dcrat | 94b1ba15a35f137c8596a97f28241c496b61bccec7597ed2f2004510e47b4af1

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09-12-2024 01:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

94b1ba15a35f137c8596a97f28241c496b61bccec7597ed2f2004510e47b4af1.exe
Size

1.7MB
MD5

64f23bf509820aaebdd17acf6ee2215f
SHA1

98a5be357387e3951149c993b0fc3e8753a57709
SHA256

94b1ba15a35f137c8596a97f28241c496b61bccec7597ed2f2004510e47b4af1
SHA512

cd068260c8ba60ef50f461677141872f79e3f13c14977bba519a57848f3ec96af4823955f28c7cf0d1ce362f145d59284e6e2a71f33897f7f818eb44c7564f29
SSDEEP

49152:j+gYXZTD1VXUqzX7VwjvMoh1IFyuyigWnMzm6sDBKv:OTHUxUoh1IF9gl2

Score

10^/10

dcrat execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 30 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1780	4464	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2000	4464	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4036	4464	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3416	4464	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3076	4464	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2104	4464	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3648	4464	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2152	4464	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3844	4464	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4284	4464	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1884	4464	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3380	4464	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4068	4464	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4916	4464	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2376	4464	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4292	4464	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4200	4464	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2240	4464	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2844	4464	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4276	4464	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4424	4464	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2412	4464	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2096	4464	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4496	4464	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3980	4464	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2212	4464	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3112	4464	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5092	4464	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3208	4464	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2872	4464	schtasks.exe	85

DCRat payload 5 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/1116-1-0x0000000000780000-0x0000000000940000-memory.dmp	dcrat
behavioral2/files/0x000a000000023b4c-30.dat	dcrat
behavioral2/files/0x0011000000023b65-115.dat	dcrat
behavioral2/files/0x000e000000023b50-148.dat	dcrat
behavioral2/files/0x000c000000023b57-160.dat	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1436	powershell.exe
2092	powershell.exe
3308	powershell.exe
5072	powershell.exe
64	powershell.exe
1008	powershell.exe
2616	powershell.exe
1184	powershell.exe
5056	powershell.exe
4508	powershell.exe
2224	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	94b1ba15a35f137c8596a97f28241c496b61bccec7597ed2f2004510e47b4af1.exe

Checks computer location settings 2 TTPs 9 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	sihost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	sihost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	94b1ba15a35f137c8596a97f28241c496b61bccec7597ed2f2004510e47b4af1.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	sihost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	sihost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	sihost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	sihost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	sihost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	sihost.exe

Executes dropped EXE 8 IoCs

pid	Process
644	sihost.exe
3896	sihost.exe
2508	sihost.exe
4516	sihost.exe
3648	sihost.exe
452	sihost.exe
2544	sihost.exe
3132	sihost.exe

Drops file in Program Files directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Windows Multimedia Platform\RCX8FBE.tmp	94b1ba15a35f137c8596a97f28241c496b61bccec7597ed2f2004510e47b4af1.exe
File opened for modification	C:\Program Files\Windows Multimedia Platform\spoolsv.exe	94b1ba15a35f137c8596a97f28241c496b61bccec7597ed2f2004510e47b4af1.exe
File opened for modification	C:\Program Files\Uninstall Information\RCX9540.tmp	94b1ba15a35f137c8596a97f28241c496b61bccec7597ed2f2004510e47b4af1.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\66fc9ff0ee96c2	94b1ba15a35f137c8596a97f28241c496b61bccec7597ed2f2004510e47b4af1.exe
File created	C:\Program Files\Uninstall Information\StartMenuExperienceHost.exe	94b1ba15a35f137c8596a97f28241c496b61bccec7597ed2f2004510e47b4af1.exe
File created	C:\Program Files\Uninstall Information\55b276f4edf653	94b1ba15a35f137c8596a97f28241c496b61bccec7597ed2f2004510e47b4af1.exe
File opened for modification	C:\Program Files\Uninstall Information\RCX94C2.tmp	94b1ba15a35f137c8596a97f28241c496b61bccec7597ed2f2004510e47b4af1.exe
File created	C:\Program Files\Windows Multimedia Platform\f3b6ecef712a24	94b1ba15a35f137c8596a97f28241c496b61bccec7597ed2f2004510e47b4af1.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\RCX8459.tmp	94b1ba15a35f137c8596a97f28241c496b61bccec7597ed2f2004510e47b4af1.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\sihost.exe	94b1ba15a35f137c8596a97f28241c496b61bccec7597ed2f2004510e47b4af1.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\sihost.exe	94b1ba15a35f137c8596a97f28241c496b61bccec7597ed2f2004510e47b4af1.exe
File created	C:\Program Files\Windows Multimedia Platform\spoolsv.exe	94b1ba15a35f137c8596a97f28241c496b61bccec7597ed2f2004510e47b4af1.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\RCX8469.tmp	94b1ba15a35f137c8596a97f28241c496b61bccec7597ed2f2004510e47b4af1.exe
File opened for modification	C:\Program Files\Windows Multimedia Platform\RCX8FBD.tmp	94b1ba15a35f137c8596a97f28241c496b61bccec7597ed2f2004510e47b4af1.exe
File opened for modification	C:\Program Files\Uninstall Information\StartMenuExperienceHost.exe	94b1ba15a35f137c8596a97f28241c496b61bccec7597ed2f2004510e47b4af1.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\dllhost.exe	94b1ba15a35f137c8596a97f28241c496b61bccec7597ed2f2004510e47b4af1.exe
File created	C:\Windows\BitLockerDiscoveryVolumeContents\RuntimeBroker.exe	94b1ba15a35f137c8596a97f28241c496b61bccec7597ed2f2004510e47b4af1.exe
File created	C:\Windows\BitLockerDiscoveryVolumeContents\9e8d7a4ca61bd9	94b1ba15a35f137c8596a97f28241c496b61bccec7597ed2f2004510e47b4af1.exe
File opened for modification	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\RCX7FFF.tmp	94b1ba15a35f137c8596a97f28241c496b61bccec7597ed2f2004510e47b4af1.exe
File opened for modification	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\RCX8010.tmp	94b1ba15a35f137c8596a97f28241c496b61bccec7597ed2f2004510e47b4af1.exe
File opened for modification	C:\Windows\BitLockerDiscoveryVolumeContents\RCX8224.tmp	94b1ba15a35f137c8596a97f28241c496b61bccec7597ed2f2004510e47b4af1.exe
File created	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\dllhost.exe	94b1ba15a35f137c8596a97f28241c496b61bccec7597ed2f2004510e47b4af1.exe
File created	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\5940a34987c991	94b1ba15a35f137c8596a97f28241c496b61bccec7597ed2f2004510e47b4af1.exe
File created	C:\Windows\LanguageOverlayCache\lsass.exe	94b1ba15a35f137c8596a97f28241c496b61bccec7597ed2f2004510e47b4af1.exe
File opened for modification	C:\Windows\BitLockerDiscoveryVolumeContents\RCX8235.tmp	94b1ba15a35f137c8596a97f28241c496b61bccec7597ed2f2004510e47b4af1.exe
File opened for modification	C:\Windows\BitLockerDiscoveryVolumeContents\RuntimeBroker.exe	94b1ba15a35f137c8596a97f28241c496b61bccec7597ed2f2004510e47b4af1.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	94b1ba15a35f137c8596a97f28241c496b61bccec7597ed2f2004510e47b4af1.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	sihost.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 30 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2376	schtasks.exe
2240	schtasks.exe
4424	schtasks.exe
3416	schtasks.exe
3076	schtasks.exe
2152	schtasks.exe
4276	schtasks.exe
1780	schtasks.exe
2000	schtasks.exe
2104	schtasks.exe
4292	schtasks.exe
2212	schtasks.exe
4036	schtasks.exe
3380	schtasks.exe
4200	schtasks.exe
3112	schtasks.exe
3844	schtasks.exe
4068	schtasks.exe
2844	schtasks.exe
4496	schtasks.exe
2872	schtasks.exe
4284	schtasks.exe
2412	schtasks.exe
5092	schtasks.exe
1884	schtasks.exe
4916	schtasks.exe
3208	schtasks.exe
3648	schtasks.exe
2096	schtasks.exe
3980	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1116	94b1ba15a35f137c8596a97f28241c496b61bccec7597ed2f2004510e47b4af1.exe
1116	94b1ba15a35f137c8596a97f28241c496b61bccec7597ed2f2004510e47b4af1.exe
1116	94b1ba15a35f137c8596a97f28241c496b61bccec7597ed2f2004510e47b4af1.exe
1116	94b1ba15a35f137c8596a97f28241c496b61bccec7597ed2f2004510e47b4af1.exe
1116	94b1ba15a35f137c8596a97f28241c496b61bccec7597ed2f2004510e47b4af1.exe
1116	94b1ba15a35f137c8596a97f28241c496b61bccec7597ed2f2004510e47b4af1.exe
1116	94b1ba15a35f137c8596a97f28241c496b61bccec7597ed2f2004510e47b4af1.exe
1116	94b1ba15a35f137c8596a97f28241c496b61bccec7597ed2f2004510e47b4af1.exe
1116	94b1ba15a35f137c8596a97f28241c496b61bccec7597ed2f2004510e47b4af1.exe
1116	94b1ba15a35f137c8596a97f28241c496b61bccec7597ed2f2004510e47b4af1.exe
1116	94b1ba15a35f137c8596a97f28241c496b61bccec7597ed2f2004510e47b4af1.exe
1116	94b1ba15a35f137c8596a97f28241c496b61bccec7597ed2f2004510e47b4af1.exe
1116	94b1ba15a35f137c8596a97f28241c496b61bccec7597ed2f2004510e47b4af1.exe
1116	94b1ba15a35f137c8596a97f28241c496b61bccec7597ed2f2004510e47b4af1.exe
1116	94b1ba15a35f137c8596a97f28241c496b61bccec7597ed2f2004510e47b4af1.exe
1116	94b1ba15a35f137c8596a97f28241c496b61bccec7597ed2f2004510e47b4af1.exe
1116	94b1ba15a35f137c8596a97f28241c496b61bccec7597ed2f2004510e47b4af1.exe
1116	94b1ba15a35f137c8596a97f28241c496b61bccec7597ed2f2004510e47b4af1.exe
1116	94b1ba15a35f137c8596a97f28241c496b61bccec7597ed2f2004510e47b4af1.exe
1116	94b1ba15a35f137c8596a97f28241c496b61bccec7597ed2f2004510e47b4af1.exe
1116	94b1ba15a35f137c8596a97f28241c496b61bccec7597ed2f2004510e47b4af1.exe
1116	94b1ba15a35f137c8596a97f28241c496b61bccec7597ed2f2004510e47b4af1.exe
1116	94b1ba15a35f137c8596a97f28241c496b61bccec7597ed2f2004510e47b4af1.exe
1116	94b1ba15a35f137c8596a97f28241c496b61bccec7597ed2f2004510e47b4af1.exe
1116	94b1ba15a35f137c8596a97f28241c496b61bccec7597ed2f2004510e47b4af1.exe
1116	94b1ba15a35f137c8596a97f28241c496b61bccec7597ed2f2004510e47b4af1.exe
1116	94b1ba15a35f137c8596a97f28241c496b61bccec7597ed2f2004510e47b4af1.exe
1116	94b1ba15a35f137c8596a97f28241c496b61bccec7597ed2f2004510e47b4af1.exe
1116	94b1ba15a35f137c8596a97f28241c496b61bccec7597ed2f2004510e47b4af1.exe
1116	94b1ba15a35f137c8596a97f28241c496b61bccec7597ed2f2004510e47b4af1.exe
1116	94b1ba15a35f137c8596a97f28241c496b61bccec7597ed2f2004510e47b4af1.exe
1116	94b1ba15a35f137c8596a97f28241c496b61bccec7597ed2f2004510e47b4af1.exe
1116	94b1ba15a35f137c8596a97f28241c496b61bccec7597ed2f2004510e47b4af1.exe
1116	94b1ba15a35f137c8596a97f28241c496b61bccec7597ed2f2004510e47b4af1.exe
1116	94b1ba15a35f137c8596a97f28241c496b61bccec7597ed2f2004510e47b4af1.exe
1116	94b1ba15a35f137c8596a97f28241c496b61bccec7597ed2f2004510e47b4af1.exe
1116	94b1ba15a35f137c8596a97f28241c496b61bccec7597ed2f2004510e47b4af1.exe
1116	94b1ba15a35f137c8596a97f28241c496b61bccec7597ed2f2004510e47b4af1.exe
1116	94b1ba15a35f137c8596a97f28241c496b61bccec7597ed2f2004510e47b4af1.exe
1116	94b1ba15a35f137c8596a97f28241c496b61bccec7597ed2f2004510e47b4af1.exe
1116	94b1ba15a35f137c8596a97f28241c496b61bccec7597ed2f2004510e47b4af1.exe
1116	94b1ba15a35f137c8596a97f28241c496b61bccec7597ed2f2004510e47b4af1.exe
1116	94b1ba15a35f137c8596a97f28241c496b61bccec7597ed2f2004510e47b4af1.exe
5072	powershell.exe
5072	powershell.exe
64	powershell.exe
64	powershell.exe
1184	powershell.exe
1184	powershell.exe
2224	powershell.exe
2224	powershell.exe
2092	powershell.exe
2092	powershell.exe
4508	powershell.exe
4508	powershell.exe
1008	powershell.exe
1008	powershell.exe
3308	powershell.exe
3308	powershell.exe
1436	powershell.exe
1436	powershell.exe
5056	powershell.exe
5056	powershell.exe
5056	powershell.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	1116	94b1ba15a35f137c8596a97f28241c496b61bccec7597ed2f2004510e47b4af1.exe
Token: SeDebugPrivilege	5072	powershell.exe
Token: SeDebugPrivilege	64	powershell.exe
Token: SeDebugPrivilege	1184	powershell.exe
Token: SeDebugPrivilege	5056	powershell.exe
Token: SeDebugPrivilege	2224	powershell.exe
Token: SeDebugPrivilege	2092	powershell.exe
Token: SeDebugPrivilege	4508	powershell.exe
Token: SeDebugPrivilege	1008	powershell.exe
Token: SeDebugPrivilege	3308	powershell.exe
Token: SeDebugPrivilege	1436	powershell.exe
Token: SeDebugPrivilege	644	sihost.exe
Token: SeDebugPrivilege	3896	sihost.exe
Token: SeDebugPrivilege	2508	sihost.exe
Token: SeDebugPrivilege	4516	sihost.exe
Token: SeDebugPrivilege	3648	sihost.exe
Token: SeDebugPrivilege	452	sihost.exe
Token: SeDebugPrivilege	2544	sihost.exe
Token: SeDebugPrivilege	3132	sihost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1116 wrote to memory of 3308	1116	94b1ba15a35f137c8596a97f28241c496b61bccec7597ed2f2004510e47b4af1.exe	117
PID 1116 wrote to memory of 3308	1116	94b1ba15a35f137c8596a97f28241c496b61bccec7597ed2f2004510e47b4af1.exe	117
PID 1116 wrote to memory of 5072	1116	94b1ba15a35f137c8596a97f28241c496b61bccec7597ed2f2004510e47b4af1.exe	118
PID 1116 wrote to memory of 5072	1116	94b1ba15a35f137c8596a97f28241c496b61bccec7597ed2f2004510e47b4af1.exe	118
PID 1116 wrote to memory of 64	1116	94b1ba15a35f137c8596a97f28241c496b61bccec7597ed2f2004510e47b4af1.exe	119
PID 1116 wrote to memory of 64	1116	94b1ba15a35f137c8596a97f28241c496b61bccec7597ed2f2004510e47b4af1.exe	119
PID 1116 wrote to memory of 1008	1116	94b1ba15a35f137c8596a97f28241c496b61bccec7597ed2f2004510e47b4af1.exe	120
PID 1116 wrote to memory of 1008	1116	94b1ba15a35f137c8596a97f28241c496b61bccec7597ed2f2004510e47b4af1.exe	120
PID 1116 wrote to memory of 1184	1116	94b1ba15a35f137c8596a97f28241c496b61bccec7597ed2f2004510e47b4af1.exe	121
PID 1116 wrote to memory of 1184	1116	94b1ba15a35f137c8596a97f28241c496b61bccec7597ed2f2004510e47b4af1.exe	121
PID 1116 wrote to memory of 1436	1116	94b1ba15a35f137c8596a97f28241c496b61bccec7597ed2f2004510e47b4af1.exe	122
PID 1116 wrote to memory of 1436	1116	94b1ba15a35f137c8596a97f28241c496b61bccec7597ed2f2004510e47b4af1.exe	122
PID 1116 wrote to memory of 5056	1116	94b1ba15a35f137c8596a97f28241c496b61bccec7597ed2f2004510e47b4af1.exe	123
PID 1116 wrote to memory of 5056	1116	94b1ba15a35f137c8596a97f28241c496b61bccec7597ed2f2004510e47b4af1.exe	123
PID 1116 wrote to memory of 4508	1116	94b1ba15a35f137c8596a97f28241c496b61bccec7597ed2f2004510e47b4af1.exe	124
PID 1116 wrote to memory of 4508	1116	94b1ba15a35f137c8596a97f28241c496b61bccec7597ed2f2004510e47b4af1.exe	124
PID 1116 wrote to memory of 2092	1116	94b1ba15a35f137c8596a97f28241c496b61bccec7597ed2f2004510e47b4af1.exe	125
PID 1116 wrote to memory of 2092	1116	94b1ba15a35f137c8596a97f28241c496b61bccec7597ed2f2004510e47b4af1.exe	125
PID 1116 wrote to memory of 2224	1116	94b1ba15a35f137c8596a97f28241c496b61bccec7597ed2f2004510e47b4af1.exe	126
PID 1116 wrote to memory of 2224	1116	94b1ba15a35f137c8596a97f28241c496b61bccec7597ed2f2004510e47b4af1.exe	126
PID 1116 wrote to memory of 2616	1116	94b1ba15a35f137c8596a97f28241c496b61bccec7597ed2f2004510e47b4af1.exe	127
PID 1116 wrote to memory of 2616	1116	94b1ba15a35f137c8596a97f28241c496b61bccec7597ed2f2004510e47b4af1.exe	127
PID 1116 wrote to memory of 3004	1116	94b1ba15a35f137c8596a97f28241c496b61bccec7597ed2f2004510e47b4af1.exe	139
PID 1116 wrote to memory of 3004	1116	94b1ba15a35f137c8596a97f28241c496b61bccec7597ed2f2004510e47b4af1.exe	139
PID 3004 wrote to memory of 2380	3004	cmd.exe	141
PID 3004 wrote to memory of 2380	3004	cmd.exe	141
PID 3004 wrote to memory of 644	3004	cmd.exe	148
PID 3004 wrote to memory of 644	3004	cmd.exe	148
PID 644 wrote to memory of 1780	644	sihost.exe	152
PID 644 wrote to memory of 1780	644	sihost.exe	152
PID 644 wrote to memory of 3544	644	sihost.exe	153
PID 644 wrote to memory of 3544	644	sihost.exe	153
PID 1780 wrote to memory of 3896	1780	WScript.exe	159
PID 1780 wrote to memory of 3896	1780	WScript.exe	159
PID 3896 wrote to memory of 4924	3896	sihost.exe	163
PID 3896 wrote to memory of 4924	3896	sihost.exe	163
PID 3896 wrote to memory of 3452	3896	sihost.exe	164
PID 3896 wrote to memory of 3452	3896	sihost.exe	164
PID 4924 wrote to memory of 2508	4924	WScript.exe	166
PID 4924 wrote to memory of 2508	4924	WScript.exe	166
PID 2508 wrote to memory of 4908	2508	sihost.exe	168
PID 2508 wrote to memory of 4908	2508	sihost.exe	168
PID 2508 wrote to memory of 4108	2508	sihost.exe	169
PID 2508 wrote to memory of 4108	2508	sihost.exe	169
PID 4908 wrote to memory of 4516	4908	WScript.exe	171
PID 4908 wrote to memory of 4516	4908	WScript.exe	171
PID 4516 wrote to memory of 1532	4516	sihost.exe	173
PID 4516 wrote to memory of 1532	4516	sihost.exe	173
PID 4516 wrote to memory of 3724	4516	sihost.exe	174
PID 4516 wrote to memory of 3724	4516	sihost.exe	174
PID 1532 wrote to memory of 3648	1532	WScript.exe	175
PID 1532 wrote to memory of 3648	1532	WScript.exe	175
PID 3648 wrote to memory of 2856	3648	sihost.exe	177
PID 3648 wrote to memory of 2856	3648	sihost.exe	177
PID 3648 wrote to memory of 3308	3648	sihost.exe	178
PID 3648 wrote to memory of 3308	3648	sihost.exe	178
PID 2856 wrote to memory of 452	2856	WScript.exe	180
PID 2856 wrote to memory of 452	2856	WScript.exe	180
PID 452 wrote to memory of 3376	452	sihost.exe	182
PID 452 wrote to memory of 3376	452	sihost.exe	182
PID 452 wrote to memory of 4184	452	sihost.exe	183
PID 452 wrote to memory of 4184	452	sihost.exe	183
PID 3376 wrote to memory of 2544	3376	WScript.exe	184
PID 3376 wrote to memory of 2544	3376	WScript.exe	184

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\94b1ba15a35f137c8596a97f28241c496b61bccec7597ed2f2004510e47b4af1.exe
"C:\Users\Admin\AppData\Local\Temp\94b1ba15a35f137c8596a97f28241c496b61bccec7597ed2f2004510e47b4af1.exe"
1⤵
- Drops file in Drivers directory
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1116
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3308
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5072
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:64
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1008
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1184
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1436
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5056
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4508
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2092
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2224
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2616
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\uCD7w8UeNy.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3004
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:2380
- - C:\Program Files (x86)\Reference Assemblies\Microsoft\sihost.exe
    "C:\Program Files (x86)\Reference Assemblies\Microsoft\sihost.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:644
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fb76ff11-669a-45e5-b148-b772f7eba766.vbs"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1780
    - - C:\Program Files (x86)\Reference Assemblies\Microsoft\sihost.exe
        
        "C:\Program Files (x86)\Reference Assemblies\Microsoft\sihost.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3896
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ac91d755-99ca-49c5-82e1-eadc53f6b6e5.vbs"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4924
        
        C:\Program Files (x86)\Reference Assemblies\Microsoft\sihost.exe
        
        "C:\Program Files (x86)\Reference Assemblies\Microsoft\sihost.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2508
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e2f62d5f-ff75-45a1-8aff-b255d64e5036.vbs"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:4908
        
        C:\Program Files (x86)\Reference Assemblies\Microsoft\sihost.exe
        
        "C:\Program Files (x86)\Reference Assemblies\Microsoft\sihost.exe"
        9⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4516
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3f6467bd-0820-4704-9c82-144fcb0392c6.vbs"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:1532
        
        C:\Program Files (x86)\Reference Assemblies\Microsoft\sihost.exe
        
        "C:\Program Files (x86)\Reference Assemblies\Microsoft\sihost.exe"
        11⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3648
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9e749f91-d519-4075-8891-8888551cb0d8.vbs"
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:2856
        
        C:\Program Files (x86)\Reference Assemblies\Microsoft\sihost.exe
        
        "C:\Program Files (x86)\Reference Assemblies\Microsoft\sihost.exe"
        13⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:452
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2d1898b0-9742-4aff-8e9e-8c7a7bf2653c.vbs"
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:3376
        
        C:\Program Files (x86)\Reference Assemblies\Microsoft\sihost.exe
        
        "C:\Program Files (x86)\Reference Assemblies\Microsoft\sihost.exe"
        15⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:2544
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8b24ab97-e821-475a-b809-da9283d09b97.vbs"
        16⤵
        
        PID:4276
        
        C:\Program Files (x86)\Reference Assemblies\Microsoft\sihost.exe
        
        "C:\Program Files (x86)\Reference Assemblies\Microsoft\sihost.exe"
        17⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:3132
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bcce0a1a-66a7-4638-8648-a4ec2f9c09c4.vbs"
        18⤵
        
        PID:5100
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\26fc9efc-7152-4ebe-bfdc-d28bf9dc988d.vbs"
        18⤵
        
        PID:1764
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b11d0251-f3cd-4340-addf-dcc064ffa3f9.vbs"
        16⤵
        
        PID:3676
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2fc53564-7a6e-4c4e-a373-0b86a5576d0b.vbs"
        14⤵
        
        PID:4184
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9f6b7481-5a93-4bdf-8c5f-44e05061d7a4.vbs"
        12⤵
        
        PID:3308
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d686678f-d88e-42d1-94a9-9c6473b9cb4e.vbs"
        10⤵
        
        PID:3724
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\97ed994f-7dcf-48c8-a32c-7869647b50ab.vbs"
        8⤵
        
        PID:4108
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c6e3e65b-7dec-4798-8804-9f9113d89de3.vbs"
        6⤵
        
        PID:3452
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\04cdaaa7-6856-4e81-8c92-31ae7e3d3c61.vbs"
      4⤵
      PID:3544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Windows\BitLockerDiscoveryVolumeContents\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\BitLockerDiscoveryVolumeContents\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Windows\BitLockerDiscoveryVolumeContents\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2152

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 8 /tr "'C:\Users\Default\Favorites\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Users\Default\Favorites\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 10 /tr "'C:\Users\Default\Favorites\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 13 /tr "'C:\Users\Default User\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Users\Default User\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 6 /tr "'C:\Users\Default User\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2240

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\Users\Public\Libraries\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Users\Public\Libraries\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4276

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 10 /tr "'C:\Users\Public\Libraries\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4424

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Multimedia Platform\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files\Windows Multimedia Platform\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2096

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Multimedia Platform\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Users\Public\AccountPictures\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Public\AccountPictures\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2212

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Users\Public\AccountPictures\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 14 /tr "'C:\Program Files\Uninstall Information\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 13 /tr "'C:\Program Files\Uninstall Information\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Uninstall Information\StartMenuExperienceHost.exe

Filesize
1.7MB

MD5
4c006f01c3d17f792f2e8f0a28407bd0

SHA1
10a580d3a4a4ea150efba96d24ea8fdc7d43d307

SHA256
5e2f4930a3fe4ca86ba5f485b80768ce7d0f6591088455fc888662033d1b36bf

SHA512
e4651dd8de73366a64814c37fa8db82825c095aa83ed153e941329dd58c7a32a2c7547b57a41978a95302b2ac1c795fe806d2e4cd6099b522cbfc798fee002bc

Download Submit
C:\Recovery\WindowsRE\RuntimeBroker.exe

Filesize
1.7MB

MD5
64f23bf509820aaebdd17acf6ee2215f

SHA1
98a5be357387e3951149c993b0fc3e8753a57709

SHA256
94b1ba15a35f137c8596a97f28241c496b61bccec7597ed2f2004510e47b4af1

SHA512
cd068260c8ba60ef50f461677141872f79e3f13c14977bba519a57848f3ec96af4823955f28c7cf0d1ce362f145d59284e6e2a71f33897f7f818eb44c7564f29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\sihost.exe.log

Filesize
1KB

MD5
4a667f150a4d1d02f53a9f24d89d53d1

SHA1
306e125c9edce66f28fdb63e6c4ca5c9ad6e8c97

SHA256
414659decfd237dde09625a49811e03b5b30ee06ee2ee97ea8bcfac394d281fd

SHA512
4edd8e73ce03488a6d92750a782cd4042fbb54a5b3f8d8ba3ea227fda0653c2cd84f0c5d64976c7cdc1f518a2fdc8ff10e2a015ec7acf3cd01b0d62bc98542d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6d42b6da621e8df5674e26b799c8e2aa

SHA1
ab3ce1327ea1eeedb987ec823d5e0cb146bafa48

SHA256
5ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c

SHA512
53faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
2e907f77659a6601fcc408274894da2e

SHA1
9f5b72abef1cd7145bf37547cdb1b9254b4efe9d

SHA256
385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233

SHA512
34fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
cadef9abd087803c630df65264a6c81c

SHA1
babbf3636c347c8727c35f3eef2ee643dbcc4bd2

SHA256
cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

SHA512
7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

Download Submit
C:\Users\Admin\AppData\Local\Temp\04cdaaa7-6856-4e81-8c92-31ae7e3d3c61.vbs

Filesize
516B

MD5
e2be314a4c447d122a2d1a9be75a42b5

SHA1
96339d7452332f3cf9a909ce13da3e8393ca23e5

SHA256
ac3dd2fa1f22faef9e40a938b0ca149054ab46ef9d1ed95c5eb65f112b228d5c

SHA512
9c3c77827acf896c79ecead438b16d396dd68df7c0b4074df8c40f61e709b8bf7b64e46a57363460e65b00e667a6d0babc005d1592907cc21cbd72e58b5313c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\2d1898b0-9742-4aff-8e9e-8c7a7bf2653c.vbs

Filesize
739B

MD5
9124a6855bf4268a5162ca33d6164d44

SHA1
2c532db65d4592f004c7cbd672e8766e6a2460c1

SHA256
5486d28f32d92864504c5334dbda2f406edef1b19ad9e187eda0a7242bd43a02

SHA512
c909ac5e4f6766f93f3f452119b09db133a895915a695f47335554b7ea87d37a6d5bc694230ed6332c8fb8b4561f1c29b8ce6b5a1d204ff4e3e4ae3100080e28

Download Submit
C:\Users\Admin\AppData\Local\Temp\3f6467bd-0820-4704-9c82-144fcb0392c6.vbs

Filesize
740B

MD5
c59ac717a857a05c35b0b67ff0f86f20

SHA1
e11a20acdbef4fbe5265442968767b94e12640c6

SHA256
91567a9b54170923f8c16f2fd9e6fea2ed798a08615e13f8c885cdb6916704e3

SHA512
a067b6a2a2a3133c5a2482faec7ea45a710e96cb890ab76ca6a6bf13eef89119f97e081fd1b88a05cee4362697a510b5f05856fe3a00d3abcb6fda938ae25620

Download Submit
C:\Users\Admin\AppData\Local\Temp\8b24ab97-e821-475a-b809-da9283d09b97.vbs

Filesize
740B

MD5
845e04e07d9e870c265d4e61c8c7a75c

SHA1
0c7ab00de6660ab95b8090b5949f27f2453d718e

SHA256
d7dc6b190fdd5940a8aa4267a8ce761988e765bea0f71a0c67934e7e1b058ce3

SHA512
491ccc505fed02b679ac110763da66beb779613b3f859b42e3cb5282e9a3c0a79ec117cd5af012e5c04839619d75bd7b20566733e7aa9c664ed12b24028c7326

Download Submit
C:\Users\Admin\AppData\Local\Temp\9e749f91-d519-4075-8891-8888551cb0d8.vbs

Filesize
740B

MD5
c086f954482d40bf55949db0dde220c6

SHA1
86d0abec236fe6da04fdb4950b2102896539b9b8

SHA256
ac6d48ee175d1fab90668763c9153927a7d9d9d35fbcd9a1693ee9b9d3245a62

SHA512
2a55d5b8ec3c63e498e71f89c347a16c3b677eaae84e144162bbdf049a5cad6a184354bfd61f80b952d19924582a4350976d624d6eefa8c44041dd81b5d05069

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wdj1xepk.13j.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\ac91d755-99ca-49c5-82e1-eadc53f6b6e5.vbs

Filesize
740B

MD5
458c444dac7465bffc435a3b762b258f

SHA1
8d17b5a24c73c0e42ce685a18e2008e09e1b0628

SHA256
8d930740d59463fc29d4b782cb3f1b1d0f7483175ba494e70cde98ced0df7c5e

SHA512
aa98a1699ccb333d101677242457219165f034e07d87ec2307eb7f58cc0431b0c5289d141db76ea1e88e3104590ffc79dc0943c7f53134190a1cc1dad6a4c107

Download Submit
C:\Users\Admin\AppData\Local\Temp\bcce0a1a-66a7-4638-8648-a4ec2f9c09c4.vbs

Filesize
740B

MD5
6255f59b594ca3cd9e096ae401fa9b28

SHA1
5e61dc8f0bf72b703e93f58c35c409a3630eead6

SHA256
c267727f6bed66f4e165cd589973afc96193f4247a6bfaf83eb35e8443ba1388

SHA512
4e5138de07ffeceb2744409f23c4f719dfe10d3301143142b010d58dc9d7b5b6dd1a604fce1ec7971d257238ed4867cdfe0687687c50d8528dcf8e46a8692b7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\e2f62d5f-ff75-45a1-8aff-b255d64e5036.vbs

Filesize
740B

MD5
0a7999bf0e968c045dd67cc6556defb3

SHA1
a28330d2de10dc189ebfedca8439b502c7967404

SHA256
c5f60994007053d955116fedb28c9bdb3d49a2b6017a5d674cd3fef0941c4739

SHA512
4cbfd5d1460f95801c5e50a6827beee9b3f73da0539d24ab6c8fc8df7f092a5af412f8484b3d0d1e1b9e94354a622e327617f9d9475b3089c851b2c2156057c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\fb76ff11-669a-45e5-b148-b772f7eba766.vbs

Filesize
739B

MD5
55f9779cb7df722aa946fdd0994f74f0

SHA1
3f23febafa22cf98f28f3cd2d128a97f528718a6

SHA256
1f36daf944b8bd23f9d94ecfa9e321a30c363be130cbd0facecc457e12774687

SHA512
da2c0049464e1b572c677b7daf9edfaa4ae938d609183b41c1f0b57de031b1d50b368ae408f83644c1fc6f31217c0e1c5ea73b58bcd11228007a47a4f12b028f

Download Submit
C:\Users\Admin\AppData\Local\Temp\uCD7w8UeNy.bat

Filesize
229B

MD5
d318fbb9c2cd70d7fc21c07784a68a5f

SHA1
29e2674ef6c3d35b7bc22ef107d46bce4ef02373

SHA256
e479aca43a3656b57eb93a102a0c73f82f7edf956736073abb684945e80dd39c

SHA512
49301c034a958d1464cea349b94cb510c846b4b18b3bdd1c81c5632f90b8b84aa6a6842b89662d60e39d89629d7420540535bd9f0992032506fafb3bfda1d218

Download Submit
C:\Users\Default\SppExtComObj.exe

Filesize
1.7MB

MD5
74ccf904aca783d40ffcf1262c04e3c5

SHA1
e5d2b5e9551ad413ce3100778a81c545453831da

SHA256
bef0ada34b689c15deb2d2bc2a8d5a2d1cd294973c2352f1b87acf1d17c174ab

SHA512
a3837bc54899060a68ba8cafc16357b154ddc92b322081fd313ca03bcffc23bfe8cf8f0b138d6fde1d4b0f0753c7cc122e185b7d81972473714c9f6b40fa9814

Download Submit
C:\Users\Public\AccountPictures\csrss.exe

Filesize
1.7MB

MD5
c4574fa1dfede16638d71b3fa2570537

SHA1
2f2aaa2a10035e3b173a6babc9c81b8355d03277

SHA256
03d88cb1234fa9e30480bb246bfe818c38d946d41c457056288109220e7166d0

SHA512
5bc1a2e3dc56d4956a799fbdbf2a1047241e42f8f079810c8e9a2ce6742575e7a7b5bdfc85db14d530d8cc770ec86af994be2fd0a8e189a561f64b4e04ad064e

Download Submit
memory/1116-7-0x0000000002AB0000-0x0000000002AC6000-memory.dmp

Filesize
88KB

Download
memory/1116-15-0x000000001BD70000-0x000000001BD7A000-memory.dmp

Filesize
40KB

Download
memory/1116-13-0x000000001C190000-0x000000001C6B8000-memory.dmp

Filesize
5.2MB

Download
memory/1116-151-0x00007FFD8F053000-0x00007FFD8F055000-memory.dmp

Filesize
8KB

Download
memory/1116-12-0x000000001BC30000-0x000000001BC42000-memory.dmp

Filesize
72KB

Download
memory/1116-1-0x0000000000780000-0x0000000000940000-memory.dmp

Filesize
1.8MB

Download
memory/1116-16-0x000000001BD80000-0x000000001BD8E000-memory.dmp

Filesize
56KB

Download
memory/1116-10-0x0000000002AF0000-0x0000000002AF8000-memory.dmp

Filesize
32KB

Download
memory/1116-19-0x000000001BEB0000-0x000000001BEBC000-memory.dmp

Filesize
48KB

Download
memory/1116-17-0x000000001BD90000-0x000000001BD98000-memory.dmp

Filesize
32KB

Download
memory/1116-18-0x000000001BEA0000-0x000000001BEAC000-memory.dmp

Filesize
48KB

Download
memory/1116-14-0x000000001BC60000-0x000000001BC6C000-memory.dmp

Filesize
48KB

Download
memory/1116-22-0x00007FFD8F050000-0x00007FFD8FB11000-memory.dmp

Filesize
10.8MB

Download
memory/1116-0-0x00007FFD8F053000-0x00007FFD8F055000-memory.dmp

Filesize
8KB

Download
memory/1116-175-0x00007FFD8F050000-0x00007FFD8FB11000-memory.dmp

Filesize
10.8MB

Download
memory/1116-9-0x0000000002AE0000-0x0000000002AEC000-memory.dmp

Filesize
48KB

Download
memory/1116-4-0x000000001BBE0000-0x000000001BC30000-memory.dmp

Filesize
320KB

Download
memory/1116-23-0x00007FFD8F050000-0x00007FFD8FB11000-memory.dmp

Filesize
10.8MB

Download
memory/1116-2-0x00007FFD8F050000-0x00007FFD8FB11000-memory.dmp

Filesize
10.8MB

Download
memory/1116-8-0x0000000002AD0000-0x0000000002AE0000-memory.dmp

Filesize
64KB

Download
memory/1116-5-0x0000000002A90000-0x0000000002A98000-memory.dmp

Filesize
32KB

Download
memory/1116-6-0x0000000002AA0000-0x0000000002AB0000-memory.dmp

Filesize
64KB

Download
memory/1116-3-0x0000000002A70000-0x0000000002A8C000-memory.dmp

Filesize
112KB

Download
memory/2508-310-0x000000001B830000-0x000000001B842000-memory.dmp

Filesize
72KB

Download
memory/5072-174-0x00000221EE680000-0x00000221EE6A2000-memory.dmp

Filesize
136KB

Download