Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
03/11/2022, 12:12
Behavioral task
behavioral1
Sample
c5878aa98b5144b0af9fa20e6255986b3ee6b6289311f4f5a8b48a34d837019b.exe
Resource
win10-20220812-en
General
-
Target
c5878aa98b5144b0af9fa20e6255986b3ee6b6289311f4f5a8b48a34d837019b.exe
-
Size
1.3MB
-
MD5
ba66a82f7fdf3d053ee98f72e02c5eb8
-
SHA1
19d2b3161a4d3bf0fedece59ef89ce6ae9373332
-
SHA256
c5878aa98b5144b0af9fa20e6255986b3ee6b6289311f4f5a8b48a34d837019b
-
SHA512
251bb335defd83c9f79728b9b12516d5941faf8a1b3741e48f93b98d5a902dbd450771c07d6b9e81636f5c370f2fc358f89a067df8d47bf1a2f223d147a84f58
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process 45 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3116 4292 schtasks.exe 70 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4436 4292 schtasks.exe 70 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3244 4292 schtasks.exe 70 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3744 4292 schtasks.exe 70 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3572 4292 schtasks.exe 70 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4304 4292 schtasks.exe 70 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2984 4292 schtasks.exe 70 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5092 4292 schtasks.exe 70 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4488 4292 schtasks.exe 70 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2932 4292 schtasks.exe 70 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4764 4292 schtasks.exe 70 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4756 4292 schtasks.exe 70 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4792 4292 schtasks.exe 70 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3016 4292 schtasks.exe 70 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3272 4292 schtasks.exe 70 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4796 4292 schtasks.exe 70 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4692 4292 schtasks.exe 70 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4680 4292 schtasks.exe 70 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3172 4292 schtasks.exe 70 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4804 4292 schtasks.exe 70 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4652 4292 schtasks.exe 70 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4668 4292 schtasks.exe 70 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4572 4292 schtasks.exe 70 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 496 4292 schtasks.exe 70 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 640 4292 schtasks.exe 70 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 504 4292 schtasks.exe 70 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 420 4292 schtasks.exe 70 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1800 4292 schtasks.exe 70 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1332 4292 schtasks.exe 70 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1792 4292 schtasks.exe 70 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1636 4292 schtasks.exe 70 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1184 4292 schtasks.exe 70 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1036 4292 schtasks.exe 70 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 688 4292 schtasks.exe 70 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2020 4292 schtasks.exe 70 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 760 4292 schtasks.exe 70 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 580 4292 schtasks.exe 70 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 96 4292 schtasks.exe 70 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 188 4292 schtasks.exe 70 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 208 4292 schtasks.exe 70 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3288 4292 schtasks.exe 70 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2252 4292 schtasks.exe 70 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1820 4292 schtasks.exe 70 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2128 4292 schtasks.exe 70 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5044 4292 schtasks.exe 70 -
resource yara_rule behavioral1/files/0x000700000001ac2e-280.dat dcrat behavioral1/files/0x000700000001ac2e-281.dat dcrat behavioral1/memory/2280-282-0x00000000007F0000-0x0000000000900000-memory.dmp dcrat behavioral1/files/0x000600000001ac37-843.dat dcrat behavioral1/files/0x000600000001ac37-844.dat dcrat behavioral1/files/0x000600000001ac37-879.dat dcrat behavioral1/files/0x000600000001ac37-884.dat dcrat behavioral1/files/0x000600000001ac37-890.dat dcrat behavioral1/files/0x000600000001ac37-896.dat dcrat behavioral1/files/0x000600000001ac37-902.dat dcrat behavioral1/files/0x000600000001ac37-907.dat dcrat behavioral1/files/0x000600000001ac37-913.dat dcrat behavioral1/files/0x000600000001ac37-918.dat dcrat behavioral1/files/0x000600000001ac37-923.dat dcrat -
Executes dropped EXE 11 IoCs
pid Process 2280 DllCommonsvc.exe 5164 DllCommonsvc.exe 5484 DllCommonsvc.exe 5664 DllCommonsvc.exe 5844 DllCommonsvc.exe 6024 DllCommonsvc.exe 1652 DllCommonsvc.exe 196 DllCommonsvc.exe 2400 DllCommonsvc.exe 4844 DllCommonsvc.exe 1792 DllCommonsvc.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Drops file in Program Files directory 6 IoCs
description ioc Process File created C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\cmd.exe DllCommonsvc.exe File created C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\ebf1f9fa8afd6d DllCommonsvc.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\it\lsass.exe DllCommonsvc.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\it\6203df4a6bafc7 DllCommonsvc.exe File created C:\Program Files (x86)\Windows Portable Devices\DllCommonsvc.exe DllCommonsvc.exe File created C:\Program Files (x86)\Windows Portable Devices\a76d7bf15d8370 DllCommonsvc.exe -
Drops file in Windows directory 5 IoCs
description ioc Process File created C:\Windows\Migration\WTR\6cb0b6c459d5d3 DllCommonsvc.exe File created C:\Windows\ImmersiveControlPanel\ja-JP\sihost.exe DllCommonsvc.exe File created C:\Windows\INF\wininit.exe DllCommonsvc.exe File created C:\Windows\INF\56085415360792 DllCommonsvc.exe File created C:\Windows\Migration\WTR\dwm.exe DllCommonsvc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 45 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3744 schtasks.exe 2984 schtasks.exe 4692 schtasks.exe 4668 schtasks.exe 188 schtasks.exe 1820 schtasks.exe 4764 schtasks.exe 1800 schtasks.exe 3116 schtasks.exe 3272 schtasks.exe 4680 schtasks.exe 3172 schtasks.exe 3288 schtasks.exe 3572 schtasks.exe 4756 schtasks.exe 4572 schtasks.exe 1792 schtasks.exe 1036 schtasks.exe 5044 schtasks.exe 208 schtasks.exe 2128 schtasks.exe 5092 schtasks.exe 4488 schtasks.exe 4652 schtasks.exe 504 schtasks.exe 1332 schtasks.exe 760 schtasks.exe 4792 schtasks.exe 420 schtasks.exe 96 schtasks.exe 2252 schtasks.exe 496 schtasks.exe 640 schtasks.exe 4436 schtasks.exe 3244 schtasks.exe 4304 schtasks.exe 2932 schtasks.exe 4796 schtasks.exe 4804 schtasks.exe 1636 schtasks.exe 1184 schtasks.exe 3016 schtasks.exe 688 schtasks.exe 2020 schtasks.exe 580 schtasks.exe -
Modifies registry class 12 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings DllCommonsvc.exe Key created \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings DllCommonsvc.exe Key created \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings DllCommonsvc.exe Key created \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings DllCommonsvc.exe Key created \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings DllCommonsvc.exe Key created \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings c5878aa98b5144b0af9fa20e6255986b3ee6b6289311f4f5a8b48a34d837019b.exe Key created \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings DllCommonsvc.exe Key created \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings DllCommonsvc.exe Key created \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings DllCommonsvc.exe Key created \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings DllCommonsvc.exe Key created \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings DllCommonsvc.exe Key created \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings DllCommonsvc.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2280 DllCommonsvc.exe 2280 DllCommonsvc.exe 2280 DllCommonsvc.exe 2280 DllCommonsvc.exe 2280 DllCommonsvc.exe 2280 DllCommonsvc.exe 2280 DllCommonsvc.exe 2280 DllCommonsvc.exe 2280 DllCommonsvc.exe 2280 DllCommonsvc.exe 2280 DllCommonsvc.exe 2280 DllCommonsvc.exe 2280 DllCommonsvc.exe 2280 DllCommonsvc.exe 2280 DllCommonsvc.exe 2280 DllCommonsvc.exe 2280 DllCommonsvc.exe 68 powershell.exe 68 powershell.exe 868 powershell.exe 868 powershell.exe 768 powershell.exe 768 powershell.exe 2512 powershell.exe 2512 powershell.exe 2640 powershell.exe 2640 powershell.exe 3840 powershell.exe 3840 powershell.exe 2516 powershell.exe 2516 powershell.exe 3496 powershell.exe 3496 powershell.exe 4612 powershell.exe 4612 powershell.exe 4852 powershell.exe 4852 powershell.exe 4936 powershell.exe 4936 powershell.exe 2500 powershell.exe 2500 powershell.exe 4312 powershell.exe 4312 powershell.exe 4092 powershell.exe 4092 powershell.exe 3496 powershell.exe 4536 powershell.exe 4536 powershell.exe 3732 powershell.exe 3732 powershell.exe 4312 powershell.exe 4536 powershell.exe 4312 powershell.exe 68 powershell.exe 68 powershell.exe 868 powershell.exe 868 powershell.exe 768 powershell.exe 2640 powershell.exe 2512 powershell.exe 4612 powershell.exe 3496 powershell.exe 3840 powershell.exe 2516 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2280 DllCommonsvc.exe Token: SeDebugPrivilege 68 powershell.exe Token: SeDebugPrivilege 868 powershell.exe Token: SeDebugPrivilege 768 powershell.exe Token: SeDebugPrivilege 2512 powershell.exe Token: SeDebugPrivilege 2640 powershell.exe Token: SeDebugPrivilege 3840 powershell.exe Token: SeDebugPrivilege 2516 powershell.exe Token: SeDebugPrivilege 3496 powershell.exe Token: SeDebugPrivilege 4612 powershell.exe Token: SeDebugPrivilege 4852 powershell.exe Token: SeDebugPrivilege 4936 powershell.exe Token: SeDebugPrivilege 2500 powershell.exe Token: SeDebugPrivilege 4312 powershell.exe Token: SeDebugPrivilege 4092 powershell.exe Token: SeDebugPrivilege 4536 powershell.exe Token: SeDebugPrivilege 3732 powershell.exe Token: SeIncreaseQuotaPrivilege 4312 powershell.exe Token: SeSecurityPrivilege 4312 powershell.exe Token: SeTakeOwnershipPrivilege 4312 powershell.exe Token: SeLoadDriverPrivilege 4312 powershell.exe Token: SeSystemProfilePrivilege 4312 powershell.exe Token: SeSystemtimePrivilege 4312 powershell.exe Token: SeProfSingleProcessPrivilege 4312 powershell.exe Token: SeIncBasePriorityPrivilege 4312 powershell.exe Token: SeCreatePagefilePrivilege 4312 powershell.exe Token: SeBackupPrivilege 4312 powershell.exe Token: SeRestorePrivilege 4312 powershell.exe Token: SeShutdownPrivilege 4312 powershell.exe Token: SeDebugPrivilege 4312 powershell.exe Token: SeSystemEnvironmentPrivilege 4312 powershell.exe Token: SeRemoteShutdownPrivilege 4312 powershell.exe Token: SeUndockPrivilege 4312 powershell.exe Token: SeManageVolumePrivilege 4312 powershell.exe Token: 33 4312 powershell.exe Token: 34 4312 powershell.exe Token: 35 4312 powershell.exe Token: 36 4312 powershell.exe Token: SeIncreaseQuotaPrivilege 3496 powershell.exe Token: SeSecurityPrivilege 3496 powershell.exe Token: SeTakeOwnershipPrivilege 3496 powershell.exe Token: SeLoadDriverPrivilege 3496 powershell.exe Token: SeSystemProfilePrivilege 3496 powershell.exe Token: SeSystemtimePrivilege 3496 powershell.exe Token: SeProfSingleProcessPrivilege 3496 powershell.exe Token: SeIncBasePriorityPrivilege 3496 powershell.exe Token: SeCreatePagefilePrivilege 3496 powershell.exe Token: SeBackupPrivilege 3496 powershell.exe Token: SeRestorePrivilege 3496 powershell.exe Token: SeShutdownPrivilege 3496 powershell.exe Token: SeDebugPrivilege 3496 powershell.exe Token: SeSystemEnvironmentPrivilege 3496 powershell.exe Token: SeRemoteShutdownPrivilege 3496 powershell.exe Token: SeUndockPrivilege 3496 powershell.exe Token: SeManageVolumePrivilege 3496 powershell.exe Token: 33 3496 powershell.exe Token: 34 3496 powershell.exe Token: 35 3496 powershell.exe Token: 36 3496 powershell.exe Token: SeIncreaseQuotaPrivilege 4536 powershell.exe Token: SeSecurityPrivilege 4536 powershell.exe Token: SeTakeOwnershipPrivilege 4536 powershell.exe Token: SeLoadDriverPrivilege 4536 powershell.exe Token: SeSystemProfilePrivilege 4536 powershell.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2976 wrote to memory of 4376 2976 c5878aa98b5144b0af9fa20e6255986b3ee6b6289311f4f5a8b48a34d837019b.exe 66 PID 2976 wrote to memory of 4376 2976 c5878aa98b5144b0af9fa20e6255986b3ee6b6289311f4f5a8b48a34d837019b.exe 66 PID 2976 wrote to memory of 4376 2976 c5878aa98b5144b0af9fa20e6255986b3ee6b6289311f4f5a8b48a34d837019b.exe 66 PID 4376 wrote to memory of 3968 4376 WScript.exe 67 PID 4376 wrote to memory of 3968 4376 WScript.exe 67 PID 4376 wrote to memory of 3968 4376 WScript.exe 67 PID 3968 wrote to memory of 2280 3968 cmd.exe 69 PID 3968 wrote to memory of 2280 3968 cmd.exe 69 PID 2280 wrote to memory of 68 2280 DllCommonsvc.exe 116 PID 2280 wrote to memory of 68 2280 DllCommonsvc.exe 116 PID 2280 wrote to memory of 868 2280 DllCommonsvc.exe 127 PID 2280 wrote to memory of 868 2280 DllCommonsvc.exe 127 PID 2280 wrote to memory of 768 2280 DllCommonsvc.exe 118 PID 2280 wrote to memory of 768 2280 DllCommonsvc.exe 118 PID 2280 wrote to memory of 2640 2280 DllCommonsvc.exe 119 PID 2280 wrote to memory of 2640 2280 DllCommonsvc.exe 119 PID 2280 wrote to memory of 2512 2280 DllCommonsvc.exe 124 PID 2280 wrote to memory of 2512 2280 DllCommonsvc.exe 124 PID 2280 wrote to memory of 2516 2280 DllCommonsvc.exe 120 PID 2280 wrote to memory of 2516 2280 DllCommonsvc.exe 120 PID 2280 wrote to memory of 3840 2280 DllCommonsvc.exe 121 PID 2280 wrote to memory of 3840 2280 DllCommonsvc.exe 121 PID 2280 wrote to memory of 3496 2280 DllCommonsvc.exe 148 PID 2280 wrote to memory of 3496 2280 DllCommonsvc.exe 148 PID 2280 wrote to memory of 4852 2280 DllCommonsvc.exe 147 PID 2280 wrote to memory of 4852 2280 DllCommonsvc.exe 147 PID 2280 wrote to memory of 4612 2280 DllCommonsvc.exe 129 PID 2280 wrote to memory of 4612 2280 DllCommonsvc.exe 129 PID 2280 wrote to memory of 2500 2280 DllCommonsvc.exe 144 PID 2280 wrote to memory of 2500 2280 DllCommonsvc.exe 144 PID 2280 wrote to memory of 4936 2280 DllCommonsvc.exe 130 PID 2280 wrote to memory of 4936 2280 DllCommonsvc.exe 130 PID 2280 wrote to memory of 4092 2280 DllCommonsvc.exe 142 PID 2280 wrote to memory of 4092 2280 DllCommonsvc.exe 142 PID 2280 wrote to memory of 4312 2280 DllCommonsvc.exe 141 PID 2280 wrote to memory of 4312 2280 DllCommonsvc.exe 141 PID 2280 wrote to memory of 4536 2280 DllCommonsvc.exe 138 PID 2280 wrote to memory of 4536 2280 DllCommonsvc.exe 138 PID 2280 wrote to memory of 3732 2280 DllCommonsvc.exe 133 PID 2280 wrote to memory of 3732 2280 DllCommonsvc.exe 133 PID 2280 wrote to memory of 4780 2280 DllCommonsvc.exe 137 PID 2280 wrote to memory of 4780 2280 DllCommonsvc.exe 137 PID 4780 wrote to memory of 4940 4780 cmd.exe 150 PID 4780 wrote to memory of 4940 4780 cmd.exe 150 PID 4780 wrote to memory of 5164 4780 cmd.exe 152 PID 4780 wrote to memory of 5164 4780 cmd.exe 152 PID 5164 wrote to memory of 5408 5164 DllCommonsvc.exe 153 PID 5164 wrote to memory of 5408 5164 DllCommonsvc.exe 153 PID 5408 wrote to memory of 5464 5408 cmd.exe 155 PID 5408 wrote to memory of 5464 5408 cmd.exe 155 PID 5408 wrote to memory of 5484 5408 cmd.exe 156 PID 5408 wrote to memory of 5484 5408 cmd.exe 156 PID 5484 wrote to memory of 5588 5484 DllCommonsvc.exe 157 PID 5484 wrote to memory of 5588 5484 DllCommonsvc.exe 157 PID 5588 wrote to memory of 5644 5588 cmd.exe 159 PID 5588 wrote to memory of 5644 5588 cmd.exe 159 PID 5588 wrote to memory of 5664 5588 cmd.exe 160 PID 5588 wrote to memory of 5664 5588 cmd.exe 160 PID 5664 wrote to memory of 5768 5664 DllCommonsvc.exe 161 PID 5664 wrote to memory of 5768 5664 DllCommonsvc.exe 161 PID 5768 wrote to memory of 5824 5768 cmd.exe 163 PID 5768 wrote to memory of 5824 5768 cmd.exe 163 PID 5768 wrote to memory of 5844 5768 cmd.exe 164 PID 5768 wrote to memory of 5844 5768 cmd.exe 164
Processes
-
C:\Users\Admin\AppData\Local\Temp\c5878aa98b5144b0af9fa20e6255986b3ee6b6289311f4f5a8b48a34d837019b.exe"C:\Users\Admin\AppData\Local\Temp\c5878aa98b5144b0af9fa20e6255986b3ee6b6289311f4f5a8b48a34d837019b.exe"1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"2⤵
- Suspicious use of WriteProcessMemory
PID:4376 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:3968 -
C:\providercommon\DllCommonsvc.exe"C:\providercommon\DllCommonsvc.exe"4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:68
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\fontdrvhost.exe'5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:768
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Portable Devices\DllCommonsvc.exe'5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2640
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Migration\WTR\dwm.exe'5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2516
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\OfficeClickToRun.exe'5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3840
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\fontdrvhost.exe'5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2512
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\sppsvc.exe'5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:868
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\fontdrvhost.exe'5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4612
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Start Menu\System.exe'5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4936
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\it\lsass.exe'5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3732
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\kM739AVLL2.bat"5⤵
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:26⤵PID:4940
-
-
C:\Program Files (x86)\Windows Portable Devices\DllCommonsvc.exe"C:\Program Files (x86)\Windows Portable Devices\DllCommonsvc.exe"6⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5164 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\38GCmEMl12.bat"7⤵
- Suspicious use of WriteProcessMemory
PID:5408 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:28⤵PID:5464
-
-
C:\Program Files (x86)\Windows Portable Devices\DllCommonsvc.exe"C:\Program Files (x86)\Windows Portable Devices\DllCommonsvc.exe"8⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5484 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\zHC6P4FzNT.bat"9⤵
- Suspicious use of WriteProcessMemory
PID:5588 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:210⤵PID:5644
-
-
C:\Program Files (x86)\Windows Portable Devices\DllCommonsvc.exe"C:\Program Files (x86)\Windows Portable Devices\DllCommonsvc.exe"10⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5664 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\lZfwAG7KGX.bat"11⤵
- Suspicious use of WriteProcessMemory
PID:5768 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:212⤵PID:5824
-
-
C:\Program Files (x86)\Windows Portable Devices\DllCommonsvc.exe"C:\Program Files (x86)\Windows Portable Devices\DllCommonsvc.exe"12⤵
- Executes dropped EXE
- Modifies registry class
PID:5844 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\rcE1qBYVKA.bat"13⤵PID:5948
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:214⤵PID:6004
-
-
C:\Program Files (x86)\Windows Portable Devices\DllCommonsvc.exe"C:\Program Files (x86)\Windows Portable Devices\DllCommonsvc.exe"14⤵
- Executes dropped EXE
- Modifies registry class
PID:6024 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Ys8lvSze9b.bat"15⤵PID:6128
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:216⤵PID:2656
-
-
C:\Program Files (x86)\Windows Portable Devices\DllCommonsvc.exe"C:\Program Files (x86)\Windows Portable Devices\DllCommonsvc.exe"16⤵
- Executes dropped EXE
- Modifies registry class
PID:1652 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\sNl5EWIzDs.bat"17⤵PID:4336
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:218⤵PID:3464
-
-
C:\Program Files (x86)\Windows Portable Devices\DllCommonsvc.exe"C:\Program Files (x86)\Windows Portable Devices\DllCommonsvc.exe"18⤵
- Executes dropped EXE
- Modifies registry class
PID:196 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Ys8lvSze9b.bat"19⤵PID:3988
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:220⤵PID:648
-
-
C:\Program Files (x86)\Windows Portable Devices\DllCommonsvc.exe"C:\Program Files (x86)\Windows Portable Devices\DllCommonsvc.exe"20⤵
- Executes dropped EXE
- Modifies registry class
PID:2400 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\jddtUB3Qwl.bat"21⤵PID:3296
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:222⤵PID:5124
-
-
C:\Program Files (x86)\Windows Portable Devices\DllCommonsvc.exe"C:\Program Files (x86)\Windows Portable Devices\DllCommonsvc.exe"22⤵
- Executes dropped EXE
- Modifies registry class
PID:4844 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\3HNGHapxv4.bat"23⤵PID:4968
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:224⤵PID:2356
-
-
C:\Program Files (x86)\Windows Portable Devices\DllCommonsvc.exe"C:\Program Files (x86)\Windows Portable Devices\DllCommonsvc.exe"24⤵
- Executes dropped EXE
- Modifies registry class
PID:1792 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\0LMDaVm4bI.bat"25⤵PID:1664
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:226⤵PID:4684
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\wininit.exe'5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4536
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\fontdrvhost.exe'5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4312
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\INF\wininit.exe'5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4092
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\cmd.exe'5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2500
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\fontdrvhost.exe'5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4852
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\lsass.exe'5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3496
-
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3116
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4436
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3244
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\providercommon\fontdrvhost.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3744
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\providercommon\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3572
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\providercommon\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4304
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Portable Devices\DllCommonsvc.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2984
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\DllCommonsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5092
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Portable Devices\DllCommonsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4488
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\odt\fontdrvhost.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2932
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\odt\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4764
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\odt\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4756
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\Windows\Migration\WTR\dwm.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4792
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\Migration\WTR\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3016
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 14 /tr "'C:\Windows\Migration\WTR\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3272
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 9 /tr "'C:\providercommon\OfficeClickToRun.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4796
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\providercommon\OfficeClickToRun.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4692
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 8 /tr "'C:\providercommon\OfficeClickToRun.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4680
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\lsass.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3172
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4804
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4652
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\providercommon\fontdrvhost.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4668
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\providercommon\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4572
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\providercommon\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:496
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:640
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:504
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:420
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "cmdc" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\cmd.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1800
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\cmd.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1332
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "cmdc" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\cmd.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1792
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 13 /tr "'C:\Users\Default\Start Menu\System.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1636
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Users\Default\Start Menu\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1184
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 6 /tr "'C:\Users\Default\Start Menu\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1036
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'C:\Windows\INF\wininit.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:688
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Windows\INF\wininit.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2020
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 9 /tr "'C:\Windows\INF\wininit.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:760
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\Users\Default User\fontdrvhost.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:580
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\Default User\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:96
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:188
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 11 /tr "'C:\odt\wininit.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:208
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\odt\wininit.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3288
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 14 /tr "'C:\odt\wininit.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2252
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\it\lsass.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1820
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\it\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2128
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\it\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5044
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
Filesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
Filesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
Filesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
Filesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
Filesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
Filesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
Filesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
Filesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
Filesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
Filesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
Filesize
1KB
MD5b4268d8ae66fdd920476b97a1776bf85
SHA1f920de54f7467f0970eccc053d3c6c8dd181d49a
SHA25661d17affcc8d91ecb1858e710c455186f9d0ccfc4d8ae17a1145d87bc7317879
SHA51203b6b90641837f9efb6065698602220d6c5ad263d51d7b7714747c2a3c3c618bd3d94add206b034d6fa2b8e43cbd1ac4a1741cfa1c2b1c1fc8589ae0b0c89516
-
Filesize
3KB
MD5ad5cd538ca58cb28ede39c108acb5785
SHA11ae910026f3dbe90ed025e9e96ead2b5399be877
SHA256c9e6cb04d6c893458d5a7e12eb575cf97c3172f5e312b1f63a667cbbc5f0c033
SHA512c066c5d9b276a68fa636647bb29aea05bfa2292217bc77f5324d9c1d93117772ee8277e1f7cff91ec8d6b7c05ca078f929cecfdbb09582522a9067f54740af13
-
Filesize
1KB
MD5f42672d2cfc54ba70fa0542d5743843a
SHA15bf3a7521f2ec605de70aa3f3ab410c8c800cc9d
SHA2563e8c707725c53855be98cc864d3581fdf2ac5b3ad3aaf1ffecb9886ef0f0ce56
SHA512794ed957dbaf4904a2dbe1691052c9464b2184567f1915d441d46e89e03b97765101e046a31c83757c10233262cc77a23a9a763be01e4adc10d432eebb475f77
-
Filesize
1KB
MD568de62fe66f9b492e94e98ced7737bf4
SHA16681849abb88363f3e0cedaec84535faea0221bd
SHA256da45781ef0aad5448310a4a4d5ad8cedb4c72eddba621fd2e111ad8be953c32e
SHA512aec608aa0ef68da637cd021d970b54aa76e071c1441e4ab0239bd7085f2290f10b3e5bc5c0b533e5b06717c5ee307f46c07625ed0398428b9fecbca7ce20186a
-
Filesize
1KB
MD5b9105535614bcc8e6b0467dbee18fdcc
SHA104963aede8462ec0236f6bac81f87912a4d309f9
SHA256a4344e0dc1af70a964d819a2e181dedae2c0539ee3111ca3acc97e9110f6bb34
SHA512c3e98ee9fb4f2881aa62b8edb202b31e48faca65b352d563f43b81440279490e50114b07cb557ef75171bbb738ab2ef8170ab297e4286e808e80005918dcd5bf
-
Filesize
1KB
MD5edb6d13ebb9d0829280d4e4f597fd8f9
SHA11ef5eaaa6ab6444fb2f121355d0ffe586609580e
SHA2569ab5072aaf0c58d5ec25adcb39591ea0e9be71b8ab8fc335035d1e2e039a9d2c
SHA512de8b58e06b02da74ff8e10641fe9d08e55d4a391bffc4f271259b5a7d16f00f7d71be7dce9e47b0e7edffead388cde30c7edbc45fb8ab982afffc3db17722377
-
Filesize
1KB
MD50c2709cb9970c0cf43ca4ce2e057139a
SHA1d91a16f847cc7adb46c0542aa67974c7d5c14b00
SHA2565247b7cfa79c50a2f3b35ad2a15c726b8a74665795e9c785122adf1cf0fa9b17
SHA5125edc45bcd17e1a5fae1cf5a3dbe76226531fc1021c8c947a8466946c5d1b679027539cef8373d8bdca6a79ad579ec5f695a6c0af6a96ae467e5d971571777672
-
Filesize
1KB
MD52701eb1c330a8391ec6e9902a187a6ae
SHA136fd17e7f4df322a5ed547983864df0ddd8f3030
SHA2565eae755eb59841874ae98080ffe949a0804eb62d634bb43e424f2f774120b025
SHA512ada5b2af9dab82795684bd424f0d61b62d739c85bac664126fe2962f2388bae4f832537806a3fe3c97fe492080b9ddb8ee9da1ba79818da290d05658c62c3af2
-
Filesize
1KB
MD50c2709cb9970c0cf43ca4ce2e057139a
SHA1d91a16f847cc7adb46c0542aa67974c7d5c14b00
SHA2565247b7cfa79c50a2f3b35ad2a15c726b8a74665795e9c785122adf1cf0fa9b17
SHA5125edc45bcd17e1a5fae1cf5a3dbe76226531fc1021c8c947a8466946c5d1b679027539cef8373d8bdca6a79ad579ec5f695a6c0af6a96ae467e5d971571777672
-
Filesize
1KB
MD52701eb1c330a8391ec6e9902a187a6ae
SHA136fd17e7f4df322a5ed547983864df0ddd8f3030
SHA2565eae755eb59841874ae98080ffe949a0804eb62d634bb43e424f2f774120b025
SHA512ada5b2af9dab82795684bd424f0d61b62d739c85bac664126fe2962f2388bae4f832537806a3fe3c97fe492080b9ddb8ee9da1ba79818da290d05658c62c3af2
-
Filesize
1KB
MD52701eb1c330a8391ec6e9902a187a6ae
SHA136fd17e7f4df322a5ed547983864df0ddd8f3030
SHA2565eae755eb59841874ae98080ffe949a0804eb62d634bb43e424f2f774120b025
SHA512ada5b2af9dab82795684bd424f0d61b62d739c85bac664126fe2962f2388bae4f832537806a3fe3c97fe492080b9ddb8ee9da1ba79818da290d05658c62c3af2
-
Filesize
1KB
MD50c2709cb9970c0cf43ca4ce2e057139a
SHA1d91a16f847cc7adb46c0542aa67974c7d5c14b00
SHA2565247b7cfa79c50a2f3b35ad2a15c726b8a74665795e9c785122adf1cf0fa9b17
SHA5125edc45bcd17e1a5fae1cf5a3dbe76226531fc1021c8c947a8466946c5d1b679027539cef8373d8bdca6a79ad579ec5f695a6c0af6a96ae467e5d971571777672
-
Filesize
1KB
MD52701eb1c330a8391ec6e9902a187a6ae
SHA136fd17e7f4df322a5ed547983864df0ddd8f3030
SHA2565eae755eb59841874ae98080ffe949a0804eb62d634bb43e424f2f774120b025
SHA512ada5b2af9dab82795684bd424f0d61b62d739c85bac664126fe2962f2388bae4f832537806a3fe3c97fe492080b9ddb8ee9da1ba79818da290d05658c62c3af2
-
Filesize
1KB
MD52701eb1c330a8391ec6e9902a187a6ae
SHA136fd17e7f4df322a5ed547983864df0ddd8f3030
SHA2565eae755eb59841874ae98080ffe949a0804eb62d634bb43e424f2f774120b025
SHA512ada5b2af9dab82795684bd424f0d61b62d739c85bac664126fe2962f2388bae4f832537806a3fe3c97fe492080b9ddb8ee9da1ba79818da290d05658c62c3af2
-
Filesize
1KB
MD52701eb1c330a8391ec6e9902a187a6ae
SHA136fd17e7f4df322a5ed547983864df0ddd8f3030
SHA2565eae755eb59841874ae98080ffe949a0804eb62d634bb43e424f2f774120b025
SHA512ada5b2af9dab82795684bd424f0d61b62d739c85bac664126fe2962f2388bae4f832537806a3fe3c97fe492080b9ddb8ee9da1ba79818da290d05658c62c3af2
-
Filesize
1KB
MD50c2709cb9970c0cf43ca4ce2e057139a
SHA1d91a16f847cc7adb46c0542aa67974c7d5c14b00
SHA2565247b7cfa79c50a2f3b35ad2a15c726b8a74665795e9c785122adf1cf0fa9b17
SHA5125edc45bcd17e1a5fae1cf5a3dbe76226531fc1021c8c947a8466946c5d1b679027539cef8373d8bdca6a79ad579ec5f695a6c0af6a96ae467e5d971571777672
-
Filesize
1KB
MD50c2709cb9970c0cf43ca4ce2e057139a
SHA1d91a16f847cc7adb46c0542aa67974c7d5c14b00
SHA2565247b7cfa79c50a2f3b35ad2a15c726b8a74665795e9c785122adf1cf0fa9b17
SHA5125edc45bcd17e1a5fae1cf5a3dbe76226531fc1021c8c947a8466946c5d1b679027539cef8373d8bdca6a79ad579ec5f695a6c0af6a96ae467e5d971571777672
-
Filesize
229B
MD59d7abfda6d83a2f0a1407900d41708b9
SHA1cb82ff17d4769d3d853f4d463b11631d67e11927
SHA256c87a8c7325a495d9edc181d0e192b20a415bd47e6f3de47f523c10eeb87e3486
SHA512ebd7e3976dbeac1bc70c4b88194e8c52c8f57684008e86244466a92ef7908fa37b0f91e21a2a01f07d72e9a99529416a4d9cdece524300c99a7b401371891566
-
Filesize
229B
MD5bb153da09d97d3bb91c49d7207ef3a54
SHA189f2ba1a23be07736b98fd32728bec0e2c1ff9ac
SHA25691c7e540e468824224414d5547bceb863465eae55aa486e2ebbe71d11ef89458
SHA51251fbbae84fab4d7feb74a4d754057e6b29cc2f5181115a727c52b918e70c1d93a293b9a0b76ab2b903f82632216507edcd745b46e67b0a1c0d4cac22a4cb0d51
-
Filesize
229B
MD56ebbe7e4597ee1ac63aa8098c854871e
SHA128edd3da39939f3d72b57bca3b1eedee366bb19f
SHA2566181236d6b9f59fbe9e723704c538cb9ccded99381564a1e3dea97443d124eca
SHA512ba3e7fe314e94d2496a61e5442b16f299a3dfe55d1be073c791677d580703bf96a60d5771cc7a172c71e0212bd4af06c44b8d6176f2dd421296fc786eb9ec833
-
Filesize
229B
MD5f6d0df28ab710107eec630554477f870
SHA1f474882f9e5f6af2d07f8ef1d1a7249baa79b619
SHA256ac9d179975e449326f036c8cc97c08f2c5d091e8e53ed3ec1074f0e308d55a28
SHA512fe171f580b6a761faf8bac7e7ee44c2e39c4bafaf817ee058cb0e2cbee0c00fc9fcf4ca917094dc6fcd08311fd5a1f3436931068e25efb71cbc80a637d74b683
-
Filesize
229B
MD5f6d0df28ab710107eec630554477f870
SHA1f474882f9e5f6af2d07f8ef1d1a7249baa79b619
SHA256ac9d179975e449326f036c8cc97c08f2c5d091e8e53ed3ec1074f0e308d55a28
SHA512fe171f580b6a761faf8bac7e7ee44c2e39c4bafaf817ee058cb0e2cbee0c00fc9fcf4ca917094dc6fcd08311fd5a1f3436931068e25efb71cbc80a637d74b683
-
Filesize
229B
MD5c6125cca99ca190feaa89096df41104f
SHA184900d87d80e262acbc0944c6d531fa5d6d2819a
SHA256a958fed4ed5491a642f90033e158ed6cc62471120e1bf495db310325364d6ae9
SHA512c046c9bfa7b7db51c605fb31d3f8bcb4eb130cbd0d9965f9dcf9301d969741759efd0f13198742b8c4bb1234358c7378f7cb628921923f33110fd10ff4a4d966
-
Filesize
229B
MD55d1f40bd75b95662611c31c9151a4c77
SHA1bba9c766c26e012ba5b5bb73f8d585cdb578484f
SHA2564b6a073fa16546ca44acdc485f3eda842dbc96abf453de3cf33d0fb808e9dbed
SHA512dfa145187d6d2b2fdfdc969c2a0a4524b360fff213acbd93c03e032f4422c374f263f164bdb62656ac0c4c4669c9024a95f54bbc563529fbbf1edefb9f9253b7
-
Filesize
229B
MD5d09466e0285b6cd414ceed5343a74bef
SHA18a34ac5a318e5b6515e7d919b32e7f18be68d41a
SHA256d2f4f4ab3f5469e342c634e50a55972fc84907be4c50561edab9b22a30dd7b87
SHA51231146707acd22a0e5ed492836c0517900bee8d22751e7faede086abc748ec3ec5235afccaa2dad8d3323b05cb83d3314d523b1708359fb17f3e782c08f9d76aa
-
Filesize
229B
MD5bf87696a02769a7afa8f027a246e6feb
SHA1ba9f71d3a81edf2031114fa1980233db897ba683
SHA2567c3199ad0ea51e46fd7f6a6da5d739c29eac0fb8c8a881694e3d98213582e996
SHA512298ba7c04c9955a653521102311e0311600b1684bae6d43254d4343fcd54a24e5b2688f1fd44defc59fa64e71603f518a657ab57e8dce16523c35cae235b1687
-
Filesize
229B
MD56159ade6e45602a0c7011b2083dd4cb5
SHA151337c8bace666de3acbf7c65890fe0d7fe21c74
SHA25611c2933963a071ea4d0300b89d73f93a4619cbacb3144b6a5ef4aa511aa4b520
SHA5125d323f78c67b872dcec905f15808b0b47c134c86bada6d44fb95332f6e1c879b1fd04de77a174a7d6832f77d0a4da5d67174a70e3e4fbcd884b6c039e767ab05
-
Filesize
229B
MD524a3cb63391658481deff807d7c689da
SHA1e6ad32080416eb47cb9f227dd49106d672a37d1b
SHA25608083a5534dfc5c046c99ce2b024d35fe850c14c80601c56d1c421f8ec79f0b8
SHA5120ac618b3457616d95bc39e13383d0bb680951f5d66c7140e4408463e60a379e9147889a956aad2d9a0b4f67e06b287218924a1c38863117fa2eb81171d066f3d
-
Filesize
36B
MD56783c3ee07c7d151ceac57f1f9c8bed7
SHA117468f98f95bf504cc1f83c49e49a78526b3ea03
SHA2568ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322
SHA512c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8
-
Filesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
Filesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
Filesize
197B
MD58088241160261560a02c84025d107592
SHA1083121f7027557570994c9fc211df61730455bb5
SHA2562072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1
SHA51220d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478