dcrat | 6993b53f85ba0f40bb7eb332e3eef3877751acd544a9b96f5792d23cde8fe44d

Analysis

max time kernel
146s
max time network
148s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
01/11/2022, 11:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6993b53f85ba0f40bb7eb332e3eef3877751acd544a9b96f5792d23cde8fe44d.exe
Size 1.3MB
Sample221101-ntfhasbee5
SHA256 6993b53f85ba0f40bb7eb332e3eef3877751acd544a9b96f5792d23cde8fe44d
MD5 3f08062dec8c3da63ec82160172de788
SHA1 03a8656f37fa99ef74f693a38c53b0bfcf195b54
SHA512 f1cac8a0b725e1ebff89c5224e6db8c315d78f8b335a2594d7f017d29b424fe8088cad8ce54021c4de1df1f3e5b2346c39ec9551e1bfa07ee7afb75a51062226
SSDEEP 24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 45 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4596	4880	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4924	4880	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4900	4880	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	508	4880	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4476	4880	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4464	4880	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1000	4880	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4500	4880	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3184	4880	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3200	4880	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3076	4880	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	656	4880	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4772	4880	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4760	4880	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4704	4880	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4744	4880	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4752	4880	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4660	4880	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1360	4880	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	60	4880	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	916	4880	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	820	4880	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1848	4880	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1744	4880	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1620	4880	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2160	4880	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2292	4880	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1584	4880	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1332	4880	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2392	4880	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3796	4880	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1192	4880	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	792	4880	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3400	4880	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3396	4880	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3412	4880	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	188	4880	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	204	4880	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	212	4880	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	304	4880	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2208	4880	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2756	4880	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2188	4880	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2480	4880	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1212	4880	schtasks.exe	70

DCRat payload 15 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x000400000001ac49-283.dat	dcrat
behavioral1/files/0x000400000001ac49-284.dat	dcrat
behavioral1/memory/1316-285-0x0000000000540000-0x0000000000650000-memory.dmp	dcrat
behavioral1/files/0x000600000001ac5c-371.dat	dcrat
behavioral1/files/0x000600000001ac5c-372.dat	dcrat
behavioral1/files/0x000600000001ac5c-860.dat	dcrat
behavioral1/files/0x000600000001ac5c-867.dat	dcrat
behavioral1/files/0x000600000001ac5c-873.dat	dcrat
behavioral1/files/0x000600000001ac5c-879.dat	dcrat
behavioral1/files/0x000600000001ac5c-884.dat	dcrat
behavioral1/files/0x000600000001ac5c-889.dat	dcrat
behavioral1/files/0x000600000001ac5c-895.dat	dcrat
behavioral1/files/0x000600000001ac5c-901.dat	dcrat
behavioral1/files/0x000600000001ac5c-906.dat	dcrat
behavioral1/files/0x000600000001ac5c-912.dat	dcrat

Executes dropped EXE 12 IoCs

pid	Process
1316	DllCommonsvc.exe
3060	dllhost.exe
5704	dllhost.exe
5888	dllhost.exe
6072	dllhost.exe
5276	dllhost.exe
5536	dllhost.exe
4456	dllhost.exe
5600	dllhost.exe
4676	dllhost.exe
1836	dllhost.exe
3076	dllhost.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in Program Files directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\spoolsv.exe	DllCommonsvc.exe
File created	C:\Program Files\Microsoft Office\f3b6ecef712a24	DllCommonsvc.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\7a0fd90576e088	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Defender\ja-JP\csrss.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\OfficeClickToRun.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\e6c9b481da804f	DllCommonsvc.exe
File created	C:\Program Files\Microsoft Office\spoolsv.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\explorer.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Defender\ja-JP\886983d96e3d3e	DllCommonsvc.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\RuntimeBroker.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\9e8d7a4ca61bd9	DllCommonsvc.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\L2Schemas\taskhostw.exe	DllCommonsvc.exe
File created	C:\Windows\L2Schemas\ea9f0e6c9e2dcd	DllCommonsvc.exe
File created	C:\Windows\ELAMBKUP\cmd.exe	DllCommonsvc.exe
File created	C:\Windows\ELAMBKUP\ebf1f9fa8afd6d	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 45 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3400	schtasks.exe
3396	schtasks.exe
2188	schtasks.exe
4924	schtasks.exe
4476	schtasks.exe
1360	schtasks.exe
916	schtasks.exe
2160	schtasks.exe
2292	schtasks.exe
1192	schtasks.exe
2756	schtasks.exe
3200	schtasks.exe
3076	schtasks.exe
4744	schtasks.exe
1744	schtasks.exe
1620	schtasks.exe
204	schtasks.exe
4596	schtasks.exe
4900	schtasks.exe
508	schtasks.exe
1000	schtasks.exe
60	schtasks.exe
792	schtasks.exe
1212	schtasks.exe
3184	schtasks.exe
656	schtasks.exe
4660	schtasks.exe
2392	schtasks.exe
3796	schtasks.exe
820	schtasks.exe
188	schtasks.exe
1332	schtasks.exe
4464	schtasks.exe
4500	schtasks.exe
4704	schtasks.exe
1848	schtasks.exe
1584	schtasks.exe
4760	schtasks.exe
3412	schtasks.exe
2208	schtasks.exe
2480	schtasks.exe
4772	schtasks.exe
4752	schtasks.exe
212	schtasks.exe
304	schtasks.exe

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	6993b53f85ba0f40bb7eb332e3eef3877751acd544a9b96f5792d23cde8fe44d.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	dllhost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1316	DllCommonsvc.exe
1316	DllCommonsvc.exe
1316	DllCommonsvc.exe
1316	DllCommonsvc.exe
1316	DllCommonsvc.exe
1316	DllCommonsvc.exe
1316	DllCommonsvc.exe
1316	DllCommonsvc.exe
1316	DllCommonsvc.exe
1316	DllCommonsvc.exe
2500	powershell.exe
2500	powershell.exe
2868	powershell.exe
2868	powershell.exe
2500	powershell.exe
4980	powershell.exe
4980	powershell.exe
2868	powershell.exe
1944	powershell.exe
1944	powershell.exe
4980	powershell.exe
1944	powershell.exe
2056	powershell.exe
2056	powershell.exe
2820	powershell.exe
2820	powershell.exe
2500	powershell.exe
3904	powershell.exe
3904	powershell.exe
2868	powershell.exe
2056	powershell.exe
5024	powershell.exe
5024	powershell.exe
4688	powershell.exe
4688	powershell.exe
5040	powershell.exe
5040	powershell.exe
4568	powershell.exe
4568	powershell.exe
4980	powershell.exe
4644	powershell.exe
4644	powershell.exe
3424	powershell.exe
3424	powershell.exe
5024	powershell.exe
1944	powershell.exe
3996	powershell.exe
3996	powershell.exe
3972	powershell.exe
3972	powershell.exe
3424	powershell.exe
4688	powershell.exe
2056	powershell.exe
3996	powershell.exe
2820	powershell.exe
5024	powershell.exe
3904	powershell.exe
3704	powershell.exe
3704	powershell.exe
3996	powershell.exe
4688	powershell.exe
3424	powershell.exe
5040	powershell.exe
4568	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1316	DllCommonsvc.exe
Token: SeDebugPrivilege	2500	powershell.exe
Token: SeDebugPrivilege	2868	powershell.exe
Token: SeDebugPrivilege	4980	powershell.exe
Token: SeDebugPrivilege	1944	powershell.exe
Token: SeDebugPrivilege	2056	powershell.exe
Token: SeDebugPrivilege	2820	powershell.exe
Token: SeDebugPrivilege	3904	powershell.exe
Token: SeDebugPrivilege	5024	powershell.exe
Token: SeDebugPrivilege	4688	powershell.exe
Token: SeDebugPrivilege	5040	powershell.exe
Token: SeDebugPrivilege	4568	powershell.exe
Token: SeDebugPrivilege	4644	powershell.exe
Token: SeDebugPrivilege	3424	powershell.exe
Token: SeDebugPrivilege	3996	powershell.exe
Token: SeDebugPrivilege	3972	powershell.exe
Token: SeDebugPrivilege	3704	powershell.exe
Token: SeDebugPrivilege	3060	dllhost.exe
Token: SeIncreaseQuotaPrivilege	1944	powershell.exe
Token: SeSecurityPrivilege	1944	powershell.exe
Token: SeTakeOwnershipPrivilege	1944	powershell.exe
Token: SeLoadDriverPrivilege	1944	powershell.exe
Token: SeSystemProfilePrivilege	1944	powershell.exe
Token: SeSystemtimePrivilege	1944	powershell.exe
Token: SeProfSingleProcessPrivilege	1944	powershell.exe
Token: SeIncBasePriorityPrivilege	1944	powershell.exe
Token: SeCreatePagefilePrivilege	1944	powershell.exe
Token: SeBackupPrivilege	1944	powershell.exe
Token: SeRestorePrivilege	1944	powershell.exe
Token: SeShutdownPrivilege	1944	powershell.exe
Token: SeDebugPrivilege	1944	powershell.exe
Token: SeSystemEnvironmentPrivilege	1944	powershell.exe
Token: SeRemoteShutdownPrivilege	1944	powershell.exe
Token: SeUndockPrivilege	1944	powershell.exe
Token: SeManageVolumePrivilege	1944	powershell.exe
Token: 33	1944	powershell.exe
Token: 34	1944	powershell.exe
Token: 35	1944	powershell.exe
Token: 36	1944	powershell.exe
Token: SeIncreaseQuotaPrivilege	2868	powershell.exe
Token: SeSecurityPrivilege	2868	powershell.exe
Token: SeTakeOwnershipPrivilege	2868	powershell.exe
Token: SeLoadDriverPrivilege	2868	powershell.exe
Token: SeSystemProfilePrivilege	2868	powershell.exe
Token: SeSystemtimePrivilege	2868	powershell.exe
Token: SeProfSingleProcessPrivilege	2868	powershell.exe
Token: SeIncBasePriorityPrivilege	2868	powershell.exe
Token: SeCreatePagefilePrivilege	2868	powershell.exe
Token: SeBackupPrivilege	2868	powershell.exe
Token: SeRestorePrivilege	2868	powershell.exe
Token: SeShutdownPrivilege	2868	powershell.exe
Token: SeDebugPrivilege	2868	powershell.exe
Token: SeSystemEnvironmentPrivilege	2868	powershell.exe
Token: SeRemoteShutdownPrivilege	2868	powershell.exe
Token: SeUndockPrivilege	2868	powershell.exe
Token: SeManageVolumePrivilege	2868	powershell.exe
Token: 33	2868	powershell.exe
Token: 34	2868	powershell.exe
Token: 35	2868	powershell.exe
Token: 36	2868	powershell.exe
Token: SeIncreaseQuotaPrivilege	4980	powershell.exe
Token: SeSecurityPrivilege	4980	powershell.exe
Token: SeTakeOwnershipPrivilege	4980	powershell.exe
Token: SeLoadDriverPrivilege	4980	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4248 wrote to memory of 3576	4248	6993b53f85ba0f40bb7eb332e3eef3877751acd544a9b96f5792d23cde8fe44d.exe	66
PID 4248 wrote to memory of 3576	4248	6993b53f85ba0f40bb7eb332e3eef3877751acd544a9b96f5792d23cde8fe44d.exe	66
PID 4248 wrote to memory of 3576	4248	6993b53f85ba0f40bb7eb332e3eef3877751acd544a9b96f5792d23cde8fe44d.exe	66
PID 3576 wrote to memory of 4496	3576	WScript.exe	67
PID 3576 wrote to memory of 4496	3576	WScript.exe	67
PID 3576 wrote to memory of 4496	3576	WScript.exe	67
PID 4496 wrote to memory of 1316	4496	cmd.exe	69
PID 4496 wrote to memory of 1316	4496	cmd.exe	69
PID 1316 wrote to memory of 2500	1316	DllCommonsvc.exe	116
PID 1316 wrote to memory of 2500	1316	DllCommonsvc.exe	116
PID 1316 wrote to memory of 2868	1316	DllCommonsvc.exe	124
PID 1316 wrote to memory of 2868	1316	DllCommonsvc.exe	124
PID 1316 wrote to memory of 4980	1316	DllCommonsvc.exe	118
PID 1316 wrote to memory of 4980	1316	DllCommonsvc.exe	118
PID 1316 wrote to memory of 1944	1316	DllCommonsvc.exe	122
PID 1316 wrote to memory of 1944	1316	DllCommonsvc.exe	122
PID 1316 wrote to memory of 2056	1316	DllCommonsvc.exe	120
PID 1316 wrote to memory of 2056	1316	DllCommonsvc.exe	120
PID 1316 wrote to memory of 2820	1316	DllCommonsvc.exe	128
PID 1316 wrote to memory of 2820	1316	DllCommonsvc.exe	128
PID 1316 wrote to memory of 3904	1316	DllCommonsvc.exe	127
PID 1316 wrote to memory of 3904	1316	DllCommonsvc.exe	127
PID 1316 wrote to memory of 4688	1316	DllCommonsvc.exe	130
PID 1316 wrote to memory of 4688	1316	DllCommonsvc.exe	130
PID 1316 wrote to memory of 5024	1316	DllCommonsvc.exe	147
PID 1316 wrote to memory of 5024	1316	DllCommonsvc.exe	147
PID 1316 wrote to memory of 5040	1316	DllCommonsvc.exe	146
PID 1316 wrote to memory of 5040	1316	DllCommonsvc.exe	146
PID 1316 wrote to memory of 4568	1316	DllCommonsvc.exe	133
PID 1316 wrote to memory of 4568	1316	DllCommonsvc.exe	133
PID 1316 wrote to memory of 4644	1316	DllCommonsvc.exe	134
PID 1316 wrote to memory of 4644	1316	DllCommonsvc.exe	134
PID 1316 wrote to memory of 3424	1316	DllCommonsvc.exe	135
PID 1316 wrote to memory of 3424	1316	DllCommonsvc.exe	135
PID 1316 wrote to memory of 3704	1316	DllCommonsvc.exe	136
PID 1316 wrote to memory of 3704	1316	DllCommonsvc.exe	136
PID 1316 wrote to memory of 3972	1316	DllCommonsvc.exe	143
PID 1316 wrote to memory of 3972	1316	DllCommonsvc.exe	143
PID 1316 wrote to memory of 3996	1316	DllCommonsvc.exe	139
PID 1316 wrote to memory of 3996	1316	DllCommonsvc.exe	139
PID 1316 wrote to memory of 3060	1316	DllCommonsvc.exe	148
PID 1316 wrote to memory of 3060	1316	DllCommonsvc.exe	148
PID 3060 wrote to memory of 5472	3060	dllhost.exe	150
PID 3060 wrote to memory of 5472	3060	dllhost.exe	150
PID 5472 wrote to memory of 5528	5472	cmd.exe	152
PID 5472 wrote to memory of 5528	5472	cmd.exe	152
PID 5472 wrote to memory of 5704	5472	cmd.exe	153
PID 5472 wrote to memory of 5704	5472	cmd.exe	153
PID 5704 wrote to memory of 5812	5704	dllhost.exe	154
PID 5704 wrote to memory of 5812	5704	dllhost.exe	154
PID 5812 wrote to memory of 5868	5812	cmd.exe	156
PID 5812 wrote to memory of 5868	5812	cmd.exe	156
PID 5812 wrote to memory of 5888	5812	cmd.exe	157
PID 5812 wrote to memory of 5888	5812	cmd.exe	157
PID 5888 wrote to memory of 5996	5888	dllhost.exe	158
PID 5888 wrote to memory of 5996	5888	dllhost.exe	158
PID 5996 wrote to memory of 6052	5996	cmd.exe	160
PID 5996 wrote to memory of 6052	5996	cmd.exe	160
PID 5996 wrote to memory of 6072	5996	cmd.exe	161
PID 5996 wrote to memory of 6072	5996	cmd.exe	161
PID 6072 wrote to memory of 5200	6072	dllhost.exe	162
PID 6072 wrote to memory of 5200	6072	dllhost.exe	162
PID 5200 wrote to memory of 5260	5200	cmd.exe	164
PID 5200 wrote to memory of 5260	5200	cmd.exe	164

C:\Users\Admin\AppData\Local\Temp\6993b53f85ba0f40bb7eb332e3eef3877751acd544a9b96f5792d23cde8fe44d.exe
"C:\Users\Admin\AppData\Local\Temp\6993b53f85ba0f40bb7eb332e3eef3877751acd544a9b96f5792d23cde8fe44d.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4248
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3576
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4496
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1316
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2500
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\ELAMBKUP\cmd.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4980
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\explorer.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2056
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\dllhost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1944
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Microsoft Office\spoolsv.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2868
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\csrss.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3904
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\My Documents\csrss.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2820
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\SearchUI.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4688
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Defender\ja-JP\csrss.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4568
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Mozilla Maintenance Service\logs\OfficeClickToRun.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4644
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\SearchUI.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3424
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\RuntimeBroker.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3704
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\L2Schemas\taskhostw.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3996
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\explorer.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3972
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\Idle.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5040
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\csrss.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5024
    - - C:\providercommon\dllhost.exe
        
        "C:\providercommon\dllhost.exe"
        5⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3060
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\WtQmBjXbDh.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:5472
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:5528
        
        C:\providercommon\dllhost.exe
        
        "C:\providercommon\dllhost.exe"
        7⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5704
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\J2mXRZwkCj.bat"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:5812
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:5868
        
        C:\providercommon\dllhost.exe
        
        "C:\providercommon\dllhost.exe"
        9⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5888
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\H7kUlUtrsw.bat"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:5996
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:6052
        
        C:\providercommon\dllhost.exe
        
        "C:\providercommon\dllhost.exe"
        11⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:6072
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\lLU0orPlEL.bat"
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:5200
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:5260
        
        C:\providercommon\dllhost.exe
        
        "C:\providercommon\dllhost.exe"
        13⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5276
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\gTQuRhIyam.bat"
        14⤵
        
        PID:4716
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        15⤵
        
        PID:5344
        
        C:\providercommon\dllhost.exe
        
        "C:\providercommon\dllhost.exe"
        15⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5536
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\wRcBAgH7Mb.bat"
        16⤵
        
        PID:1464
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        17⤵
        
        PID:4448
        
        C:\providercommon\dllhost.exe
        
        "C:\providercommon\dllhost.exe"
        17⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4456
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\B4BP5ZSgoJ.bat"
        18⤵
        
        PID:3212
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        19⤵
        
        PID:4732
        
        C:\providercommon\dllhost.exe
        
        "C:\providercommon\dllhost.exe"
        19⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5600
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\BDITavvsiM.bat"
        20⤵
        
        PID:4076
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        21⤵
        
        PID:388
        
        C:\providercommon\dllhost.exe
        
        "C:\providercommon\dllhost.exe"
        21⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4676
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\AsgPmp9HNF.bat"
        22⤵
        
        PID:5012
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        23⤵
        
        PID:4904
        
        C:\providercommon\dllhost.exe
        
        "C:\providercommon\dllhost.exe"
        23⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1836
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\989MOUOnUX.bat"
        24⤵
        
        PID:696
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        25⤵
        
        PID:3904
        
        C:\providercommon\dllhost.exe
        
        "C:\providercommon\dllhost.exe"
        25⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3076
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\F4MZx53eLu.bat"
        26⤵
        
        PID:4544
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        27⤵
        
        PID:5068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 7 /tr "'C:\Program Files\Microsoft Office\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 8 /tr "'C:\Program Files\Microsoft Office\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 11 /tr "'C:\Windows\ELAMBKUP\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Windows\ELAMBKUP\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 7 /tr "'C:\Windows\ELAMBKUP\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\providercommon\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\providercommon\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4500

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\providercommon\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\My Documents\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Admin\My Documents\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\My Documents\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchUIS" /sc MINUTE /mo 7 /tr "'C:\providercommon\SearchUI.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchUI" /sc ONLOGON /tr "'C:\providercommon\SearchUI.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:60

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchUIS" /sc MINUTE /mo 9 /tr "'C:\providercommon\SearchUI.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\odt\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\odt\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\odt\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 14 /tr "'C:\providercommon\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\providercommon\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2160

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\providercommon\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Defender\ja-JP\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\ja-JP\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1332

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Defender\ja-JP\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1192

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchUIS" /sc MINUTE /mo 13 /tr "'C:\providercommon\SearchUI.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchUI" /sc ONLOGON /tr "'C:\providercommon\SearchUI.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchUIS" /sc MINUTE /mo 14 /tr "'C:\providercommon\SearchUI.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:188

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:204

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:212

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\providercommon\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\providercommon\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\providercommon\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 5 /tr "'C:\Windows\L2Schemas\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2188

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Windows\L2Schemas\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 10 /tr "'C:\Windows\L2Schemas\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1212

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Web Service

T1102

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dllhost.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\dllhost.exe.log
Size 1KB
SHA256 375076241775962f3edc08a8c72832a00920b427a4f3332528d91d21e909fa12
MD5 d63ff49d7c92016feb39812e4db10419
SHA1 2307d5e35ca9864ffefc93acf8573ea995ba189b
SHA512 00f8c8d0336d6575b956876183199624d6f4d2056f2c0aa633a6f17c516f22ee648062d9bc419254d84c459323e9424f0da8aed9dd4e16c2926e5ba30e797d8a
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 c9e6cb04d6c893458d5a7e12eb575cf97c3172f5e312b1f63a667cbbc5f0c033
MD5 ad5cd538ca58cb28ede39c108acb5785
SHA1 1ae910026f3dbe90ed025e9e96ead2b5399be877
SHA512 c066c5d9b276a68fa636647bb29aea05bfa2292217bc77f5324d9c1d93117772ee8277e1f7cff91ec8d6b7c05ca078f929cecfdbb09582522a9067f54740af13
MD5 SHA1 SHA512

Submit Download