dcrat | d3b635dff3c5d177ca4520b510eeda4950bfe5f30ba9a0e0fa43541a986c02ce

Analysis

max time kernel
143s
max time network
141s
platform
windows10-1703_x64
resource
win10-20220901-en
resource tags

arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system
submitted
01/11/2022, 11:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d3b635dff3c5d177ca4520b510eeda4950bfe5f30ba9a0e0fa43541a986c02ce.exe
Size 1.3MB
Sample221101-npc7dabea6
SHA256 d3b635dff3c5d177ca4520b510eeda4950bfe5f30ba9a0e0fa43541a986c02ce
MD5 f14da3690d953227f29fdc436948416b
SHA1 3964d7b8aef66b0f8ee2dbfbe423a9e05eaba5ab
SHA512 4c89cc72248ce9a432ebf8c40002dd81e55146397eadf1c13f8d8af0ff4c5f4613d453e7c8004bef3235bf3c233e2c1dbdf243cd8abb6ebdc47080ab3f95a935
SSDEEP 24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 64 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5076	3348	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4940	3348	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4672	3348	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4392	3348	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1388	3348	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4372	3348	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4684	3348	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4596	3348	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4584	3348	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4524	3348	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4712	3348	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4544	3348	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4536	3348	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4576	3348	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	424	3348	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2668	3348	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4808	3348	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4820	3348	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1020	3348	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3088	3348	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1996	3348	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4320	3348	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3740	3348	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1164	3348	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3476	3348	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2268	3348	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4860	3348	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	576	3348	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4396	3348	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4596	3348	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4580	3348	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4544	3348	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4704	3348	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	424	3348	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3972	3348	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	588	3348	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3044	3348	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	296	3348	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2256	3348	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4828	3348	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4888	3348	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	364	3348	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3976	3348	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4824	3348	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	304	3348	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3572	3348	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1860	3348	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3688	3348	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5104	3348	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2096	3348	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3804	3348	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2224	3348	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4076	3348	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1996	3348	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1528	3348	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4320	3348	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3824	3348	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3816	3348	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3440	3348	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4308	3348	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4908	3348	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4924	3348	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3940	3348	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3996	3348	schtasks.exe	70

DCRat payload 16 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x000900000001abba-284.dat	dcrat
behavioral1/files/0x000900000001abba-285.dat	dcrat
behavioral1/memory/4256-286-0x0000000000A20000-0x0000000000B30000-memory.dmp	dcrat
behavioral1/files/0x000900000001abba-307.dat	dcrat
behavioral1/files/0x000600000001abee-896.dat	dcrat
behavioral1/files/0x000600000001abee-895.dat	dcrat
behavioral1/files/0x000600000001abee-1218.dat	dcrat
behavioral1/files/0x000600000001abee-1224.dat	dcrat
behavioral1/files/0x000600000001abee-1230.dat	dcrat
behavioral1/files/0x000600000001abee-1236.dat	dcrat
behavioral1/files/0x000600000001abee-1242.dat	dcrat
behavioral1/files/0x000600000001abee-1248.dat	dcrat
behavioral1/files/0x000600000001abee-1253.dat	dcrat
behavioral1/files/0x000600000001abee-1258.dat	dcrat
behavioral1/files/0x000600000001abee-1264.dat	dcrat
behavioral1/files/0x000600000001abee-1270.dat	dcrat

Executes dropped EXE 13 IoCs

pid	Process
4256	DllCommonsvc.exe
2664	DllCommonsvc.exe
5544	winlogon.exe
6000	winlogon.exe
6072	winlogon.exe
5376	winlogon.exe
2044	winlogon.exe
5052	winlogon.exe
5240	winlogon.exe
1784	winlogon.exe
3692	winlogon.exe
4704	winlogon.exe
4596	winlogon.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in Program Files directory 25 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Defender\dab4d89cac03ec	DllCommonsvc.exe
File created	C:\Program Files\Windows Security\BrowserCore\en-US\SearchUI.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Security\BrowserCore\en-US\dab4d89cac03ec	DllCommonsvc.exe
File created	C:\Program Files (x86)\Google\CrashReports\WmiPrvSE.exe	DllCommonsvc.exe
File opened for modification	C:\Program Files (x86)\Google\CrashReports\WmiPrvSE.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Portable Devices\RuntimeBroker.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Portable Devices\9e8d7a4ca61bd9	DllCommonsvc.exe
File created	C:\Program Files\Java\088424020bedd6	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Portable Devices\spoolsv.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Defender\SearchUI.exe	DllCommonsvc.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\27d1bcfc3c54e0	DllCommonsvc.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\dllhost.exe	DllCommonsvc.exe
File created	C:\Program Files\7-Zip\Lang\System.exe	DllCommonsvc.exe
File created	C:\Program Files\7-Zip\Lang\c5b4cb5e9653cc	DllCommonsvc.exe
File created	C:\Program Files\Java\DllCommonsvc.exe	DllCommonsvc.exe
File created	C:\Program Files\Java\conhost.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Portable Devices\f3b6ecef712a24	DllCommonsvc.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\5940a34987c991	DllCommonsvc.exe
File created	C:\Program Files\7-Zip\Lang\27d1bcfc3c54e0	DllCommonsvc.exe
File created	C:\Program Files\7-Zip\Lang\services.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Security\7a0fd90576e088	DllCommonsvc.exe
File created	C:\Program Files\Java\a76d7bf15d8370	DllCommonsvc.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\System.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Google\CrashReports\24dbde2999530e	DllCommonsvc.exe
File created	C:\Program Files\Windows Security\explorer.exe	DllCommonsvc.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\HoloShell\f8c8f1285d826b	DllCommonsvc.exe
File created	C:\Windows\Logs\NetSetup\explorer.exe	DllCommonsvc.exe
File created	C:\Windows\Logs\NetSetup\7a0fd90576e088	DllCommonsvc.exe
File created	C:\Windows\de-DE\csrss.exe	DllCommonsvc.exe
File created	C:\Windows\de-DE\886983d96e3d3e	DllCommonsvc.exe
File created	C:\Windows\PLA\Templates\spoolsv.exe	DllCommonsvc.exe
File created	C:\Windows\PLA\Templates\f3b6ecef712a24	DllCommonsvc.exe
File created	C:\Windows\HoloShell\ShellExperienceHost.exe	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 64 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
304	schtasks.exe
364	schtasks.exe
1388	schtasks.exe
3740	schtasks.exe
4828	schtasks.exe
1996	schtasks.exe
3996	schtasks.exe
4596	schtasks.exe
4580	schtasks.exe
4824	schtasks.exe
5000	schtasks.exe
4672	schtasks.exe
1020	schtasks.exe
424	schtasks.exe
3804	schtasks.exe
1244	schtasks.exe
3908	schtasks.exe
2156	schtasks.exe
4524	schtasks.exe
1996	schtasks.exe
2268	schtasks.exe
3972	schtasks.exe
3044	schtasks.exe
4308	schtasks.exe
4940	schtasks.exe
4372	schtasks.exe
4684	schtasks.exe
4536	schtasks.exe
3688	schtasks.exe
4860	schtasks.exe
1860	schtasks.exe
2224	schtasks.exe
4320	schtasks.exe
3912	schtasks.exe
4712	schtasks.exe
4544	schtasks.exe
4576	schtasks.exe
2096	schtasks.exe
4076	schtasks.exe
4396	schtasks.exe
4544	schtasks.exe
4888	schtasks.exe
5104	schtasks.exe
3824	schtasks.exe
4392	schtasks.exe
4320	schtasks.exe
296	schtasks.exe
3976	schtasks.exe
3572	schtasks.exe
3552	schtasks.exe
5076	schtasks.exe
424	schtasks.exe
3088	schtasks.exe
3476	schtasks.exe
4704	schtasks.exe
4596	schtasks.exe
4584	schtasks.exe
4820	schtasks.exe
3440	schtasks.exe
4092	schtasks.exe
2668	schtasks.exe
1164	schtasks.exe
588	schtasks.exe
3816	schtasks.exe

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings	d3b635dff3c5d177ca4520b510eeda4950bfe5f30ba9a0e0fa43541a986c02ce.exe
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings	winlogon.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4256	DllCommonsvc.exe
4256	DllCommonsvc.exe
4256	DllCommonsvc.exe
488	powershell.exe
3184	powershell.exe
804	powershell.exe
4420	powershell.exe
612	powershell.exe
3184	powershell.exe
4400	powershell.exe
4420	powershell.exe
2664	DllCommonsvc.exe
612	powershell.exe
488	powershell.exe
804	powershell.exe
4420	powershell.exe
3184	powershell.exe
4400	powershell.exe
612	powershell.exe
488	powershell.exe
804	powershell.exe
4400	powershell.exe
2664	DllCommonsvc.exe
2664	DllCommonsvc.exe
2664	DllCommonsvc.exe
2664	DllCommonsvc.exe
2664	DllCommonsvc.exe
2664	DllCommonsvc.exe
2664	DllCommonsvc.exe
2664	DllCommonsvc.exe
2664	DllCommonsvc.exe
2664	DllCommonsvc.exe
2664	DllCommonsvc.exe
4932	powershell.exe
4932	powershell.exe
4660	powershell.exe
4660	powershell.exe
4276	powershell.exe
4276	powershell.exe
4944	powershell.exe
4944	powershell.exe
5068	powershell.exe
5068	powershell.exe
3164	powershell.exe
3164	powershell.exe
4368	powershell.exe
4368	powershell.exe
4524	powershell.exe
4524	powershell.exe
4372	powershell.exe
4372	powershell.exe
336	powershell.exe
336	powershell.exe
424	powershell.exe
424	powershell.exe
3044	powershell.exe
3044	powershell.exe
2272	powershell.exe
2272	powershell.exe
4888	powershell.exe
4888	powershell.exe
4276	powershell.exe
4416	powershell.exe
4416	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4256	DllCommonsvc.exe
Token: SeDebugPrivilege	612	powershell.exe
Token: SeDebugPrivilege	488	powershell.exe
Token: SeDebugPrivilege	3184	powershell.exe
Token: SeDebugPrivilege	804	powershell.exe
Token: SeDebugPrivilege	2664	DllCommonsvc.exe
Token: SeDebugPrivilege	4420	powershell.exe
Token: SeDebugPrivilege	4400	powershell.exe
Token: SeIncreaseQuotaPrivilege	3184	powershell.exe
Token: SeSecurityPrivilege	3184	powershell.exe
Token: SeTakeOwnershipPrivilege	3184	powershell.exe
Token: SeLoadDriverPrivilege	3184	powershell.exe
Token: SeSystemProfilePrivilege	3184	powershell.exe
Token: SeSystemtimePrivilege	3184	powershell.exe
Token: SeProfSingleProcessPrivilege	3184	powershell.exe
Token: SeIncBasePriorityPrivilege	3184	powershell.exe
Token: SeCreatePagefilePrivilege	3184	powershell.exe
Token: SeBackupPrivilege	3184	powershell.exe
Token: SeRestorePrivilege	3184	powershell.exe
Token: SeShutdownPrivilege	3184	powershell.exe
Token: SeDebugPrivilege	3184	powershell.exe
Token: SeSystemEnvironmentPrivilege	3184	powershell.exe
Token: SeRemoteShutdownPrivilege	3184	powershell.exe
Token: SeUndockPrivilege	3184	powershell.exe
Token: SeManageVolumePrivilege	3184	powershell.exe
Token: 33	3184	powershell.exe
Token: 34	3184	powershell.exe
Token: 35	3184	powershell.exe
Token: 36	3184	powershell.exe
Token: SeIncreaseQuotaPrivilege	4420	powershell.exe
Token: SeSecurityPrivilege	4420	powershell.exe
Token: SeTakeOwnershipPrivilege	4420	powershell.exe
Token: SeLoadDriverPrivilege	4420	powershell.exe
Token: SeSystemProfilePrivilege	4420	powershell.exe
Token: SeSystemtimePrivilege	4420	powershell.exe
Token: SeProfSingleProcessPrivilege	4420	powershell.exe
Token: SeIncBasePriorityPrivilege	4420	powershell.exe
Token: SeCreatePagefilePrivilege	4420	powershell.exe
Token: SeBackupPrivilege	4420	powershell.exe
Token: SeRestorePrivilege	4420	powershell.exe
Token: SeShutdownPrivilege	4420	powershell.exe
Token: SeDebugPrivilege	4420	powershell.exe
Token: SeSystemEnvironmentPrivilege	4420	powershell.exe
Token: SeRemoteShutdownPrivilege	4420	powershell.exe
Token: SeUndockPrivilege	4420	powershell.exe
Token: SeManageVolumePrivilege	4420	powershell.exe
Token: 33	4420	powershell.exe
Token: 34	4420	powershell.exe
Token: 35	4420	powershell.exe
Token: 36	4420	powershell.exe
Token: SeIncreaseQuotaPrivilege	612	powershell.exe
Token: SeSecurityPrivilege	612	powershell.exe
Token: SeTakeOwnershipPrivilege	612	powershell.exe
Token: SeLoadDriverPrivilege	612	powershell.exe
Token: SeSystemProfilePrivilege	612	powershell.exe
Token: SeSystemtimePrivilege	612	powershell.exe
Token: SeProfSingleProcessPrivilege	612	powershell.exe
Token: SeIncBasePriorityPrivilege	612	powershell.exe
Token: SeCreatePagefilePrivilege	612	powershell.exe
Token: SeBackupPrivilege	612	powershell.exe
Token: SeRestorePrivilege	612	powershell.exe
Token: SeShutdownPrivilege	612	powershell.exe
Token: SeDebugPrivilege	612	powershell.exe
Token: SeSystemEnvironmentPrivilege	612	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 564 wrote to memory of 1192	564	d3b635dff3c5d177ca4520b510eeda4950bfe5f30ba9a0e0fa43541a986c02ce.exe	66
PID 564 wrote to memory of 1192	564	d3b635dff3c5d177ca4520b510eeda4950bfe5f30ba9a0e0fa43541a986c02ce.exe	66
PID 564 wrote to memory of 1192	564	d3b635dff3c5d177ca4520b510eeda4950bfe5f30ba9a0e0fa43541a986c02ce.exe	66
PID 1192 wrote to memory of 3956	1192	WScript.exe	67
PID 1192 wrote to memory of 3956	1192	WScript.exe	67
PID 1192 wrote to memory of 3956	1192	WScript.exe	67
PID 3956 wrote to memory of 4256	3956	cmd.exe	69
PID 3956 wrote to memory of 4256	3956	cmd.exe	69
PID 4256 wrote to memory of 488	4256	DllCommonsvc.exe	86
PID 4256 wrote to memory of 488	4256	DllCommonsvc.exe	86
PID 4256 wrote to memory of 612	4256	DllCommonsvc.exe	97
PID 4256 wrote to memory of 612	4256	DllCommonsvc.exe	97
PID 4256 wrote to memory of 3184	4256	DllCommonsvc.exe	87
PID 4256 wrote to memory of 3184	4256	DllCommonsvc.exe	87
PID 4256 wrote to memory of 4420	4256	DllCommonsvc.exe	95
PID 4256 wrote to memory of 4420	4256	DllCommonsvc.exe	95
PID 4256 wrote to memory of 804	4256	DllCommonsvc.exe	89
PID 4256 wrote to memory of 804	4256	DllCommonsvc.exe	89
PID 4256 wrote to memory of 4400	4256	DllCommonsvc.exe	90
PID 4256 wrote to memory of 4400	4256	DllCommonsvc.exe	90
PID 4256 wrote to memory of 2664	4256	DllCommonsvc.exe	98
PID 4256 wrote to memory of 2664	4256	DllCommonsvc.exe	98
PID 2664 wrote to memory of 4932	2664	DllCommonsvc.exe	157
PID 2664 wrote to memory of 4932	2664	DllCommonsvc.exe	157
PID 2664 wrote to memory of 4276	2664	DllCommonsvc.exe	158
PID 2664 wrote to memory of 4276	2664	DllCommonsvc.exe	158
PID 2664 wrote to memory of 4660	2664	DllCommonsvc.exe	159
PID 2664 wrote to memory of 4660	2664	DllCommonsvc.exe	159
PID 2664 wrote to memory of 4944	2664	DllCommonsvc.exe	160
PID 2664 wrote to memory of 4944	2664	DllCommonsvc.exe	160
PID 2664 wrote to memory of 5068	2664	DllCommonsvc.exe	168
PID 2664 wrote to memory of 5068	2664	DllCommonsvc.exe	168
PID 2664 wrote to memory of 3164	2664	DllCommonsvc.exe	166
PID 2664 wrote to memory of 3164	2664	DllCommonsvc.exe	166
PID 2664 wrote to memory of 4368	2664	DllCommonsvc.exe	162
PID 2664 wrote to memory of 4368	2664	DllCommonsvc.exe	162
PID 2664 wrote to memory of 4524	2664	DllCommonsvc.exe	163
PID 2664 wrote to memory of 4524	2664	DllCommonsvc.exe	163
PID 2664 wrote to memory of 4372	2664	DllCommonsvc.exe	171
PID 2664 wrote to memory of 4372	2664	DllCommonsvc.exe	171
PID 2664 wrote to memory of 336	2664	DllCommonsvc.exe	180
PID 2664 wrote to memory of 336	2664	DllCommonsvc.exe	180
PID 2664 wrote to memory of 424	2664	DllCommonsvc.exe	174
PID 2664 wrote to memory of 424	2664	DllCommonsvc.exe	174
PID 2664 wrote to memory of 3044	2664	DllCommonsvc.exe	175
PID 2664 wrote to memory of 3044	2664	DllCommonsvc.exe	175
PID 2664 wrote to memory of 2272	2664	DllCommonsvc.exe	177
PID 2664 wrote to memory of 2272	2664	DllCommonsvc.exe	177
PID 2664 wrote to memory of 4888	2664	DllCommonsvc.exe	181
PID 2664 wrote to memory of 4888	2664	DllCommonsvc.exe	181
PID 2664 wrote to memory of 4416	2664	DllCommonsvc.exe	182
PID 2664 wrote to memory of 4416	2664	DllCommonsvc.exe	182
PID 2664 wrote to memory of 4812	2664	DllCommonsvc.exe	183
PID 2664 wrote to memory of 4812	2664	DllCommonsvc.exe	183
PID 2664 wrote to memory of 4600	2664	DllCommonsvc.exe	186
PID 2664 wrote to memory of 4600	2664	DllCommonsvc.exe	186
PID 2664 wrote to memory of 4320	2664	DllCommonsvc.exe	187
PID 2664 wrote to memory of 4320	2664	DllCommonsvc.exe	187
PID 2664 wrote to memory of 3620	2664	DllCommonsvc.exe	188
PID 2664 wrote to memory of 3620	2664	DllCommonsvc.exe	188
PID 2664 wrote to memory of 1000	2664	DllCommonsvc.exe	189
PID 2664 wrote to memory of 1000	2664	DllCommonsvc.exe	189
PID 2664 wrote to memory of 4452	2664	DllCommonsvc.exe	197
PID 2664 wrote to memory of 4452	2664	DllCommonsvc.exe	197

C:\Users\Admin\AppData\Local\Temp\d3b635dff3c5d177ca4520b510eeda4950bfe5f30ba9a0e0fa43541a986c02ce.exe
"C:\Users\Admin\AppData\Local\Temp\d3b635dff3c5d177ca4520b510eeda4950bfe5f30ba9a0e0fa43541a986c02ce.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:564
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1192
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3956
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4256
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:488
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Java\DllCommonsvc.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3184
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Microsoft Office 15\ClientX64\System.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:804
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Security\BrowserCore\en-US\SearchUI.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4400
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Defender\SearchUI.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4420
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\sihost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:612
    - - C:\providercommon\DllCommonsvc.exe
        
        "C:\providercommon\DllCommonsvc.exe"
        5⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Drops file in Windows directory
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2664
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4932
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Google\CrashReports\WmiPrvSE.exe'
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4276
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Logs\NetSetup\explorer.exe'
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4660
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\fontdrvhost.exe'
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4944
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\winlogon.exe'
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4368
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Java\conhost.exe'
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4524
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Portable Devices\RuntimeBroker.exe'
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3164
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\winlogon.exe'
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5068
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Portable Devices\spoolsv.exe'
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4372
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\de-DE\csrss.exe'
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:424
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\taskhostw.exe'
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3044
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\7-Zip\Lang\System.exe'
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2272
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\dllhost.exe'
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:336
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\7-Zip\Lang\services.exe'
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4888
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Templates\conhost.exe'
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4416
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\PLA\Templates\spoolsv.exe'
        6⤵
        
        PID:4812
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Documents\My Videos\csrss.exe'
        6⤵
        
        PID:4600
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Start Menu\spoolsv.exe'
        6⤵
        
        PID:4320
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Security\explorer.exe'
        6⤵
        
        PID:3620
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\HoloShell\ShellExperienceHost.exe'
        6⤵
        
        PID:1000
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\i4tfx5pw0W.bat"
        6⤵
        
        PID:4452
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:5360
        
        C:\odt\winlogon.exe
        
        "C:\odt\winlogon.exe"
        7⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5544
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\OvjOVLkpjd.bat"
        8⤵
        
        PID:5572
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:5296
        
        C:\odt\winlogon.exe
        
        "C:\odt\winlogon.exe"
        9⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:6000
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\FEON83D8AI.bat"
        10⤵
        
        PID:5764
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:3588
        
        C:\odt\winlogon.exe
        
        "C:\odt\winlogon.exe"
        11⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:6072
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\5Ad8adCyX4.bat"
        12⤵
        
        PID:5632
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:6012
        
        C:\odt\winlogon.exe
        
        "C:\odt\winlogon.exe"
        13⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5376
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\dhQfvaPZ4N.bat"
        14⤵
        
        PID:2452
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        15⤵
        
        PID:4880
        
        C:\odt\winlogon.exe
        
        "C:\odt\winlogon.exe"
        15⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2044
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\3Fb5uY85DH.bat"
        16⤵
        
        PID:4552
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        17⤵
        
        PID:4280
        
        C:\odt\winlogon.exe
        
        "C:\odt\winlogon.exe"
        17⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5052
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\kUVpzpaF2i.bat"
        18⤵
        
        PID:5284
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        19⤵
        
        PID:1792
        
        C:\odt\winlogon.exe
        
        "C:\odt\winlogon.exe"
        19⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5240
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\4Q74CISUeM.bat"
        20⤵
        
        PID:1388
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        21⤵
        
        PID:288
        
        C:\odt\winlogon.exe
        
        "C:\odt\winlogon.exe"
        21⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1784
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\0Sh6ipYOoX.bat"
        22⤵
        
        PID:4716
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        23⤵
        
        PID:5300
        
        C:\odt\winlogon.exe
        
        "C:\odt\winlogon.exe"
        23⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3692
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\JCnMdX7E06.bat"
        24⤵
        
        PID:5568
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        25⤵
        
        PID:5384
        
        C:\odt\winlogon.exe
        
        "C:\odt\winlogon.exe"
        25⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4704
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\yNYzWO1Iaj.bat"
        26⤵
        
        PID:5792
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        27⤵
        
        PID:5224
        
        C:\odt\winlogon.exe
        
        "C:\odt\winlogon.exe"
        27⤵
        Executes dropped EXE
        
        PID:4596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 13 /tr "'C:\odt\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\odt\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 14 /tr "'C:\odt\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 7 /tr "'C:\Program Files\Java\DllCommonsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\Program Files\Java\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 6 /tr "'C:\Program Files\Java\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchUIS" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Defender\SearchUI.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchUI" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\SearchUI.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchUIS" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Defender\SearchUI.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office 15\ClientX64\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 9 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchUIS" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\SearchUI.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchUI" /sc ONLOGON /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\SearchUI.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchUIS" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\SearchUI.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:424

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Google\CrashReports\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\CrashReports\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:4808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Google\CrashReports\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\Windows\Logs\NetSetup\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\Logs\NetSetup\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\Windows\Logs\NetSetup\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3740

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1164

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'C:\providercommon\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\providercommon\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\providercommon\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Portable Devices\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
PID:576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Portable Devices\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\odt\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\odt\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 10 /tr "'C:\odt\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 12 /tr "'C:\Program Files\Java\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:424

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files\Java\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 10 /tr "'C:\Program Files\Java\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Portable Devices\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:296

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Portable Devices\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:2256

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:364

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Windows\de-DE\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\de-DE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Windows\de-DE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 7 /tr "'C:\odt\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\odt\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 6 /tr "'C:\odt\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 12 /tr "'C:\Program Files\7-Zip\Lang\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files\7-Zip\Lang\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2096

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 9 /tr "'C:\Program Files\7-Zip\Lang\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 8 /tr "'C:\Program Files\7-Zip\Lang\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files\7-Zip\Lang\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 6 /tr "'C:\Program Files\7-Zip\Lang\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 9 /tr "'C:\Users\Default\Templates\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
PID:1528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Users\Default\Templates\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 14 /tr "'C:\Users\Default\Templates\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 10 /tr "'C:\Windows\PLA\Templates\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\PLA\Templates\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3440

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 9 /tr "'C:\Windows\PLA\Templates\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Users\Public\Documents\My Videos\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
PID:4908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Public\Documents\My Videos\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:4924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Users\Public\Documents\My Videos\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:3940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\Start Menu\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Users\All Users\Start Menu\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:3552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\Start Menu\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:5000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Security\explorer.exe'" /f
1⤵
- Creates scheduled task(s)
PID:1244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files\Windows Security\explorer.exe'" /rl HIGHEST /f
1⤵
PID:4048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Security\explorer.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:3908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ShellExperienceHostS" /sc MINUTE /mo 7 /tr "'C:\Windows\HoloShell\ShellExperienceHost.exe'" /f
1⤵
- Creates scheduled task(s)
PID:4092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ShellExperienceHost" /sc ONLOGON /tr "'C:\Windows\HoloShell\ShellExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:3912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ShellExperienceHostS" /sc MINUTE /mo 9 /tr "'C:\Windows\HoloShell\ShellExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:2156

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Web Service

T1102

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DllCommonsvc.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\DllCommonsvc.exe.log
Size 1KB
SHA256 61d17affcc8d91ecb1858e710c455186f9d0ccfc4d8ae17a1145d87bc7317879
MD5 b4268d8ae66fdd920476b97a1776bf85
SHA1 f920de54f7467f0970eccc053d3c6c8dd181d49a
SHA512 03b6b90641837f9efb6065698602220d6c5ad263d51d7b7714747c2a3c3c618bd3d94add206b034d6fa2b8e43cbd1ac4a1741cfa1c2b1c1fc8589ae0b0c89516
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 c9e6cb04d6c893458d5a7e12eb575cf97c3172f5e312b1f63a667cbbc5f0c033
MD5 ad5cd538ca58cb28ede39c108acb5785
SHA1 1ae910026f3dbe90ed025e9e96ead2b5399be877
SHA512 c066c5d9b276a68fa636647bb29aea05bfa2292217bc77f5324d9c1d93117772ee8277e1f7cff91ec8d6b7c05ca078f929cecfdbb09582522a9067f54740af13
MD5 SHA1 SHA512

Submit Download

winlogon.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\winlogon.exe.log
Size 1KB
SHA256 375076241775962f3edc08a8c72832a00920b427a4f3332528d91d21e909fa12
MD5 d63ff49d7c92016feb39812e4db10419
SHA1 2307d5e35ca9864ffefc93acf8573ea995ba189b
SHA512 00f8c8d0336d6575b956876183199624d6f4d2056f2c0aa633a6f17c516f22ee648062d9bc419254d84c459323e9424f0da8aed9dd4e16c2926e5ba30e797d8a
MD5 SHA1 SHA512

Submit Download