dcrat | 95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11-12-2024 11:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe
Size

1.7MB
MD5

68a655281c115869e423c1d7f5bea01d
SHA1

8193dcbfd44ca6bad7dd4c5824f9e0d4495220c2
SHA256

95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d
SHA512

c72d216bc5172e259226c624023aaf869cfdbebb29b2aa8421a15363f9c3c29acedb3436dbb829afce50aa13935f06c6baf40b3523c912ded39fb82f9b21c1db
SSDEEP

49152:D+gYXZTD1VXUqzX7VwjvMoh1IFyuyigWnMzm6sDBKvS:uTHUxUoh1IF9gl2d

Score

10^/10

dcrat execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 33 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2716	2680	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2796	2680	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2816	2680	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2720	2680	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2852	2680	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2840	2680	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2628	2680	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2828	2680	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2644	2680	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2640	2680	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3012	2680	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2156	2680	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	644	2680	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	732	2680	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1808	2680	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1172	2680	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2892	2680	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3008	2680	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2088	2680	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2432	2680	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1976	2680	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3000	2680	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2864	2680	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1652	2680	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1288	2680	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2472	2680	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1772	2680	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2412	2680	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2132	2680	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	320	2680	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	356	2680	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2556	2680	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2052	2680	schtasks.exe	30

DCRat payload 11 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/memory/2508-1-0x0000000001080000-0x0000000001240000-memory.dmp	dcrat
behavioral1/files/0x0005000000019408-27.dat	dcrat
behavioral1/files/0x000c000000016d46-113.dat	dcrat
behavioral1/files/0x00070000000194b4-122.dat	dcrat
behavioral1/files/0x00080000000194ea-147.dat	dcrat
behavioral1/memory/968-244-0x0000000001320000-0x00000000014E0000-memory.dmp	dcrat
behavioral1/memory/2572-267-0x00000000002C0000-0x0000000000480000-memory.dmp	dcrat
behavioral1/memory/2140-279-0x0000000000340000-0x0000000000500000-memory.dmp	dcrat
behavioral1/memory/2296-291-0x00000000000C0000-0x0000000000280000-memory.dmp	dcrat
behavioral1/memory/1916-304-0x00000000002B0000-0x0000000000470000-memory.dmp	dcrat
behavioral1/memory/1360-316-0x00000000003D0000-0x0000000000590000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2780	powershell.exe
2316	powershell.exe
2668	powershell.exe
2304	powershell.exe
2744	powershell.exe
2800	powershell.exe
2548	powershell.exe
2216	powershell.exe
2076	powershell.exe
2880	powershell.exe
2732	powershell.exe
2140	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe

Executes dropped EXE 7 IoCs

pid	Process
968	spoolsv.exe
1432	spoolsv.exe
2572	spoolsv.exe
2140	spoolsv.exe
2296	spoolsv.exe
1916	spoolsv.exe
1360	spoolsv.exe

Drops file in Program Files directory 25 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\audiodg.exe	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\RCX8B65.tmp	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\it-IT\RCX8FDB.tmp	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\it-IT\RCX8FDC.tmp	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\RCX96E3.tmp	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\audiodg.exe	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\services.exe	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe
File opened for modification	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\RCX895F.tmp	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\csrss.exe	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\it-IT\System.exe	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe
File opened for modification	C:\Program Files\Uninstall Information\RCX9B69.tmp	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe
File opened for modification	C:\Program Files\Uninstall Information\spoolsv.exe	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.151\csrss.exe	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\c5b4cb5e9653cc	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe
File created	C:\Program Files\Uninstall Information\f3b6ecef712a24	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe
File opened for modification	C:\Program Files\Uninstall Information\RCX9B6A.tmp	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe
File opened for modification	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\RCX8960.tmp	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\RCX8B64.tmp	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\services.exe	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe
File created	C:\Program Files (x86)\Windows Defender\it-IT\27d1bcfc3c54e0	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe
File created	C:\Program Files\Uninstall Information\spoolsv.exe	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\RCX96E4.tmp	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\42af1c969fbb7b	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.151\886983d96e3d3e	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe
File created	C:\Program Files (x86)\Windows Defender\it-IT\System.exe	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\de-DE\winlogon.exe	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe
File created	C:\Windows\de-DE\cc11b995f2a76d	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe
File opened for modification	C:\Windows\de-DE\RCX9461.tmp	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe
File opened for modification	C:\Windows\de-DE\RCX94D0.tmp	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe
File opened for modification	C:\Windows\de-DE\winlogon.exe	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 33 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2640	schtasks.exe
1976	schtasks.exe
356	schtasks.exe
2720	schtasks.exe
732	schtasks.exe
2892	schtasks.exe
2088	schtasks.exe
1288	schtasks.exe
2412	schtasks.exe
320	schtasks.exe
2840	schtasks.exe
2828	schtasks.exe
1808	schtasks.exe
3008	schtasks.exe
1652	schtasks.exe
2644	schtasks.exe
2156	schtasks.exe
3000	schtasks.exe
2556	schtasks.exe
2052	schtasks.exe
2816	schtasks.exe
2472	schtasks.exe
2716	schtasks.exe
2796	schtasks.exe
2864	schtasks.exe
1772	schtasks.exe
2628	schtasks.exe
3012	schtasks.exe
1172	schtasks.exe
2432	schtasks.exe
2132	schtasks.exe
2852	schtasks.exe
644	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2508	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe
2508	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe
2508	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe
2508	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe
2508	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe
2508	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe
2508	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe
2508	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe
2508	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe
2508	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe
2508	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe
2508	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe
2508	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe
2508	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe
2508	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe
2508	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe
2508	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe
2508	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe
2508	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe
2508	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe
2508	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe
2508	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe
2508	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe
2508	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe
2508	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe
2508	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe
2508	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe
2508	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe
2508	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe
2508	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe
2508	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe
2508	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe
2508	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe
2316	powershell.exe
2076	powershell.exe
2548	powershell.exe
2304	powershell.exe
2880	powershell.exe
2780	powershell.exe
2216	powershell.exe
2732	powershell.exe
2140	powershell.exe
2668	powershell.exe
2800	powershell.exe
2744	powershell.exe
968	spoolsv.exe
968	spoolsv.exe
968	spoolsv.exe
968	spoolsv.exe
968	spoolsv.exe
968	spoolsv.exe
968	spoolsv.exe
968	spoolsv.exe
968	spoolsv.exe
968	spoolsv.exe
968	spoolsv.exe
968	spoolsv.exe
968	spoolsv.exe
968	spoolsv.exe
968	spoolsv.exe
968	spoolsv.exe
968	spoolsv.exe
968	spoolsv.exe
968	spoolsv.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	2508	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe
Token: SeDebugPrivilege	2316	powershell.exe
Token: SeDebugPrivilege	2076	powershell.exe
Token: SeDebugPrivilege	2548	powershell.exe
Token: SeDebugPrivilege	2304	powershell.exe
Token: SeDebugPrivilege	2880	powershell.exe
Token: SeDebugPrivilege	2780	powershell.exe
Token: SeDebugPrivilege	2216	powershell.exe
Token: SeDebugPrivilege	2732	powershell.exe
Token: SeDebugPrivilege	2140	powershell.exe
Token: SeDebugPrivilege	2668	powershell.exe
Token: SeDebugPrivilege	2800	powershell.exe
Token: SeDebugPrivilege	2744	powershell.exe
Token: SeDebugPrivilege	968	spoolsv.exe
Token: SeDebugPrivilege	1432	spoolsv.exe
Token: SeDebugPrivilege	2572	spoolsv.exe
Token: SeDebugPrivilege	2140	spoolsv.exe
Token: SeDebugPrivilege	2296	spoolsv.exe
Token: SeDebugPrivilege	1916	spoolsv.exe
Token: SeDebugPrivilege	1360	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 2668	2508	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe	64
PID 2508 wrote to memory of 2668	2508	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe	64
PID 2508 wrote to memory of 2668	2508	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe	64
PID 2508 wrote to memory of 2316	2508	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe	65
PID 2508 wrote to memory of 2316	2508	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe	65
PID 2508 wrote to memory of 2316	2508	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe	65
PID 2508 wrote to memory of 2304	2508	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe	67
PID 2508 wrote to memory of 2304	2508	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe	67
PID 2508 wrote to memory of 2304	2508	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe	67
PID 2508 wrote to memory of 2216	2508	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe	68
PID 2508 wrote to memory of 2216	2508	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe	68
PID 2508 wrote to memory of 2216	2508	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe	68
PID 2508 wrote to memory of 2548	2508	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe	69
PID 2508 wrote to memory of 2548	2508	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe	69
PID 2508 wrote to memory of 2548	2508	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe	69
PID 2508 wrote to memory of 2140	2508	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe	70
PID 2508 wrote to memory of 2140	2508	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe	70
PID 2508 wrote to memory of 2140	2508	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe	70
PID 2508 wrote to memory of 2780	2508	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe	72
PID 2508 wrote to memory of 2780	2508	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe	72
PID 2508 wrote to memory of 2780	2508	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe	72
PID 2508 wrote to memory of 2800	2508	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe	73
PID 2508 wrote to memory of 2800	2508	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe	73
PID 2508 wrote to memory of 2800	2508	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe	73
PID 2508 wrote to memory of 2076	2508	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe	74
PID 2508 wrote to memory of 2076	2508	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe	74
PID 2508 wrote to memory of 2076	2508	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe	74
PID 2508 wrote to memory of 2732	2508	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe	75
PID 2508 wrote to memory of 2732	2508	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe	75
PID 2508 wrote to memory of 2732	2508	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe	75
PID 2508 wrote to memory of 2744	2508	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe	76
PID 2508 wrote to memory of 2744	2508	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe	76
PID 2508 wrote to memory of 2744	2508	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe	76
PID 2508 wrote to memory of 2880	2508	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe	77
PID 2508 wrote to memory of 2880	2508	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe	77
PID 2508 wrote to memory of 2880	2508	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe	77
PID 2508 wrote to memory of 552	2508	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe	88
PID 2508 wrote to memory of 552	2508	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe	88
PID 2508 wrote to memory of 552	2508	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe	88
PID 552 wrote to memory of 1268	552	cmd.exe	90
PID 552 wrote to memory of 1268	552	cmd.exe	90
PID 552 wrote to memory of 1268	552	cmd.exe	90
PID 552 wrote to memory of 968	552	cmd.exe	91
PID 552 wrote to memory of 968	552	cmd.exe	91
PID 552 wrote to memory of 968	552	cmd.exe	91
PID 968 wrote to memory of 888	968	spoolsv.exe	92
PID 968 wrote to memory of 888	968	spoolsv.exe	92
PID 968 wrote to memory of 888	968	spoolsv.exe	92
PID 968 wrote to memory of 1580	968	spoolsv.exe	93
PID 968 wrote to memory of 1580	968	spoolsv.exe	93
PID 968 wrote to memory of 1580	968	spoolsv.exe	93
PID 888 wrote to memory of 1432	888	WScript.exe	95
PID 888 wrote to memory of 1432	888	WScript.exe	95
PID 888 wrote to memory of 1432	888	WScript.exe	95
PID 1432 wrote to memory of 2556	1432	spoolsv.exe	96
PID 1432 wrote to memory of 2556	1432	spoolsv.exe	96
PID 1432 wrote to memory of 2556	1432	spoolsv.exe	96
PID 1432 wrote to memory of 2472	1432	spoolsv.exe	97
PID 1432 wrote to memory of 2472	1432	spoolsv.exe	97
PID 1432 wrote to memory of 2472	1432	spoolsv.exe	97
PID 2556 wrote to memory of 2572	2556	WScript.exe	98
PID 2556 wrote to memory of 2572	2556	WScript.exe	98
PID 2556 wrote to memory of 2572	2556	WScript.exe	98
PID 2572 wrote to memory of 2628	2572	spoolsv.exe	99

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe
"C:\Users\Admin\AppData\Local\Temp\95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe"
1⤵
- Drops file in Drivers directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2668
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2316
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2304
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2216
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2548
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2140
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2780
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2800
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2076
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2732
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2744
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2880
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\QePykRSfqT.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:552
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:1268
- - C:\Program Files\Uninstall Information\spoolsv.exe
    "C:\Program Files\Uninstall Information\spoolsv.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:968
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\68dec607-fe66-4ef0-9347-118fec789c59.vbs"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:888
    - - C:\Program Files\Uninstall Information\spoolsv.exe
        
        "C:\Program Files\Uninstall Information\spoolsv.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1432
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4233ec63-d4b3-4ccd-8bce-f451b6b3b625.vbs"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2556
        
        C:\Program Files\Uninstall Information\spoolsv.exe
        
        "C:\Program Files\Uninstall Information\spoolsv.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2572
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\066e5589-ce49-400c-b532-734a4ca2609a.vbs"
        8⤵
        
        PID:2628
        
        C:\Program Files\Uninstall Information\spoolsv.exe
        
        "C:\Program Files\Uninstall Information\spoolsv.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2140
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5b072dfc-935b-43f2-8973-7f2c42a9be74.vbs"
        10⤵
        
        PID:484
        
        C:\Program Files\Uninstall Information\spoolsv.exe
        
        "C:\Program Files\Uninstall Information\spoolsv.exe"
        11⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2296
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8a1727f6-5c16-41dc-b5d9-3d2f351d22df.vbs"
        12⤵
        
        PID:1804
        
        C:\Program Files\Uninstall Information\spoolsv.exe
        
        "C:\Program Files\Uninstall Information\spoolsv.exe"
        13⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1916
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\72541297-2148-4951-927f-992d3800e166.vbs"
        14⤵
        
        PID:1712
        
        C:\Program Files\Uninstall Information\spoolsv.exe
        
        "C:\Program Files\Uninstall Information\spoolsv.exe"
        15⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1360
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a7c51722-4b6f-45de-8245-d5758a6cc82a.vbs"
        16⤵
        
        PID:528
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9e919441-85d8-4152-beee-40325413d873.vbs"
        16⤵
        
        PID:2228
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e4dfe354-13cd-46bc-92eb-ad52f3852779.vbs"
        14⤵
        
        PID:1852
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\26beb32f-444a-443d-b832-2896eb91e9d6.vbs"
        12⤵
        
        PID:1016
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\956f8a38-d3f9-4b62-ab7e-df80c5a1ad46.vbs"
        10⤵
        
        PID:1816
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0f0d368c-c237-41ec-b34e-ad9a740991bb.vbs"
        8⤵
        
        PID:1532
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4bfac686-498e-4b57-92b2-59a788aebaab.vbs"
        6⤵
        
        PID:2472
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\afd9ab3c-f158-4f99-b116-2519c4f07843.vbs"
      4⤵
      PID:1580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 14 /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Google\Update\1.3.36.151\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\Update\1.3.36.151\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Google\Update\1.3.36.151\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\MSOCache\All Users\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Defender\it-IT\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\it-IT\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Defender\it-IT\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\Package Cache\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\packages\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1172

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Users\All Users\Package Cache\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\packages\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 6 /tr "'C:\Users\All Users\Package Cache\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\packages\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 12 /tr "'C:\Windows\de-DE\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\de-DE\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 12 /tr "'C:\Windows\de-DE\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 13 /tr "'C:\Program Files\Reference Assemblies\Microsoft\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files\Reference Assemblies\Microsoft\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 10 /tr "'C:\Program Files\Reference Assemblies\Microsoft\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1288

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 9 /tr "'C:\Program Files\Uninstall Information\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2132

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 11 /tr "'C:\Program Files\Uninstall Information\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\audiodg.exe

Filesize
1.7MB

MD5
f4240258b8897b8427d39d1ac3ad2806

SHA1
8439d9f407ce06409f42fd0af732b142894ba369

SHA256
f1844a9016c264b66deeec2e146c65ba7c953d26abd5bc85d9042ccd0675fb0a

SHA512
4650b0426572b347f01b1f77c3313b0975bb8652eb9673ca71e1379fdf3dce1f6e2680c2709ad8b70b12115151ae63a4bf3627a893fa85bdfd12d4ce733d81e4

Download Submit
C:\Program Files (x86)\Windows Defender\it-IT\System.exe

Filesize
1.7MB

MD5
68a655281c115869e423c1d7f5bea01d

SHA1
8193dcbfd44ca6bad7dd4c5824f9e0d4495220c2

SHA256
95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d

SHA512
c72d216bc5172e259226c624023aaf869cfdbebb29b2aa8421a15363f9c3c29acedb3436dbb829afce50aa13935f06c6baf40b3523c912ded39fb82f9b21c1db

Download Submit
C:\ProgramData\Package Cache\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\packages\WmiPrvSE.exe

Filesize
1.7MB

MD5
b1b7bc4885e6b3463718fa678292a389

SHA1
60429e254f295d18575f2bd4fa3e9b4e92d2fb26

SHA256
02effbc2eace20336187805da500b29ba1c3082434399cbace996b332a178846

SHA512
91c906624e802d6c44a5c8b9016ecf067e8cb5ee8562afc5a5498b6da609380c529d0d685ca65dbb8e9e84afbd618c93f82ff8daf0cdf6a1141666a19f235230

Download Submit
C:\Users\Admin\AppData\Local\Temp\066e5589-ce49-400c-b532-734a4ca2609a.vbs

Filesize
726B

MD5
3b43f9d922d2ce57442ab218df447674

SHA1
2454892862d61380cf144cfe7bf08f5483f9f5f7

SHA256
0563441391b2caa609f422859b0bee2ee6f5fc94b9bebe1dd918487e923dc8d4

SHA512
45b56ded625e78e049f10408fc1f801553111ec5b996f6cc4bc53efd805df3044bf49429ddff90e0fcc10247b3d8cae8b2e5926d915f481db653f5ce3aa115f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\4233ec63-d4b3-4ccd-8bce-f451b6b3b625.vbs

Filesize
726B

MD5
5bae4982ef0a3c8858bc8885e746a11f

SHA1
b156229db0f90f1c0107610c5b395f1a87f54cc1

SHA256
88f4cf0072e55f9d4c6326269ff040d18fbcb5f82903a70ef08cfa417f48e740

SHA512
229a75bb0f6f04c615d0d335783b706b650865ca3f1752ddccdf564f77705cf1ed3d8e99b46ff9e1fd042c0bd1ab60cb66b371161b7f9fd21e0330d2803fead6

Download Submit
C:\Users\Admin\AppData\Local\Temp\5b072dfc-935b-43f2-8973-7f2c42a9be74.vbs

Filesize
726B

MD5
cefc884b20343075709c4ae4a33814ab

SHA1
8d5d33e6071d9687dd50ad266be5201a1e563a3f

SHA256
88f2d8f5e0305cca33f345701d2805931e5d4155a3695226da516f84a2ad6e91

SHA512
06354f17b143ebf8a1d921b8f6674b4c25bd649de060428d40fc196977b56311e3189840ccd67b263243bb392e20ddfb553bd456053df8b94769c7a41ba12bfe

Download Submit
C:\Users\Admin\AppData\Local\Temp\68dec607-fe66-4ef0-9347-118fec789c59.vbs

Filesize
725B

MD5
5f51012ba709df055f903791904fe924

SHA1
7f951293087c6ed5ad239b6b142e01e53e0a5d2e

SHA256
aaf51de8bb8d9248fc61154331f6496e82d9ae53a2099979ee4102433d564796

SHA512
45299b0327961d6a1899b7ed9cd401d77106cbba7e8c03ce4ed19fe2396614c9c18ea2d79e23c73a80a3ee01a77a78235cadf18657199b6516816a7d1b3a9e49

Download Submit
C:\Users\Admin\AppData\Local\Temp\72541297-2148-4951-927f-992d3800e166.vbs

Filesize
726B

MD5
e5af716a176d0f82e82fea0969980fc4

SHA1
50947c51f1050c3e1bc04a8e3ab3742563106478

SHA256
99ead084b58189cfbcb4c4ca7d623b847b6b2c917564b76adc8c1fa84eabc698

SHA512
d34eb2da26a1076ad696beeb23e5e19bd3aa104b2cec99b59ed1495bf459d47844f1701db014e41a3aff5bc53b66c718051e881aed809630bbcefb9bc57eea7e

Download Submit
C:\Users\Admin\AppData\Local\Temp\8a1727f6-5c16-41dc-b5d9-3d2f351d22df.vbs

Filesize
726B

MD5
c8c4e788444e9de984cf9656ea8ef244

SHA1
9b0d63e817979411c1393922908dcae6dab4e2b2

SHA256
e8400c01b58f4255ebd649849ae99b1c341cc4b01fcf439486f67d1084e474bb

SHA512
4c3cf7f397ec2a77d7214d05106baaaf988ddc4ea6e3435b033b1a4e480af902e2023af96dd571ffcac4245cc732dd9e49528060e64bdea0f4354de58471d420

Download Submit
C:\Users\Admin\AppData\Local\Temp\QePykRSfqT.bat

Filesize
215B

MD5
45d93149717d6c32a3d0f08aa891e613

SHA1
4e027b5c747e31ef03534cef86f423a0056f7dea

SHA256
9683c23d1a8f5ea7ec18ebd92856bc08764672a657823b0f0686901f72a3baee

SHA512
ebaaeee91d1ad44de3fdb9274a83554ac0b1e2ad4242e6f9d2e762527b119cce0f0fd51288c67f8271157d9df6c43409b5933d2f8d5eac247ae3437429bef894

Download Submit
C:\Users\Admin\AppData\Local\Temp\a7c51722-4b6f-45de-8245-d5758a6cc82a.vbs

Filesize
726B

MD5
1bcd5c9d0da839e3084b73d4228e2123

SHA1
af3a6be47eef6a67d412d36cdeefe6f6be82cc27

SHA256
dacc2e524d7dd39c7cdb1108eecb41241f34de8611fa8314d6f425c3e939adad

SHA512
c233477c7538c2b478be189cf0f07324c42b49d76163f9e481e1d564b3ff19487d9d6745dd01b73d58d0dd1f12549fdf7046ae5b432021af9c05c6af8afbc95a

Download Submit
C:\Users\Admin\AppData\Local\Temp\afd9ab3c-f158-4f99-b116-2519c4f07843.vbs

Filesize
502B

MD5
36ca7d56dd36cc4701ffa6deb27a2942

SHA1
d22422f40503622da6da364f5e31b03f4ecb1c4d

SHA256
85c4bdea175810e70439993e976b57c028c5fbfaee6a98853f6c62f54192a8a5

SHA512
6ea517cad65db805364af3763083304a15faa9af44ca52868cce2282790e019b07dd26969f096f6f460e1c80d1f03fdd8bf3025f79bb0307974d94d3264a727e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
bdbbd1f6ceee1735b591a502222a2d12

SHA1
ef78d5dd5bdf430087fbaf29ea13d6e89661345a

SHA256
2adc014f2bfd5c0c181cda8fd2cd67570e379a1e267eb121a45846a70e92e954

SHA512
2e04b8cc334b496722fed6be8885040621364f3e90cced054eb5f6eaebadcd3f74748147b2e9daf37f03c1ce955d0b325f0259a6bcb3e3d0db5def4922773bc3

Download Submit
C:\Windows\de-DE\winlogon.exe

Filesize
1.7MB

MD5
a45a6c77b6c299731e25175695c8e137

SHA1
f640f37a919c3b68cc1300c1a425bed0222a90fc

SHA256
3175193169d48e1d144b5c4ff050f4a71a6b77acb7937a5d389835659d9c955f

SHA512
839ab89568650624e8a1ab6104c0f1911952b748dce322a538898a34ea3eef57ef1e6bebf826ad834e7919c62c7390b4cdf6785ad9078fdf970c017428a6ceed

Download Submit
memory/968-245-0x0000000000CD0000-0x0000000000CE2000-memory.dmp

Filesize
72KB

Download
memory/968-244-0x0000000001320000-0x00000000014E0000-memory.dmp

Filesize
1.8MB

Download
memory/1360-316-0x00000000003D0000-0x0000000000590000-memory.dmp

Filesize
1.8MB

Download
memory/1916-304-0x00000000002B0000-0x0000000000470000-memory.dmp

Filesize
1.8MB

Download
memory/2140-279-0x0000000000340000-0x0000000000500000-memory.dmp

Filesize
1.8MB

Download
memory/2296-292-0x0000000000730000-0x0000000000742000-memory.dmp

Filesize
72KB

Download
memory/2296-291-0x00000000000C0000-0x0000000000280000-memory.dmp

Filesize
1.8MB

Download
memory/2316-233-0x00000000022C0000-0x00000000022C8000-memory.dmp

Filesize
32KB

Download
memory/2316-212-0x000000001B620000-0x000000001B902000-memory.dmp

Filesize
2.9MB

Download
memory/2508-12-0x0000000000590000-0x000000000059C000-memory.dmp

Filesize
48KB

Download
memory/2508-11-0x0000000000470000-0x0000000000482000-memory.dmp

Filesize
72KB

Download
memory/2508-239-0x000007FEF5B03000-0x000007FEF5B04000-memory.dmp

Filesize
4KB

Download
memory/2508-240-0x000007FEF5B00000-0x000007FEF64EC000-memory.dmp

Filesize
9.9MB

Download
memory/2508-17-0x0000000000CE0000-0x0000000000CEC000-memory.dmp

Filesize
48KB

Download
memory/2508-16-0x0000000000C50000-0x0000000000C5C000-memory.dmp

Filesize
48KB

Download
memory/2508-15-0x00000000005B0000-0x00000000005B8000-memory.dmp

Filesize
32KB

Download
memory/2508-13-0x00000000005C0000-0x00000000005CA000-memory.dmp

Filesize
40KB

Download
memory/2508-14-0x00000000005A0000-0x00000000005AE000-memory.dmp

Filesize
56KB

Download
memory/2508-0-0x000007FEF5B03000-0x000007FEF5B04000-memory.dmp

Filesize
4KB

Download
memory/2508-1-0x0000000001080000-0x0000000001240000-memory.dmp

Filesize
1.8MB

Download
memory/2508-20-0x000007FEF5B00000-0x000007FEF64EC000-memory.dmp

Filesize
9.9MB

Download
memory/2508-9-0x0000000000450000-0x0000000000458000-memory.dmp

Filesize
32KB

Download
memory/2508-8-0x0000000000440000-0x000000000044C000-memory.dmp

Filesize
48KB

Download
memory/2508-7-0x0000000000430000-0x0000000000440000-memory.dmp

Filesize
64KB

Download
memory/2508-6-0x0000000000410000-0x0000000000426000-memory.dmp

Filesize
88KB

Download
memory/2508-5-0x0000000000180000-0x0000000000190000-memory.dmp

Filesize
64KB

Download
memory/2508-4-0x0000000000170000-0x0000000000178000-memory.dmp

Filesize
32KB

Download
memory/2508-3-0x0000000000150000-0x000000000016C000-memory.dmp

Filesize
112KB

Download
memory/2508-2-0x000007FEF5B00000-0x000007FEF64EC000-memory.dmp

Filesize
9.9MB

Download
memory/2572-267-0x00000000002C0000-0x0000000000480000-memory.dmp

Filesize
1.8MB

Download