dcrat | 6c639212b290b06dd4a17dc0d8540292a4d2b31acf9fd84aa612ef8fbbec3011

Analysis

max time kernel
154s
max time network
155s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
01/11/2022, 11:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6c639212b290b06dd4a17dc0d8540292a4d2b31acf9fd84aa612ef8fbbec3011.exe
Size 1.3MB
Sample221101-nls4escdbn
SHA256 6c639212b290b06dd4a17dc0d8540292a4d2b31acf9fd84aa612ef8fbbec3011
MD5 592cc1595f4e19a6a2bae27b6d128513
SHA1 ea7c83185773bad7e733771e990a8dea375e25c5
SHA512 d55b822a0cb82bf06a61380b96708d1f08d0864e7b17a77eb3db743806532868f5e0c917e05e820f282e955e2d71285c6e3a185fb374c2cf3b4e7b4d58f1e516
SSDEEP 24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 48 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4456	4752	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3136	4752	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4248	4752	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4524	4752	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3028	4752	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3888	4752	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2928	4752	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4516	4752	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5012	4752	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4900	4752	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4912	4752	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4580	4752	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2904	4752	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4540	4752	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4576	4752	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3172	4752	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2804	4752	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4480	4752	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4452	4752	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4404	4752	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4436	4752	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4468	4752	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4372	4752	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	776	4752	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4632	4752	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3156	4752	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3200	4752	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3760	4752	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1060	4752	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	476	4752	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1356	4752	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1348	4752	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4636	4752	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	872	4752	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3984	4752	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1776	4752	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	516	4752	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4620	4752	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1560	4752	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	212	4752	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	312	4752	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3312	4752	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2268	4752	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2256	4752	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1868	4752	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	648	4752	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	508	4752	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1920	4752	schtasks.exe	70

DCRat payload 17 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x000600000001ac35-280.dat	dcrat
behavioral1/files/0x000600000001ac35-281.dat	dcrat
behavioral1/memory/3936-282-0x0000000000DD0000-0x0000000000EE0000-memory.dmp	dcrat
behavioral1/files/0x000600000001ac61-607.dat	dcrat
behavioral1/files/0x000600000001ac61-606.dat	dcrat
behavioral1/files/0x000600000001ac61-912.dat	dcrat
behavioral1/files/0x000600000001ac61-918.dat	dcrat
behavioral1/files/0x000600000001ac61-923.dat	dcrat
behavioral1/files/0x000600000001ac61-928.dat	dcrat
behavioral1/files/0x000600000001ac61-933.dat	dcrat
behavioral1/files/0x000600000001ac61-938.dat	dcrat
behavioral1/files/0x000600000001ac61-943.dat	dcrat
behavioral1/files/0x000600000001ac61-949.dat	dcrat
behavioral1/files/0x000600000001ac61-954.dat	dcrat
behavioral1/files/0x000600000001ac61-959.dat	dcrat
behavioral1/files/0x000600000001ac61-965.dat	dcrat
behavioral1/files/0x000600000001ac61-970.dat	dcrat

Executes dropped EXE 14 IoCs

pid	Process
3936	DllCommonsvc.exe
500	lsass.exe
5824	lsass.exe
6004	lsass.exe
5288	lsass.exe
5068	lsass.exe
5592	lsass.exe
4884	lsass.exe
5632	lsass.exe
3172	lsass.exe
5532	lsass.exe
3928	lsass.exe
5732	lsass.exe
4600	lsass.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in Program Files directory 13 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Mail\en-US\e6c9b481da804f	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Media Player\Icons\csrss.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\6203df4a6bafc7	DllCommonsvc.exe
File created	C:\Program Files\7-Zip\Lang\ebf1f9fa8afd6d	DllCommonsvc.exe
File created	C:\Program Files\Windows Sidebar\Shared Gadgets\fontdrvhost.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Google\Update\Offline\dllhost.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Mail\en-US\OfficeClickToRun.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\lsass.exe	DllCommonsvc.exe
File created	C:\Program Files\Microsoft Office\Office16\dllhost.exe	DllCommonsvc.exe
File created	C:\Program Files\Microsoft Office\Office16\5940a34987c991	DllCommonsvc.exe
File created	C:\Program Files\7-Zip\Lang\cmd.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Sidebar\Shared Gadgets\5b884080fd4f94	DllCommonsvc.exe
File created	C:\Program Files (x86)\Google\Update\Offline\5940a34987c991	DllCommonsvc.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Media\Garden\services.exe	DllCommonsvc.exe
File created	C:\Windows\Media\Garden\c5b4cb5e9653cc	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 48 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
212	schtasks.exe
2256	schtasks.exe
1868	schtasks.exe
1920	schtasks.exe
3136	schtasks.exe
3172	schtasks.exe
4632	schtasks.exe
4636	schtasks.exe
3984	schtasks.exe
3312	schtasks.exe
508	schtasks.exe
2804	schtasks.exe
3156	schtasks.exe
476	schtasks.exe
1776	schtasks.exe
312	schtasks.exe
4516	schtasks.exe
4436	schtasks.exe
1060	schtasks.exe
2268	schtasks.exe
648	schtasks.exe
4248	schtasks.exe
4468	schtasks.exe
872	schtasks.exe
4372	schtasks.exe
3760	schtasks.exe
516	schtasks.exe
4900	schtasks.exe
4580	schtasks.exe
4480	schtasks.exe
2904	schtasks.exe
4540	schtasks.exe
4404	schtasks.exe
3200	schtasks.exe
1348	schtasks.exe
4524	schtasks.exe
3028	schtasks.exe
4912	schtasks.exe
1560	schtasks.exe
4452	schtasks.exe
776	schtasks.exe
4620	schtasks.exe
4456	schtasks.exe
3888	schtasks.exe
5012	schtasks.exe
2928	schtasks.exe
4576	schtasks.exe
1356	schtasks.exe

Modifies registry class 14 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	lsass.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	lsass.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	lsass.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	lsass.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	lsass.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	lsass.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	lsass.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	lsass.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	lsass.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	lsass.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	lsass.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	lsass.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	6c639212b290b06dd4a17dc0d8540292a4d2b31acf9fd84aa612ef8fbbec3011.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3936	DllCommonsvc.exe
3936	DllCommonsvc.exe
3936	DllCommonsvc.exe
3936	DllCommonsvc.exe
3936	DllCommonsvc.exe
3936	DllCommonsvc.exe
3936	DllCommonsvc.exe
3936	DllCommonsvc.exe
3936	DllCommonsvc.exe
3936	DllCommonsvc.exe
3936	DllCommonsvc.exe
3936	DllCommonsvc.exe
3936	DllCommonsvc.exe
2508	powershell.exe
2508	powershell.exe
2508	powershell.exe
2664	powershell.exe
2664	powershell.exe
2908	powershell.exe
2908	powershell.exe
2664	powershell.exe
2076	powershell.exe
2076	powershell.exe
3812	powershell.exe
3812	powershell.exe
2700	powershell.exe
2700	powershell.exe
3588	powershell.exe
3588	powershell.exe
2664	powershell.exe
2508	powershell.exe
2908	powershell.exe
4656	powershell.exe
4656	powershell.exe
3812	powershell.exe
3704	powershell.exe
3704	powershell.exe
1976	powershell.exe
1976	powershell.exe
3588	powershell.exe
4820	powershell.exe
4820	powershell.exe
2136	powershell.exe
2136	powershell.exe
5092	powershell.exe
5092	powershell.exe
4084	powershell.exe
4084	powershell.exe
3704	powershell.exe
3828	powershell.exe
3828	powershell.exe
4308	powershell.exe
4308	powershell.exe
3812	powershell.exe
3588	powershell.exe
2076	powershell.exe
2908	powershell.exe
3376	powershell.exe
3376	powershell.exe
3704	powershell.exe
2700	powershell.exe
3376	powershell.exe
4656	powershell.exe
1976	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3936	DllCommonsvc.exe
Token: SeDebugPrivilege	2508	powershell.exe
Token: SeDebugPrivilege	2664	powershell.exe
Token: SeDebugPrivilege	2908	powershell.exe
Token: SeDebugPrivilege	2076	powershell.exe
Token: SeDebugPrivilege	3812	powershell.exe
Token: SeDebugPrivilege	2700	powershell.exe
Token: SeDebugPrivilege	3588	powershell.exe
Token: SeDebugPrivilege	4656	powershell.exe
Token: SeDebugPrivilege	3704	powershell.exe
Token: SeDebugPrivilege	1976	powershell.exe
Token: SeDebugPrivilege	4820	powershell.exe
Token: SeDebugPrivilege	2136	powershell.exe
Token: SeDebugPrivilege	5092	powershell.exe
Token: SeDebugPrivilege	4084	powershell.exe
Token: SeDebugPrivilege	3828	powershell.exe
Token: SeDebugPrivilege	4308	powershell.exe
Token: SeDebugPrivilege	3376	powershell.exe
Token: SeIncreaseQuotaPrivilege	2664	powershell.exe
Token: SeSecurityPrivilege	2664	powershell.exe
Token: SeTakeOwnershipPrivilege	2664	powershell.exe
Token: SeLoadDriverPrivilege	2664	powershell.exe
Token: SeSystemProfilePrivilege	2664	powershell.exe
Token: SeSystemtimePrivilege	2664	powershell.exe
Token: SeProfSingleProcessPrivilege	2664	powershell.exe
Token: SeIncBasePriorityPrivilege	2664	powershell.exe
Token: SeCreatePagefilePrivilege	2664	powershell.exe
Token: SeBackupPrivilege	2664	powershell.exe
Token: SeRestorePrivilege	2664	powershell.exe
Token: SeShutdownPrivilege	2664	powershell.exe
Token: SeDebugPrivilege	2664	powershell.exe
Token: SeSystemEnvironmentPrivilege	2664	powershell.exe
Token: SeRemoteShutdownPrivilege	2664	powershell.exe
Token: SeUndockPrivilege	2664	powershell.exe
Token: SeManageVolumePrivilege	2664	powershell.exe
Token: 33	2664	powershell.exe
Token: 34	2664	powershell.exe
Token: 35	2664	powershell.exe
Token: 36	2664	powershell.exe
Token: SeDebugPrivilege	500	lsass.exe
Token: SeIncreaseQuotaPrivilege	2508	powershell.exe
Token: SeSecurityPrivilege	2508	powershell.exe
Token: SeTakeOwnershipPrivilege	2508	powershell.exe
Token: SeLoadDriverPrivilege	2508	powershell.exe
Token: SeSystemProfilePrivilege	2508	powershell.exe
Token: SeSystemtimePrivilege	2508	powershell.exe
Token: SeProfSingleProcessPrivilege	2508	powershell.exe
Token: SeIncBasePriorityPrivilege	2508	powershell.exe
Token: SeCreatePagefilePrivilege	2508	powershell.exe
Token: SeBackupPrivilege	2508	powershell.exe
Token: SeRestorePrivilege	2508	powershell.exe
Token: SeShutdownPrivilege	2508	powershell.exe
Token: SeDebugPrivilege	2508	powershell.exe
Token: SeSystemEnvironmentPrivilege	2508	powershell.exe
Token: SeRemoteShutdownPrivilege	2508	powershell.exe
Token: SeUndockPrivilege	2508	powershell.exe
Token: SeManageVolumePrivilege	2508	powershell.exe
Token: 33	2508	powershell.exe
Token: 34	2508	powershell.exe
Token: 35	2508	powershell.exe
Token: 36	2508	powershell.exe
Token: SeIncreaseQuotaPrivilege	3812	powershell.exe
Token: SeSecurityPrivilege	3812	powershell.exe
Token: SeTakeOwnershipPrivilege	3812	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2692 wrote to memory of 4768	2692	6c639212b290b06dd4a17dc0d8540292a4d2b31acf9fd84aa612ef8fbbec3011.exe	66
PID 2692 wrote to memory of 4768	2692	6c639212b290b06dd4a17dc0d8540292a4d2b31acf9fd84aa612ef8fbbec3011.exe	66
PID 2692 wrote to memory of 4768	2692	6c639212b290b06dd4a17dc0d8540292a4d2b31acf9fd84aa612ef8fbbec3011.exe	66
PID 4768 wrote to memory of 3680	4768	WScript.exe	67
PID 4768 wrote to memory of 3680	4768	WScript.exe	67
PID 4768 wrote to memory of 3680	4768	WScript.exe	67
PID 3680 wrote to memory of 3936	3680	cmd.exe	69
PID 3680 wrote to memory of 3936	3680	cmd.exe	69
PID 3936 wrote to memory of 2908	3936	DllCommonsvc.exe	119
PID 3936 wrote to memory of 2908	3936	DllCommonsvc.exe	119
PID 3936 wrote to memory of 2508	3936	DllCommonsvc.exe	122
PID 3936 wrote to memory of 2508	3936	DllCommonsvc.exe	122
PID 3936 wrote to memory of 2664	3936	DllCommonsvc.exe	120
PID 3936 wrote to memory of 2664	3936	DllCommonsvc.exe	120
PID 3936 wrote to memory of 2076	3936	DllCommonsvc.exe	123
PID 3936 wrote to memory of 2076	3936	DllCommonsvc.exe	123
PID 3936 wrote to memory of 3812	3936	DllCommonsvc.exe	124
PID 3936 wrote to memory of 3812	3936	DllCommonsvc.exe	124
PID 3936 wrote to memory of 2700	3936	DllCommonsvc.exe	125
PID 3936 wrote to memory of 2700	3936	DllCommonsvc.exe	125
PID 3936 wrote to memory of 4656	3936	DllCommonsvc.exe	127
PID 3936 wrote to memory of 4656	3936	DllCommonsvc.exe	127
PID 3936 wrote to memory of 3588	3936	DllCommonsvc.exe	134
PID 3936 wrote to memory of 3588	3936	DllCommonsvc.exe	134
PID 3936 wrote to memory of 3704	3936	DllCommonsvc.exe	130
PID 3936 wrote to memory of 3704	3936	DllCommonsvc.exe	130
PID 3936 wrote to memory of 1976	3936	DllCommonsvc.exe	131
PID 3936 wrote to memory of 1976	3936	DllCommonsvc.exe	131
PID 3936 wrote to memory of 4820	3936	DllCommonsvc.exe	138
PID 3936 wrote to memory of 4820	3936	DllCommonsvc.exe	138
PID 3936 wrote to memory of 2136	3936	DllCommonsvc.exe	139
PID 3936 wrote to memory of 2136	3936	DllCommonsvc.exe	139
PID 3936 wrote to memory of 5092	3936	DllCommonsvc.exe	141
PID 3936 wrote to memory of 5092	3936	DllCommonsvc.exe	141
PID 3936 wrote to memory of 4084	3936	DllCommonsvc.exe	143
PID 3936 wrote to memory of 4084	3936	DllCommonsvc.exe	143
PID 3936 wrote to memory of 3828	3936	DllCommonsvc.exe	145
PID 3936 wrote to memory of 3828	3936	DllCommonsvc.exe	145
PID 3936 wrote to memory of 4308	3936	DllCommonsvc.exe	149
PID 3936 wrote to memory of 4308	3936	DllCommonsvc.exe	149
PID 3936 wrote to memory of 3376	3936	DllCommonsvc.exe	147
PID 3936 wrote to memory of 3376	3936	DllCommonsvc.exe	147
PID 3936 wrote to memory of 3180	3936	DllCommonsvc.exe	153
PID 3936 wrote to memory of 3180	3936	DllCommonsvc.exe	153
PID 3180 wrote to memory of 4404	3180	cmd.exe	155
PID 3180 wrote to memory of 4404	3180	cmd.exe	155
PID 3180 wrote to memory of 500	3180	cmd.exe	156
PID 3180 wrote to memory of 500	3180	cmd.exe	156
PID 500 wrote to memory of 5716	500	lsass.exe	160
PID 500 wrote to memory of 5716	500	lsass.exe	160
PID 5716 wrote to memory of 5804	5716	cmd.exe	158
PID 5716 wrote to memory of 5804	5716	cmd.exe	158
PID 5716 wrote to memory of 5824	5716	cmd.exe	161
PID 5716 wrote to memory of 5824	5716	cmd.exe	161
PID 5824 wrote to memory of 5928	5824	lsass.exe	163
PID 5824 wrote to memory of 5928	5824	lsass.exe	163
PID 5928 wrote to memory of 5984	5928	cmd.exe	164
PID 5928 wrote to memory of 5984	5928	cmd.exe	164
PID 5928 wrote to memory of 6004	5928	cmd.exe	165
PID 5928 wrote to memory of 6004	5928	cmd.exe	165
PID 6004 wrote to memory of 6108	6004	lsass.exe	168
PID 6004 wrote to memory of 6108	6004	lsass.exe	168
PID 6108 wrote to memory of 5248	6108	cmd.exe	167
PID 6108 wrote to memory of 5248	6108	cmd.exe	167

C:\Users\Admin\AppData\Local\Temp\6c639212b290b06dd4a17dc0d8540292a4d2b31acf9fd84aa612ef8fbbec3011.exe
"C:\Users\Admin\AppData\Local\Temp\6c639212b290b06dd4a17dc0d8540292a4d2b31acf9fd84aa612ef8fbbec3011.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2692
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4768
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3680
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3936
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2908
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\OfficeClickToRun.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2664
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\fontdrvhost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2508
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\dllhost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2076
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\DllCommonsvc.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3812
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\sihost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2700
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\Idle.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4656
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Google\Chrome\Application\SetupMetrics\conhost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3704
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Mozilla Maintenance Service\logs\lsass.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1976
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Media\Garden\services.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3588
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Microsoft Office\Office16\dllhost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4820
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\dllhost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2136
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\7-Zip\Lang\cmd.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5092
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Sidebar\Shared Gadgets\fontdrvhost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4084
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Google\Update\Offline\dllhost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3828
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Mail\en-US\OfficeClickToRun.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3376
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\taskhostw.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4308
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\j1kG62r9vx.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3180
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:4404
      - C:\Program Files (x86)\Mozilla Maintenance Service\logs\lsass.exe
        
        "C:\Program Files (x86)\Mozilla Maintenance Service\logs\lsass.exe"
        6⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:500
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\jFR8woBO6B.bat"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:5716
        
        C:\Program Files (x86)\Mozilla Maintenance Service\logs\lsass.exe
        
        "C:\Program Files (x86)\Mozilla Maintenance Service\logs\lsass.exe"
        8⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5824
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ZfR0hqQ1j6.bat"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:5928
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:5984
        
        C:\Program Files (x86)\Mozilla Maintenance Service\logs\lsass.exe
        
        "C:\Program Files (x86)\Mozilla Maintenance Service\logs\lsass.exe"
        10⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:6004
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\gSW9k5bhgR.bat"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:6108
        
        C:\Program Files (x86)\Mozilla Maintenance Service\logs\lsass.exe
        
        "C:\Program Files (x86)\Mozilla Maintenance Service\logs\lsass.exe"
        12⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5288
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\p9sA7N8NGm.bat"
        13⤵
        
        PID:5412
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        14⤵
        
        PID:4232
        
        C:\Program Files (x86)\Mozilla Maintenance Service\logs\lsass.exe
        
        "C:\Program Files (x86)\Mozilla Maintenance Service\logs\lsass.exe"
        14⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5068
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\pI0EcicZAo.bat"
        15⤵
        
        PID:4572
        
        C:\Program Files (x86)\Mozilla Maintenance Service\logs\lsass.exe
        
        "C:\Program Files (x86)\Mozilla Maintenance Service\logs\lsass.exe"
        16⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5592
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\cSLzsZ1i8q.bat"
        17⤵
        
        PID:3948
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        18⤵
        
        PID:4336
        
        C:\Program Files (x86)\Mozilla Maintenance Service\logs\lsass.exe
        
        "C:\Program Files (x86)\Mozilla Maintenance Service\logs\lsass.exe"
        18⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4884
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\s5uDoSCHZY.bat"
        19⤵
        
        PID:5056
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        20⤵
        
        PID:4888
        
        C:\Program Files (x86)\Mozilla Maintenance Service\logs\lsass.exe
        
        "C:\Program Files (x86)\Mozilla Maintenance Service\logs\lsass.exe"
        20⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5632
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\wHaMzi6eYE.bat"
        21⤵
        
        PID:1948
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        22⤵
        
        PID:4508
        
        C:\Program Files (x86)\Mozilla Maintenance Service\logs\lsass.exe
        
        "C:\Program Files (x86)\Mozilla Maintenance Service\logs\lsass.exe"
        22⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3172
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\kKaF7FiTK0.bat"
        23⤵
        
        PID:3504
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        24⤵
        
        PID:5660
        
        C:\Program Files (x86)\Mozilla Maintenance Service\logs\lsass.exe
        
        "C:\Program Files (x86)\Mozilla Maintenance Service\logs\lsass.exe"
        24⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5532
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ZfR0hqQ1j6.bat"
        25⤵
        
        PID:5552
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        26⤵
        
        PID:1048
        
        C:\Program Files (x86)\Mozilla Maintenance Service\logs\lsass.exe
        
        "C:\Program Files (x86)\Mozilla Maintenance Service\logs\lsass.exe"
        26⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3928
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\uuaNNDTqg5.bat"
        27⤵
        
        PID:3044
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        28⤵
        
        PID:5564
        
        C:\Program Files (x86)\Mozilla Maintenance Service\logs\lsass.exe
        
        "C:\Program Files (x86)\Mozilla Maintenance Service\logs\lsass.exe"
        28⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5732
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\LdHmevWlG3.bat"
        29⤵
        
        PID:2308
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        30⤵
        
        PID:3900
        
        C:\Program Files (x86)\Mozilla Maintenance Service\logs\lsass.exe
        
        "C:\Program Files (x86)\Mozilla Maintenance Service\logs\lsass.exe"
        30⤵
        Executes dropped EXE
        
        PID:4600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 12 /tr "'C:\odt\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4456

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\odt\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3136

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\odt\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 9 /tr "'C:\odt\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\odt\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 14 /tr "'C:\odt\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\providercommon\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\providercommon\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\providercommon\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\DllCommonsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 12 /tr "'C:\odt\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\odt\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 6 /tr "'C:\odt\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\odt\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3172

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\odt\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 10 /tr "'C:\odt\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 10 /tr "'C:\Windows\Media\Garden\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4452

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Windows\Media\Garden\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 10 /tr "'C:\Windows\Media\Garden\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 5 /tr "'C:\Program Files\Google\Chrome\Application\SetupMetrics\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files\Google\Chrome\Application\SetupMetrics\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 8 /tr "'C:\Program Files\Google\Chrome\Application\SetupMetrics\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\Program Files\Microsoft Office\Office16\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\Office16\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Program Files\Microsoft Office\Office16\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\providercommon\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\providercommon\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\providercommon\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 11 /tr "'C:\Program Files\7-Zip\Lang\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Program Files\7-Zip\Lang\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 6 /tr "'C:\Program Files\7-Zip\Lang\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Google\Update\Offline\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:212

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\Update\Offline\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:312

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Google\Update\Offline\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3312

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 13 /tr "'C:\Users\Default User\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Users\Default User\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2256

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Mail\en-US\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\en-US\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Mail\en-US\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1920

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
1⤵
PID:5804

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
1⤵
PID:5248

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
1⤵
PID:4708

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Web Service

T1102

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\logs\lsass.exe
Size 1.0MB
SHA256 b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
MD5 bd31e94b4143c4ce49c17d3af46bcad0
SHA1 f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA512 f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
SSDEEP 24576:jTnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:HnzV/q+DnsXg
MD5 SHA1 SHA512 SSDEEP

Submit Download

lsass.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\logs\lsass.exe
Size 1.0MB
SHA256 b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
MD5 bd31e94b4143c4ce49c17d3af46bcad0
SHA1 f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA512 f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
SSDEEP 24576:jTnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:HnzV/q+DnsXg
MD5 SHA1 SHA512 SSDEEP

Submit Download

lsass.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\logs\lsass.exe
Size 1.0MB
SHA256 b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
MD5 bd31e94b4143c4ce49c17d3af46bcad0
SHA1 f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA512 f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
SSDEEP 24576:jTnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:HnzV/q+DnsXg
MD5 SHA1 SHA512 SSDEEP

Submit Download

lsass.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\logs\lsass.exe
Size 1.0MB
SHA256 b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
MD5 bd31e94b4143c4ce49c17d3af46bcad0
SHA1 f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA512 f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
SSDEEP 24576:jTnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:HnzV/q+DnsXg
MD5 SHA1 SHA512 SSDEEP

Submit Download

lsass.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\logs\lsass.exe
Size 1.0MB
SHA256 b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
MD5 bd31e94b4143c4ce49c17d3af46bcad0
SHA1 f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA512 f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
SSDEEP 24576:jTnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:HnzV/q+DnsXg
MD5 SHA1 SHA512 SSDEEP

Submit Download

lsass.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\logs\lsass.exe
Size 1.0MB
SHA256 b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
MD5 bd31e94b4143c4ce49c17d3af46bcad0
SHA1 f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA512 f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
SSDEEP 24576:jTnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:HnzV/q+DnsXg
MD5 SHA1 SHA512 SSDEEP

Submit Download

lsass.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\logs\lsass.exe
Size 1.0MB
SHA256 b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
MD5 bd31e94b4143c4ce49c17d3af46bcad0
SHA1 f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA512 f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
SSDEEP 24576:jTnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:HnzV/q+DnsXg
MD5 SHA1 SHA512 SSDEEP

Submit Download

lsass.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\logs\lsass.exe
Size 1.0MB
SHA256 b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
MD5 bd31e94b4143c4ce49c17d3af46bcad0
SHA1 f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA512 f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
SSDEEP 24576:jTnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:HnzV/q+DnsXg
MD5 SHA1 SHA512 SSDEEP

Submit Download

lsass.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\logs\lsass.exe
Size 1.0MB
SHA256 b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
MD5 bd31e94b4143c4ce49c17d3af46bcad0
SHA1 f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA512 f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
SSDEEP 24576:jTnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:HnzV/q+DnsXg
MD5 SHA1 SHA512 SSDEEP

Submit Download

lsass.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\logs\lsass.exe
Size 1.0MB
SHA256 b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
MD5 bd31e94b4143c4ce49c17d3af46bcad0
SHA1 f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA512 f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
SSDEEP 24576:jTnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:HnzV/q+DnsXg
MD5 SHA1 SHA512 SSDEEP

Submit Download

lsass.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\logs\lsass.exe
Size 1.0MB
SHA256 b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
MD5 bd31e94b4143c4ce49c17d3af46bcad0
SHA1 f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA512 f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
SSDEEP 24576:jTnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:HnzV/q+DnsXg
MD5 SHA1 SHA512 SSDEEP

Submit Download

lsass.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\logs\lsass.exe
Size 1.0MB
SHA256 b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
MD5 bd31e94b4143c4ce49c17d3af46bcad0
SHA1 f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA512 f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
SSDEEP 24576:jTnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:HnzV/q+DnsXg
MD5 SHA1 SHA512 SSDEEP

Submit Download

lsass.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\logs\lsass.exe
Size 1.0MB
SHA256 b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
MD5 bd31e94b4143c4ce49c17d3af46bcad0
SHA1 f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA512 f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
SSDEEP 24576:jTnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:HnzV/q+DnsXg
MD5 SHA1 SHA512 SSDEEP

Submit Download

lsass.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\logs\lsass.exe
Size 1.0MB
SHA256 b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
MD5 bd31e94b4143c4ce49c17d3af46bcad0
SHA1 f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA512 f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
SSDEEP 24576:jTnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:HnzV/q+DnsXg
MD5 SHA1 SHA512 SSDEEP

Submit Download

lsass.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\lsass.exe.log
Size 1KB
SHA256 375076241775962f3edc08a8c72832a00920b427a4f3332528d91d21e909fa12
MD5 d63ff49d7c92016feb39812e4db10419
SHA1 2307d5e35ca9864ffefc93acf8573ea995ba189b
SHA512 00f8c8d0336d6575b956876183199624d6f4d2056f2c0aa633a6f17c516f22ee648062d9bc419254d84c459323e9424f0da8aed9dd4e16c2926e5ba30e797d8a
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 c9e6cb04d6c893458d5a7e12eb575cf97c3172f5e312b1f63a667cbbc5f0c033
MD5 ad5cd538ca58cb28ede39c108acb5785
SHA1 1ae910026f3dbe90ed025e9e96ead2b5399be877
SHA512 c066c5d9b276a68fa636647bb29aea05bfa2292217bc77f5324d9c1d93117772ee8277e1f7cff91ec8d6b7c05ca078f929cecfdbb09582522a9067f54740af13
MD5 SHA1 SHA512

Submit Download