a897fd08e0b0bd77e508d37b2598edd2a9
SHA512be3c7cb529cafb00f58790a6f8b35c4ff6db9f7f43a507d2218fd80cebc88413e46f71b1bc35b8afcc36b68f9409c946470d1e74a4fe225400eeb6f3f898f5b3
-
Filesize
944B
MD5ecceac16628651c18879d836acfcb062
SHA1420502b3e5220a01586c59504e94aa1ee11982c9
SHA25658238de09a8817ed9f894ed8e5bf06a897fd08e0b0bd77e508d37b2598edd2a9
SHA512be3c7cb529cafb00f58790a6f8b35c4ff6db9f7f43a507d2218fd80cebc88413e46f71b1bc35b8afcc36b68f9409c946470d1e74a4fe225400eeb6f3f898f5b3
-
Filesize
944B
MD5e8ce785f8ccc6d202d56fefc59764945
SHA1ca032c62ddc5e0f26d84eff9895eb87f14e15960
SHA256d85c19fc6b9d25e2168a2cc50ff38bd226fbf4f02aa7ac038a5f319522d2ffa4
SHA51266460aec4afee582556270f8ee6048d130a090f1c12a2632ed71a99a4073e9931e9e1cc286e32debffb95a90bd955f0f0d6ec891b1c5cd2f0aae41eb6d25832f
-
Filesize
944B
MD5e8ce785f8ccc6d202d56fefc59764945
SHA1ca032c62ddc5e0f26d84eff9895eb87f14e15960
SHA256d85c19fc6b9d25e2168a2cc50ff38bd226fbf4f02aa7ac038a5f319522d2ffa4
SHA51266460aec4afee582556270f8ee6048d130a090f1c12a2632ed71a99a4073e9931e9e1cc286e32debffb95a90bd955f0f0d6ec891b1c5cd2f0aae41eb6d25832f
-
Filesize
944B
MD5377c375f814a335a131901ed5d5eca44
SHA19919811b18b4f8153541b332232ae88eec42f9f7
SHA2567a73ac126468f3a94954656a0da1b494b18b6f7fc4ee09beb87573e82f300a10
SHA512c511dff1a34a5e32cf0ce2c56aa3adf71bd51e9a5afc7ae75320ac7563ebb4571f6ac5cd771fa52e9c7966112431bbdd20e4b74e1a125c273bc835f127b599b5
-
Filesize
944B
MD5377c375f814a335a131901ed5d5eca44
SHA19919811b18b4f8153541b332232ae88eec42f9f7
SHA2567a73ac126468f3a94954656a0da1b494b18b6f7fc4ee09beb87573e82f300a10
SHA512c511dff1a34a5e32cf0ce2c56aa3adf71bd51e9a5afc7ae75320ac7563ebb4571f6ac5cd771fa52e9c7966112431bbdd20e4b74e1a125c273bc835f127b599b5
-
Filesize
944B
MD5377c375f814a335a131901ed5d5eca44
SHA19919811b18b4f8153541b332232ae88eec42f9f7
SHA2567a73ac126468f3a94954656a0da1b494b18b6f7fc4ee09beb87573e82f300a10
SHA512c511dff1a34a5e32cf0ce2c56aa3adf71bd51e9a5afc7ae75320ac7563ebb4571f6ac5cd771fa52e9c7966112431bbdd20e4b74e1a125c273bc835f127b599b5
-
Filesize
944B
MD5377c375f814a335a131901ed5d5eca44
SHA19919811b18b4f8153541b332232ae88eec42f9f7
SHA2567a73ac126468f3a94954656a0da1b494b18b6f7fc4ee09beb87573e82f300a10
SHA512c511dff1a34a5e32cf0ce2c56aa3adf71bd51e9a5afc7ae75320ac7563ebb4571f6ac5cd771fa52e9c7966112431bbdd20e4b74e1a125c273bc835f127b599b5
-
Filesize
944B
MD5377c375f814a335a131901ed5d5eca44
SHA19919811b18b4f8153541b332232ae88eec42f9f7
SHA2567a73ac126468f3a94954656a0da1b494b18b6f7fc4ee09beb87573e82f300a10
SHA512c511dff1a34a5e32cf0ce2c56aa3adf71bd51e9a5afc7ae75320ac7563ebb4571f6ac5cd771fa52e9c7966112431bbdd20e4b74e1a125c273bc835f127b599b5
-
Filesize
944B
MD5377c375f814a335a131901ed5d5eca44
SHA19919811b18b4f8153541b332232ae88eec42f9f7
SHA2567a73ac126468f3a94954656a0da1b494b18b6f7fc4ee09beb87573e82f300a10
SHA512c511dff1a34a5e32cf0ce2c56aa3adf71bd51e9a5afc7ae75320ac7563ebb4571f6ac5cd771fa52e9c7966112431bbdd20e4b74e1a125c273bc835f127b599b5
-
Filesize
944B
MD55f0ddc7f3691c81ee14d17b419ba220d
SHA1f0ef5fde8bab9d17c0b47137e014c91be888ee53
SHA256a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5
SHA5122ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3
-
Filesize
944B
MD5101c3b86ef1c02c62b7d862c2a47363b
SHA13c5e8d309610e5ba41b6b9788bfb826e45864b46
SHA2569174446e5bf6366c610c790d5176cf11a65574345cc15ca7ded7247daf4d233c
SHA512d199aa9fbfefea6a27e1c6414b17c1e03c39840047f03c71788f83d37f30651df49dc865c0c38214bab7923bcd2e57e064817b9f1453818c2e7a29d3686d2d60
-
Filesize
944B
MD5e8ce785f8ccc6d202d56fefc59764945
SHA1ca032c62ddc5e0f26d84eff9895eb87f14e15960
SHA256d85c19fc6b9d25e2168a2cc50ff38bd226fbf4f02aa7ac038a5f319522d2ffa4
SHA51266460aec4afee582556270f8ee6048d130a090f1c12a2632ed71a99a4073e9931e9e1cc286e32debffb95a90bd955f0f0d6ec891b1c5cd2f0aae41eb6d25832f
-
Filesize
944B
MD5e8ce785f8ccc6d202d56fefc59764945
SHA1ca032c62ddc5e0f26d84eff9895eb87f14e15960
SHA256d85c19fc6b9d25e2168a2cc50ff38bd226fbf4f02aa7ac038a5f319522d2ffa4
SHA51266460aec4afee582556270f8ee6048d130a090f1c12a2632ed71a99a4073e9931e9e1cc286e32debffb95a90bd955f0f0d6ec891b1c5cd2f0aae41eb6d25832f
-
Filesize
944B
MD5e8ce785f8ccc6d202d56fefc59764945
SHA1ca032c62ddc5e0f26d84eff9895eb87f14e15960
SHA256d85c19fc6b9d25e2168a2cc50ff38bd226fbf4f02aa7ac038a5f319522d2ffa4
SHA51266460aec4afee582556270f8ee6048d130a090f1c12a2632ed71a99a4073e9931e9e1cc286e32debffb95a90bd955f0f0d6ec891b1c5cd2f0aae41eb6d25832f
-
Filesize
944B
MD560804e808a88131a5452fed692914a8e
SHA1fdb74669923b31d573787fe024dbd701fa21bb5b
SHA256064fdd6e9e6e7f51da354604a56f66217f1edfc12d9bbbaf869a628915a86a61
SHA512d4f2791433c0bacd8cad57b40fab4a807db4dd74f7c5357d2bce9aaa6544f97667497307d1e0704b98e2c99a94775fbb6ea676685a01578e4d0304f541c9854a
-
Filesize
191B
MD5ab933e27aee52c88e76189bf925b1659
SHA18a707ffcd67bec64f8c0ddaf5a4056c872a107c2
SHA2563368ae6c1f5f87a3aca1595133d31623c72742a4ada55ce5d44c0934f42d76e8
SHA512db5f452c941e1d24db3dab20674f0606cbedf8d669e47c4be56284e5e60a9b21f44f94152c81eb15ee053dd05de5398df1ab401994c00a5201e0337b8248dcfd
-
Filesize
191B
MD51b326ea76a566e8cea6d2befb691fa66
SHA1dca2f9837f85ef2d868e6441187960ceef85c2bd
SHA256428be1a2fe6ff4d0a34d50621c3a4854a4b1058553b80ba8da85bba8bb413ef7
SHA5120ab9e4e9b4f768a42c6479359bc56ceeca40e08deaf2e6358fe426041574af9d79b0b3d4cea0bc7e1a16c92f573486f04bd1fe1ca294b7a702f0e556eea04abc
-
Filesize
191B
MD540c5b9fd27efcedb204af88bf549a55e
SHA1607611b3b6f1a95edc4104773689dd81e4b985f9
SHA25655242d4433be0079c3a6987ef98e18536cb8d432f8f1596225b8aba544e28d1a
SHA5124ee526b31a129dbc098a2f972fd519f57e1d5499176b570d5ed5f5004e1ae9509a28f65e5c241e25a2311560467ecfd784f9c81f6fce384e1af8290e421f831d
-
Filesize
191B
MD5ffea17289c28c3d1d5d2baa0b1f6f0c7
SHA1645b8c9724df56515e361d6b4602d5d5bb5bc607
SHA256c1594482676fecc464121d0b15ba691823ea554b278a519dbcc978778a29849f
SHA512a35d9b6ead7dbf7a4d2193bf902c5520134fbf5079c9fc00f9e5d8a0143a9753e35e386bd64fe89ec44642ac01742a7a66f17963c2178ebb36168f759ea61fa8
-
Filesize
191B
MD5a747dbb305a57a8cc4452e3f1817db70
SHA139a2685021ec1dc27d0726e0c0fca6cf6f5689e8
SHA256b91b113309583c0390c6f810633dd062a2f6ef93a6a328cd5c131af0f2538b2f
SHA51235130831fe00c52dbc275ea36163deaa2eecb06e1be048e43a54d823d5b022e0d78f9919e36428d4b6764bf9f20c1fcd6a0960e15fae9433523d7f060d722ada
-
Filesize
191B
MD59c4641acd8afa3736e25d29060a49f0f
SHA1ae9fa82fd25d72577ee5b9b7d31664e646e0ef0a
SHA2568ffcdea4c237f4625ed3f73d34775e8e6341ec3aa7f585f121e582893c2d54f2
SHA512197fff557c5095240ba461499e9317a40139118b80c8b1c4b97de68ac3653ec0b4d866c49efffcf1937dc26c087e85be5cf4855a57b2d1cf6f242eceec458ae2
-
Filesize
191B
MD5931307b39e6e038fc80af43400160656
SHA1fb814c5a2fe2faf97bc99696064228cac06be1f5
SHA25641f6914bc7279a224099fdda87366f068931c3ef5ab7f144f010f8a02bfaf3ad
SHA512d23fb2d60f675208e6dc41c1175cccd115fb98254d3a2594ccac40e00ef0dd4c3ec9c2d12539afe4a6cf97d4c1fd7632cd459524dc99bf2ab0a0eb71896e9e88
-
Filesize
191B
MD52b426971763b8f4c3d4d4a37a1fc47fd
SHA12711b1b488e6963cee4e61fa1aeb99a046779058
SHA256f5c0d93ad335266bb0e13eaa2064c793dff845767f129afb351e93b5c919ae4f
SHA512f7649378819cd0283354f9270a6d39750a84da7b0cfe245bd881652b749822bc89e7d6953cc78fa4d9537b77a2ac5a66d92223903c00e5c95a357942afe4a39f
-
Filesize
191B
MD5134890807e7c10d8d1fd64ca8410d6bb
SHA18d3f6d3c33f2e8ecc51147b333bd162456bcbbc3
SHA256e438cd9330b01fc0dcfe4ffcff8c45436ff025305378fcd48db60a5455cad5f6
SHA512f418f88b5ba4fdfee5299b5f601213f405e8d77b5c1a2928263d7d023e202401a4b6a0cce7f060dba52ac1b8cca4b08aefb9a5609a921adba1ff7fbd9557301c
-
Filesize
191B
MD5134890807e7c10d8d1fd64ca8410d6bb
SHA18d3f6d3c33f2e8ecc51147b333bd162456bcbbc3
SHA256e438cd9330b01fc0dcfe4ffcff8c45436ff025305378fcd48db60a5455cad5f6
SHA512f418f88b5ba4fdfee5299b5f601213f405e8d77b5c1a2928263d7d023e202401a4b6a0cce7f060dba52ac1b8cca4b08aefb9a5609a921adba1ff7fbd9557301c
-
Filesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
Filesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
Filesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
Filesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
Filesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
Filesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
Filesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
Filesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
Filesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
Filesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
Filesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
Filesize
36B
MD56783c3ee07c7d151ceac57f1f9c8bed7
SHA117468f98f95bf504cc1f83c49e49a78526b3ea03
SHA2568ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322
SHA512c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8
-
Filesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
Filesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
Filesize
197B
MD58088241160261560a02c84025d107592
SHA1083121f7027557570994c9fc211df61730455bb5
SHA2562072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1
SHA51220d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478