dcrat | abee8542dc156b695a019d34a7bf3734d2e63b648e4affb3209b151ab0f8e6ac

Analysis

max time kernel
145s
max time network
152s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
21-03-2023 20:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

09cacacf6eef86e62b26d5d1ca217c8e.exe
Size

2.6MB
MD5

09cacacf6eef86e62b26d5d1ca217c8e
SHA1

21520171163005980651861cea13fc6edc82d2da
SHA256

abee8542dc156b695a019d34a7bf3734d2e63b648e4affb3209b151ab0f8e6ac
SHA512

fc90917fa408769cef02c977ff4a0f30a6b14e0fe0731a7ccd573c63da9523e48d58914c5a26b4f5d3d8faee47ea3d32ccbf5e462e802dd7b3cc23e6ad6fd4c6
SSDEEP

49152:ubA3jlSSI+tkWr2mvKSq32s+FBf4HrypMFQtwfRKSSutCn0:ubcSbWr2mLHyC8LSut1

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 64 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1628	796	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1240	796	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	888	796	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	760	796	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	828	796	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	272	796	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1924	796	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1864	796	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2008	796	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1512	796	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	696	796	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2028	796	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1608	796	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2036	796	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	584	796	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1112	796	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	884	796	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	572	796	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1656	796	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	284	796	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	804	796	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1248	796	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2012	796	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1428	796	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1960	796	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2040	796	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1704	796	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1488	796	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1760	796	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	524	796	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2008	796	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	896	796	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1948	796	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1140	796	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1288	796	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1328	796	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1112	796	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1064	796	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1656	796	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1748	796	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1532	796	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1608	796	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	980	796	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1596	796	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	684	796	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1196	796	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1088	796	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1168	796	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	920	796	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1600	796	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	384	796	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	852	796	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	272	796	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1704	796	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1080	796	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1960	796	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2044	796	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	668	796	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1248	796	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	384	796	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1532	796	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1064	796	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1300	796	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	284	796	schtasks.exe

DCRat payload 13 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
\hyperchainagent\Surrogaterefnet.exe	dcrat
C:\hyperchainagent\Surrogaterefnet.exe	dcrat
\hyperchainagent\Surrogaterefnet.exe	dcrat
C:\hyperchainagent\Surrogaterefnet.exe	dcrat
behavioral1/memory/564-67-0x00000000003B0000-0x0000000000602000-memory.dmp	dcrat
C:\Users\Public\Libraries\lsass.exe	dcrat
C:\hyperchainagent\Surrogaterefnet.exe	dcrat
behavioral1/memory/1112-121-0x0000000000070000-0x00000000002C2000-memory.dmp	dcrat
C:\Users\Default User\System.exe	dcrat
C:\Users\Default\System.exe	dcrat
behavioral1/memory/760-168-0x0000000000A80000-0x0000000000CD2000-memory.dmp	dcrat
behavioral1/memory/760-169-0x000000001AF70000-0x000000001AFF0000-memory.dmp	dcrat
behavioral1/memory/760-170-0x000000001AF70000-0x000000001AFF0000-memory.dmp	dcrat

Executes dropped EXE 3 IoCs

Processes:

Surrogaterefnet.exeSurrogaterefnet.exeSystem.exe

pid process

564 Surrogaterefnet.exe
1112 Surrogaterefnet.exe
760 System.exe
Loads dropped DLL 2 IoCs

Processes:

cmd.exe

pid process

1912 cmd.exe
1912 cmd.exe

pid	process
1912	cmd.exe
1912	cmd.exe

Drops file in Program Files directory 20 IoCs

Processes:

Surrogaterefnet.exeSurrogaterefnet.exe

description	ioc	process
File created	C:\Program Files (x86)\Internet Explorer\SIGNUP\cmd.exe	Surrogaterefnet.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\explorer.exe	Surrogaterefnet.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\explorer.exe	Surrogaterefnet.exe
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\csrss.exe	Surrogaterefnet.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\27d1bcfc3c54e0	Surrogaterefnet.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\spoolsv.exe	Surrogaterefnet.exe
File created	C:\Program Files (x86)\Internet Explorer\SIGNUP\ebf1f9fa8afd6d	Surrogaterefnet.exe
File created	C:\Program Files\Common Files\Services\wininit.exe	Surrogaterefnet.exe
File created	C:\Program Files (x86)\Windows Defender\de-DE\lsass.exe	Surrogaterefnet.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\de-DE\lsass.exe	Surrogaterefnet.exe
File created	C:\Program Files\7-Zip\Lang\System.exe	Surrogaterefnet.exe
File created	C:\Program Files\VideoLAN\VLC\skins\fonts\7a0fd90576e088	Surrogaterefnet.exe
File created	C:\Program Files (x86)\Windows Defender\de-DE\6203df4a6bafc7	Surrogaterefnet.exe
File created	C:\Program Files\7-Zip\Lang\27d1bcfc3c54e0	Surrogaterefnet.exe
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\886983d96e3d3e	Surrogaterefnet.exe
File created	C:\Program Files\VideoLAN\VLC\skins\fonts\explorer.exe	Surrogaterefnet.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\7a0fd90576e088	Surrogaterefnet.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\7a0fd90576e088	Surrogaterefnet.exe
File created	C:\Program Files\Common Files\Services\56085415360792	Surrogaterefnet.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\System.exe	Surrogaterefnet.exe

Drops file in Windows directory 5 IoCs

Processes:

Surrogaterefnet.exe

description	ioc	process
File opened for modification	C:\Windows\assembly\GAC_64\napcrypt\6.1.0.0__31bf3856ad364e35\WMIADAP.exe	Surrogaterefnet.exe
File created	C:\Windows\assembly\GAC_64\napcrypt\6.1.0.0__31bf3856ad364e35\75a57c1bdf437c	Surrogaterefnet.exe
File created	C:\Windows\debug\WIA\System.exe	Surrogaterefnet.exe
File created	C:\Windows\debug\WIA\27d1bcfc3c54e0	Surrogaterefnet.exe
File created	C:\Windows\assembly\GAC_64\napcrypt\6.1.0.0__31bf3856ad364e35\WMIADAP.exe	Surrogaterefnet.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 64 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

Processes:

pid	process
888	schtasks.exe
1760	schtasks.exe
1600	schtasks.exe
668	schtasks.exe
1240	schtasks.exe
884	schtasks.exe
2008	schtasks.exe
272	schtasks.exe
556	schtasks.exe
2012	schtasks.exe
1656	schtasks.exe
684	schtasks.exe
920	schtasks.exe
548	schtasks.exe
1656	schtasks.exe
868	schtasks.exe
284	schtasks.exe
384	schtasks.exe
1988	schtasks.exe
1564	schtasks.exe
760	schtasks.exe
696	schtasks.exe
1948	schtasks.exe
1088	schtasks.exe
520	schtasks.exe
804	schtasks.exe
1248	schtasks.exe
852	schtasks.exe
1732	schtasks.exe
1960	schtasks.exe
1864	schtasks.exe
1508	schtasks.exe
1988	schtasks.exe
1428	schtasks.exe
1168	schtasks.exe
1064	schtasks.exe
548	schtasks.exe
1140	schtasks.exe
1480	schtasks.exe
1632	schtasks.exe
1112	schtasks.exe
1064	schtasks.exe
2036	schtasks.exe
760	schtasks.exe
2044	schtasks.exe
1300	schtasks.exe
1960	schtasks.exe
1704	schtasks.exe
1864	schtasks.exe
1960	schtasks.exe
1544	schtasks.exe
1300	schtasks.exe
1488	schtasks.exe
524	schtasks.exe
852	schtasks.exe
828	schtasks.exe
272	schtasks.exe
284	schtasks.exe
1132	schtasks.exe
564	schtasks.exe
1764	schtasks.exe
1820	schtasks.exe
272	schtasks.exe
868	schtasks.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

Surrogaterefnet.exeSurrogaterefnet.exeSystem.exe

pid	process
564	Surrogaterefnet.exe
564	Surrogaterefnet.exe
564	Surrogaterefnet.exe
1112	Surrogaterefnet.exe
760	System.exe
760	System.exe
760	System.exe
760	System.exe
760	System.exe
760	System.exe
760	System.exe
760	System.exe
760	System.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

System.exe

pid process

760 System.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

Surrogaterefnet.exeSurrogaterefnet.exeSystem.exe

description pid process

Token: SeDebugPrivilege 564 Surrogaterefnet.exe
Token: SeDebugPrivilege 1112 Surrogaterefnet.exe
Token: SeDebugPrivilege 760 System.exe

pid	process
760	System.exe

description	pid	process
Token: SeDebugPrivilege	564	Surrogaterefnet.exe
Token: SeDebugPrivilege	1112	Surrogaterefnet.exe
Token: SeDebugPrivilege	760	System.exe

Suspicious use of WriteProcessMemory 30 IoCs

Processes:

09cacacf6eef86e62b26d5d1ca217c8e.exeWScript.execmd.exeSurrogaterefnet.execmd.exeSurrogaterefnet.execmd.exe

description	pid	process	target process
PID 1728 wrote to memory of 868	1728	09cacacf6eef86e62b26d5d1ca217c8e.exe	WScript.exe
PID 1728 wrote to memory of 868	1728	09cacacf6eef86e62b26d5d1ca217c8e.exe	WScript.exe
PID 1728 wrote to memory of 868	1728	09cacacf6eef86e62b26d5d1ca217c8e.exe	WScript.exe
PID 1728 wrote to memory of 868	1728	09cacacf6eef86e62b26d5d1ca217c8e.exe	WScript.exe
PID 868 wrote to memory of 1912	868	WScript.exe	cmd.exe
PID 868 wrote to memory of 1912	868	WScript.exe	cmd.exe
PID 868 wrote to memory of 1912	868	WScript.exe	cmd.exe
PID 868 wrote to memory of 1912	868	WScript.exe	cmd.exe
PID 1912 wrote to memory of 564	1912	cmd.exe	Surrogaterefnet.exe
PID 1912 wrote to memory of 564	1912	cmd.exe	Surrogaterefnet.exe
PID 1912 wrote to memory of 564	1912	cmd.exe	Surrogaterefnet.exe
PID 1912 wrote to memory of 564	1912	cmd.exe	Surrogaterefnet.exe
PID 564 wrote to memory of 1100	564	Surrogaterefnet.exe	cmd.exe
PID 564 wrote to memory of 1100	564	Surrogaterefnet.exe	cmd.exe
PID 564 wrote to memory of 1100	564	Surrogaterefnet.exe	cmd.exe
PID 1100 wrote to memory of 772	1100	cmd.exe	w32tm.exe
PID 1100 wrote to memory of 772	1100	cmd.exe	w32tm.exe
PID 1100 wrote to memory of 772	1100	cmd.exe	w32tm.exe
PID 1100 wrote to memory of 1112	1100	cmd.exe	Surrogaterefnet.exe
PID 1100 wrote to memory of 1112	1100	cmd.exe	Surrogaterefnet.exe
PID 1100 wrote to memory of 1112	1100	cmd.exe	Surrogaterefnet.exe
PID 1112 wrote to memory of 1544	1112	Surrogaterefnet.exe	cmd.exe
PID 1112 wrote to memory of 1544	1112	Surrogaterefnet.exe	cmd.exe
PID 1112 wrote to memory of 1544	1112	Surrogaterefnet.exe	cmd.exe
PID 1544 wrote to memory of 764	1544	cmd.exe	w32tm.exe
PID 1544 wrote to memory of 764	1544	cmd.exe	w32tm.exe
PID 1544 wrote to memory of 764	1544	cmd.exe	w32tm.exe
PID 1544 wrote to memory of 760	1544	cmd.exe	System.exe
PID 1544 wrote to memory of 760	1544	cmd.exe	System.exe
PID 1544 wrote to memory of 760	1544	cmd.exe	System.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\09cacacf6eef86e62b26d5d1ca217c8e.exe
"C:\Users\Admin\AppData\Local\Temp\09cacacf6eef86e62b26d5d1ca217c8e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\hyperchainagent\hVasfh5Xz1.vbe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:868
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\hyperchainagent\DMBt2834kk6smlkgJa5RvPFxYK.bat" "
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1912
  - - C:\hyperchainagent\Surrogaterefnet.exe
      "C:\hyperchainagent\Surrogaterefnet.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:564
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\dmgGBD5MVd.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1100
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:772
      - C:\hyperchainagent\Surrogaterefnet.exe
        
        "C:\hyperchainagent\Surrogaterefnet.exe"
        6⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1112
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\cT8QmSmRPm.bat"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:1544
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:764
        
        C:\Users\Default User\System.exe
        
        "C:\Users\Default User\System.exe"
        8⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        
        PID:760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 9 /tr "'C:\Windows\assembly\GAC_64\napcrypt\6.1.0.0__31bf3856ad364e35\WMIADAP.exe'" /f
1⤵
- Process spawned unexpected child process
PID:1628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAP" /sc ONLOGON /tr "'C:\Windows\assembly\GAC_64\napcrypt\6.1.0.0__31bf3856ad364e35\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1240

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 5 /tr "'C:\Windows\assembly\GAC_64\napcrypt\6.1.0.0__31bf3856ad364e35\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\WMIADAP.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAP" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:272

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\Users\Public\Libraries\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
PID:1924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Users\Public\Libraries\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 7 /tr "'C:\Users\Public\Libraries\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:2008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Users\Default User\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
PID:1512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Default User\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Users\Default User\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:2028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Internet Explorer\SIGNUP\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
PID:1608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\SIGNUP\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Internet Explorer\SIGNUP\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 5 /tr "'C:\hyperchainagent\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\hyperchainagent\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 6 /tr "'C:\hyperchainagent\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 12 /tr "'C:\Users\Default User\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
PID:1656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Users\Default User\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 6 /tr "'C:\Users\Default User\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 14 /tr "'C:\Recovery\cfd8e0a2-b1a3-11ed-adb5-cee1c2fbb193\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Recovery\cfd8e0a2-b1a3-11ed-adb5-cee1c2fbb193\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:2012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\Recovery\cfd8e0a2-b1a3-11ed-adb5-cee1c2fbb193\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\hyperchainagent\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\hyperchainagent\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:2040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\hyperchainagent\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:1704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 11 /tr "'C:\Recovery\cfd8e0a2-b1a3-11ed-adb5-cee1c2fbb193\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Recovery\cfd8e0a2-b1a3-11ed-adb5-cee1c2fbb193\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'C:\Recovery\cfd8e0a2-b1a3-11ed-adb5-cee1c2fbb193\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\Program Files\VideoLAN\VLC\skins\fonts\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\VLC\skins\fonts\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:896

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\Program Files\VideoLAN\VLC\skins\fonts\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 9 /tr "'C:\hyperchainagent\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1140

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\hyperchainagent\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:1288

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\hyperchainagent\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:1328

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\Program Files\VideoLAN\VLC\plugins\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
PID:1112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\VLC\plugins\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:1064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\Program Files\VideoLAN\VLC\plugins\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 11 /tr "'C:\Windows\debug\WIA\System.exe'" /f
1⤵
- Process spawned unexpected child process
PID:1748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Windows\debug\WIA\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:1532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'C:\Windows\debug\WIA\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:1608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
PID:980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:1596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\Program Files\Common Files\Services\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
PID:1196

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files\Common Files\Services\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\Program Files\Common Files\Services\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1168

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 6 /tr "'C:\Users\Default\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Users\Default\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:1600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\Users\Default\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:384

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:272

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 7 /tr "'C:\Recovery\cfd8e0a2-b1a3-11ed-adb5-cee1c2fbb193\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
PID:1080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Recovery\cfd8e0a2-b1a3-11ed-adb5-cee1c2fbb193\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 5 /tr "'C:\Recovery\cfd8e0a2-b1a3-11ed-adb5-cee1c2fbb193\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:2044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Defender\de-DE\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
PID:668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\de-DE\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:1248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Defender\de-DE\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:384

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 7 /tr "'C:\Users\Default\Downloads\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
PID:1532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Users\Default\Downloads\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 12 /tr "'C:\Users\Default\Downloads\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 10 /tr "'C:\Recovery\cfd8e0a2-b1a3-11ed-adb5-cee1c2fbb193\WMIADAP.exe'" /f
1⤵
- Process spawned unexpected child process
PID:284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAP" /sc ONLOGON /tr "'C:\Recovery\cfd8e0a2-b1a3-11ed-adb5-cee1c2fbb193\WMIADAP.exe'" /rl HIGHEST /f
1⤵
PID:836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 8 /tr "'C:\Recovery\cfd8e0a2-b1a3-11ed-adb5-cee1c2fbb193\WMIADAP.exe'" /rl HIGHEST /f
1⤵
PID:1140

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 13 /tr "'C:\Program Files\7-Zip\Lang\System.exe'" /f
1⤵
- Creates scheduled task(s)
PID:1820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files\7-Zip\Lang\System.exe'" /rl HIGHEST /f
1⤵
PID:1364

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 11 /tr "'C:\Program Files\7-Zip\Lang\System.exe'" /rl HIGHEST /f
1⤵
PID:2032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 6 /tr "'C:\hyperchainagent\services.exe'" /f
1⤵
- Creates scheduled task(s)
PID:272

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\hyperchainagent\services.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:1600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 10 /tr "'C:\hyperchainagent\services.exe'" /rl HIGHEST /f
1⤵
PID:944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\hyperchainagent\dwm.exe'" /f
1⤵
- Creates scheduled task(s)
PID:868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\hyperchainagent\dwm.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 5 /tr "'C:\hyperchainagent\dwm.exe'" /rl HIGHEST /f
1⤵
PID:1156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 5 /tr "'C:\Users\Default\Pictures\services.exe'" /f
1⤵
- Creates scheduled task(s)
PID:1732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Users\Default\Pictures\services.exe'" /rl HIGHEST /f
1⤵
PID:1916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 6 /tr "'C:\Users\Default\Pictures\services.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Recovery\cfd8e0a2-b1a3-11ed-adb5-cee1c2fbb193\csrss.exe'" /f
1⤵
PID:1760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\cfd8e0a2-b1a3-11ed-adb5-cee1c2fbb193\csrss.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:1480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Recovery\cfd8e0a2-b1a3-11ed-adb5-cee1c2fbb193\csrss.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:1960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\csrss.exe'" /f
1⤵
PID:1748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\All Users\csrss.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:1544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\csrss.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:1064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\System.exe'" /f
1⤵
- Creates scheduled task(s)
PID:2012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\System.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\System.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:1864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 13 /tr "'C:\Recovery\cfd8e0a2-b1a3-11ed-adb5-cee1c2fbb193\lsm.exe'" /f
1⤵
PID:1036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Recovery\cfd8e0a2-b1a3-11ed-adb5-cee1c2fbb193\lsm.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:1508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 9 /tr "'C:\Recovery\cfd8e0a2-b1a3-11ed-adb5-cee1c2fbb193\lsm.exe'" /rl HIGHEST /f
1⤵
PID:1532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\System.exe'" /f
1⤵
- Creates scheduled task(s)
PID:1988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Users\Default User\System.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'C:\Users\Default User\System.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\csrss.exe'" /f
1⤵
PID:1496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\csrss.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\csrss.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:2044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\hyperchainagent\lsass.exe'" /f
1⤵
PID:1824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\hyperchainagent\lsass.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:1564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\hyperchainagent\lsass.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:1132

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 5 /tr "'C:\Recovery\cfd8e0a2-b1a3-11ed-adb5-cee1c2fbb193\WmiPrvSE.exe'" /f
1⤵
PID:1780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Recovery\cfd8e0a2-b1a3-11ed-adb5-cee1c2fbb193\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
PID:1820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 12 /tr "'C:\Recovery\cfd8e0a2-b1a3-11ed-adb5-cee1c2fbb193\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Recovery\cfd8e0a2-b1a3-11ed-adb5-cee1c2fbb193\csrss.exe'" /f
1⤵
- Creates scheduled task(s)
PID:1300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\cfd8e0a2-b1a3-11ed-adb5-cee1c2fbb193\csrss.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:1764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Recovery\cfd8e0a2-b1a3-11ed-adb5-cee1c2fbb193\csrss.exe'" /rl HIGHEST /f
1⤵
PID:2008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 12 /tr "'C:\Users\Public\Music\Sample Music\WmiPrvSE.exe'" /f
1⤵
- Creates scheduled task(s)
PID:1988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Users\Public\Music\Sample Music\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:1656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 11 /tr "'C:\Users\Public\Music\Sample Music\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 11 /tr "'C:\Users\Public\Downloads\spoolsv.exe'" /f
1⤵
PID:1628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Users\Public\Downloads\spoolsv.exe'" /rl HIGHEST /f
1⤵
PID:1480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 11 /tr "'C:\Users\Public\Downloads\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 12 /tr "'C:\Recovery\cfd8e0a2-b1a3-11ed-adb5-cee1c2fbb193\lsm.exe'" /f
1⤵
- Creates scheduled task(s)
PID:1632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Recovery\cfd8e0a2-b1a3-11ed-adb5-cee1c2fbb193\lsm.exe'" /rl HIGHEST /f
1⤵
PID:1012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 5 /tr "'C:\Recovery\cfd8e0a2-b1a3-11ed-adb5-cee1c2fbb193\lsm.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:668

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\cT8QmSmRPm.bat

Filesize
197B

MD5
593eec2b2fd75ca03ba1f3baafbe1542

SHA1
dabfa9171189a3b363087a2c4d47fc6a08ed5511

SHA256
457350f00be24daae144b8e904b9922f86fab40ee141eb5b949841b6fcdfa97d

SHA512
54c7cefee0cc642193a2d85124a51a913979c210988223860545b6b13c1f6d007c3ca9ac1eb91327e385f1575b19af7ecb0953dac0aeace54c318255c904c1a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\dmgGBD5MVd.bat

Filesize
203B

MD5
510d74172da1be1165dc29d8aec119b4

SHA1
0b130ccee6fd842cca895a0c6d6efe00084166c2

SHA256
7e926da8ea04f6c88b65abeac9c7257113541723f591dec883b3a1f2063d86a3

SHA512
b55edf2ee0ab3de93dc66768cbf19345474bd981b90aebaca08e3bb3f9cc6c4663c33f7368f649f2752c976afef2b014fc840188c8f7204e491fbaf4fa0ed100

Download Submit
C:\Users\Default User\System.exe

Filesize
2.3MB

MD5
dbf705ce9641d7783c9e867a15d463dc

SHA1
e14b23c79cdc102ef10cb35ce78e84a50e725549

SHA256
ca84510c38b5daf4723dd0f87379b68eb26a7192ed5f86f1ad21fead4c56c8b3

SHA512
4ad6c5f92a2e9630bd95c3a08d259ba1f3605067ed5c60b3ccc3568b4d4ff5a0a25856000bf73cdad6e1ff3afcea6bf6e468cf9948755c4427f6feef7b2e8c81

Download Submit
C:\Users\Default\System.exe

Filesize
2.3MB

MD5
dbf705ce9641d7783c9e867a15d463dc

SHA1
e14b23c79cdc102ef10cb35ce78e84a50e725549

SHA256
ca84510c38b5daf4723dd0f87379b68eb26a7192ed5f86f1ad21fead4c56c8b3

SHA512
4ad6c5f92a2e9630bd95c3a08d259ba1f3605067ed5c60b3ccc3568b4d4ff5a0a25856000bf73cdad6e1ff3afcea6bf6e468cf9948755c4427f6feef7b2e8c81

Download Submit
C:\Users\Public\Libraries\lsass.exe

Filesize
2.3MB

MD5
dbf705ce9641d7783c9e867a15d463dc

SHA1
e14b23c79cdc102ef10cb35ce78e84a50e725549

SHA256
ca84510c38b5daf4723dd0f87379b68eb26a7192ed5f86f1ad21fead4c56c8b3

SHA512
4ad6c5f92a2e9630bd95c3a08d259ba1f3605067ed5c60b3ccc3568b4d4ff5a0a25856000bf73cdad6e1ff3afcea6bf6e468cf9948755c4427f6feef7b2e8c81

Download Submit
C:\hyperchainagent\DMBt2834kk6smlkgJa5RvPFxYK.bat

Filesize
40B

MD5
9cbc6ed294d7df3d71188be1778d1e84

SHA1
49ea3428916b3fbbb817df9f40bd7fd3385dfb1e

SHA256
91bb54ba35c1ac167d6eedccd1b18f9178426f21aefcf14ac488e09dbb798af8

SHA512
7303ae61150beb18504db411371d2d6e0383f2f3e7a7e3f5f7e7feffa5cbce4fc9b1225474f57050c99f32d3adcbff7f8cab41e4f9edd78a5c26c15e95dea06a

Download Submit
C:\hyperchainagent\Surrogaterefnet.exe

Filesize
2.3MB

MD5
dbf705ce9641d7783c9e867a15d463dc

SHA1
e14b23c79cdc102ef10cb35ce78e84a50e725549

SHA256
ca84510c38b5daf4723dd0f87379b68eb26a7192ed5f86f1ad21fead4c56c8b3

SHA512
4ad6c5f92a2e9630bd95c3a08d259ba1f3605067ed5c60b3ccc3568b4d4ff5a0a25856000bf73cdad6e1ff3afcea6bf6e468cf9948755c4427f6feef7b2e8c81

Download Submit
C:\hyperchainagent\Surrogaterefnet.exe

Filesize
2.3MB

MD5
dbf705ce9641d7783c9e867a15d463dc

SHA1
e14b23c79cdc102ef10cb35ce78e84a50e725549

SHA256
ca84510c38b5daf4723dd0f87379b68eb26a7192ed5f86f1ad21fead4c56c8b3

SHA512
4ad6c5f92a2e9630bd95c3a08d259ba1f3605067ed5c60b3ccc3568b4d4ff5a0a25856000bf73cdad6e1ff3afcea6bf6e468cf9948755c4427f6feef7b2e8c81

Download Submit
C:\hyperchainagent\Surrogaterefnet.exe

Filesize
2.3MB

MD5
dbf705ce9641d7783c9e867a15d463dc

SHA1
e14b23c79cdc102ef10cb35ce78e84a50e725549

SHA256
ca84510c38b5daf4723dd0f87379b68eb26a7192ed5f86f1ad21fead4c56c8b3

SHA512
4ad6c5f92a2e9630bd95c3a08d259ba1f3605067ed5c60b3ccc3568b4d4ff5a0a25856000bf73cdad6e1ff3afcea6bf6e468cf9948755c4427f6feef7b2e8c81

Download Submit
C:\hyperchainagent\hVasfh5Xz1.vbe

Filesize
218B

MD5
16389aa806a3fd9a2322e3fbcddacede

SHA1
03c06c620f9717650013b8d2c30ca4a67d4e1939

SHA256
f2e9cef08cce338bbc9d5eea18059a3df236f4ca5a050bce564a94347dbc1742

SHA512
9d04db24f78c9a947510e32196d31380db479425cf52752231e1b0df44da43356c7e010f3dd9c79a446b05ca61ec35fbb2de5762f221b7aa1d9555d71555ea91

Download Submit
\hyperchainagent\Surrogaterefnet.exe

Filesize
2.3MB

MD5
dbf705ce9641d7783c9e867a15d463dc

SHA1
e14b23c79cdc102ef10cb35ce78e84a50e725549

SHA256
ca84510c38b5daf4723dd0f87379b68eb26a7192ed5f86f1ad21fead4c56c8b3

SHA512
4ad6c5f92a2e9630bd95c3a08d259ba1f3605067ed5c60b3ccc3568b4d4ff5a0a25856000bf73cdad6e1ff3afcea6bf6e468cf9948755c4427f6feef7b2e8c81

Download Submit
\hyperchainagent\Surrogaterefnet.exe

Filesize
2.3MB

MD5
dbf705ce9641d7783c9e867a15d463dc

SHA1
e14b23c79cdc102ef10cb35ce78e84a50e725549

SHA256
ca84510c38b5daf4723dd0f87379b68eb26a7192ed5f86f1ad21fead4c56c8b3

SHA512
4ad6c5f92a2e9630bd95c3a08d259ba1f3605067ed5c60b3ccc3568b4d4ff5a0a25856000bf73cdad6e1ff3afcea6bf6e468cf9948755c4427f6feef7b2e8c81

Download Submit
memory/564-67-0x00000000003B0000-0x0000000000602000-memory.dmp

Filesize
2.3MB

Download
memory/564-69-0x00000000002D0000-0x00000000002DE000-memory.dmp

Filesize
56KB

Download
memory/564-75-0x00000000021F0000-0x00000000021F8000-memory.dmp

Filesize
32KB

Download
memory/564-76-0x0000000002200000-0x000000000220A000-memory.dmp

Filesize
40KB

Download
memory/564-73-0x00000000003A0000-0x00000000003AE000-memory.dmp

Filesize
56KB

Download
memory/564-72-0x00000000021A0000-0x00000000021F6000-memory.dmp

Filesize
344KB

Download
memory/564-71-0x0000000000380000-0x0000000000396000-memory.dmp

Filesize
88KB

Download
memory/564-68-0x000000001B1D0000-0x000000001B250000-memory.dmp

Filesize
512KB

Download
memory/564-74-0x0000000002110000-0x0000000002118000-memory.dmp

Filesize
32KB

Download
memory/564-70-0x0000000000360000-0x000000000037C000-memory.dmp

Filesize
112KB

Download
memory/760-168-0x0000000000A80000-0x0000000000CD2000-memory.dmp

Filesize
2.3MB

Download
memory/760-169-0x000000001AF70000-0x000000001AFF0000-memory.dmp

Filesize
512KB

Download
memory/760-170-0x000000001AF70000-0x000000001AFF0000-memory.dmp

Filesize
512KB

Download
memory/1112-132-0x000000001B190000-0x000000001B210000-memory.dmp

Filesize
512KB

Download
memory/1112-121-0x0000000000070000-0x00000000002C2000-memory.dmp

Filesize
2.3MB

Download