dcrat | 3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
16-12-2024 22:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

WinPerfcommon.exe
Size

1.9MB
MD5

6b9554367a439d39a00a0dff9a08b123
SHA1

e1d22cde90c297c10f4fcba5b3980e5d551eb0b3
SHA256

3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9
SHA512

72ffbca1a2aa7cd2bb6b963d97b43d7d5eab9a11d09c647c7679e71877927b8c021e28cd1e28ae9ac5300c8621ba97aae6699e1abddc58be89c9bb3e84d1c720
SSDEEP

49152:xh0kcmcdp/caMMlawkBXRInaKYRouPbWGQ2:xhbcmcfM/N1RSavoujWH

Score

10^/10

dcrat discovery execution infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Modifies WinLogon for persistence 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Google\\Update\\sppsvc.exe\", \"C:\\Program Files\\Windows Mail\\sysmon.exe\", \"C:\\Program Files\\Java\\jdk-1.8\\legal\\jdk\\TextInputHost.exe\", \"C:\\Program Files\\Microsoft Office\\upfc.exe\", \"C:\\Users\\Public\\AccountPictures\\dllhost.exe\""	WinPerfcommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Google\\Update\\sppsvc.exe\", \"C:\\Program Files\\Windows Mail\\sysmon.exe\", \"C:\\Program Files\\Java\\jdk-1.8\\legal\\jdk\\TextInputHost.exe\", \"C:\\Program Files\\Microsoft Office\\upfc.exe\", \"C:\\Users\\Public\\AccountPictures\\dllhost.exe\", \"C:\\Users\\Admin\\AppData\\Local\\Temp\\WinPerfcommon.exe\""	WinPerfcommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Google\\Update\\sppsvc.exe\""	WinPerfcommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Google\\Update\\sppsvc.exe\", \"C:\\Program Files\\Windows Mail\\sysmon.exe\""	WinPerfcommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Google\\Update\\sppsvc.exe\", \"C:\\Program Files\\Windows Mail\\sysmon.exe\", \"C:\\Program Files\\Java\\jdk-1.8\\legal\\jdk\\TextInputHost.exe\""	WinPerfcommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Google\\Update\\sppsvc.exe\", \"C:\\Program Files\\Windows Mail\\sysmon.exe\", \"C:\\Program Files\\Java\\jdk-1.8\\legal\\jdk\\TextInputHost.exe\", \"C:\\Program Files\\Microsoft Office\\upfc.exe\""	WinPerfcommon.exe

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4952	3876	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4224	3876	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1176	3876	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3996	3876	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3912	3876	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4144	3876	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4064	3876	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5096	3876	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4168	3876	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3380	3876	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3172	3876	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4996	3876	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4040	3876	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4604	3876	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3084	3876	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3384	3876	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4388	3876	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4236	3876	schtasks.exe	82

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4456	powershell.exe
1332	powershell.exe
2080	powershell.exe
1304	powershell.exe
3812	powershell.exe
2168	powershell.exe

Checks computer location settings 2 TTPs 16 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	TextInputHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	TextInputHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	TextInputHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	TextInputHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	TextInputHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	WinPerfcommon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	TextInputHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	TextInputHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	TextInputHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	TextInputHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	TextInputHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	TextInputHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	TextInputHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	TextInputHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	TextInputHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	TextInputHost.exe

Executes dropped EXE 15 IoCs

pid	Process
2700	TextInputHost.exe
3172	TextInputHost.exe
2372	TextInputHost.exe
3672	TextInputHost.exe
4676	TextInputHost.exe
3604	TextInputHost.exe
4112	TextInputHost.exe
2736	TextInputHost.exe
4944	TextInputHost.exe
4364	TextInputHost.exe
5116	TextInputHost.exe
3832	TextInputHost.exe
2064	TextInputHost.exe
4052	TextInputHost.exe
688	TextInputHost.exe

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Program Files (x86)\\Google\\Update\\sppsvc.exe\""	WinPerfcommon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysmon = "\"C:\\Program Files\\Windows Mail\\sysmon.exe\""	WinPerfcommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysmon = "\"C:\\Program Files\\Windows Mail\\sysmon.exe\""	WinPerfcommon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TextInputHost = "\"C:\\Program Files\\Java\\jdk-1.8\\legal\\jdk\\TextInputHost.exe\""	WinPerfcommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TextInputHost = "\"C:\\Program Files\\Java\\jdk-1.8\\legal\\jdk\\TextInputHost.exe\""	WinPerfcommon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\upfc = "\"C:\\Program Files\\Microsoft Office\\upfc.exe\""	WinPerfcommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\upfc = "\"C:\\Program Files\\Microsoft Office\\upfc.exe\""	WinPerfcommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Users\\Public\\AccountPictures\\dllhost.exe\""	WinPerfcommon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinPerfcommon = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WinPerfcommon.exe\""	WinPerfcommon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Program Files (x86)\\Google\\Update\\sppsvc.exe\""	WinPerfcommon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Users\\Public\\AccountPictures\\dllhost.exe\""	WinPerfcommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinPerfcommon = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WinPerfcommon.exe\""	WinPerfcommon.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\Windows\System32\CSCE7DED6ACE104479B32BA81D49CA36CB.TMP	csc.exe
File created	\??\c:\Windows\System32\s_kgxh.exe	csc.exe

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\upfc.exe	WinPerfcommon.exe
File created	C:\Program Files\ModifiableWindowsApps\RuntimeBroker.exe	WinPerfcommon.exe
File created	C:\Program Files (x86)\Google\Update\0a1fd5f707cd16	WinPerfcommon.exe
File created	C:\Program Files\Windows Mail\121e5b5079f7c0	WinPerfcommon.exe
File created	C:\Program Files (x86)\Google\Update\sppsvc.exe	WinPerfcommon.exe
File created	C:\Program Files (x86)\Windows Media Player\Icons\Idle.exe	WinPerfcommon.exe
File created	C:\Program Files\Microsoft Office\ea1d8f6d871115	WinPerfcommon.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\TextInputHost.exe	WinPerfcommon.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\22eafd247d37c3	WinPerfcommon.exe
File created	C:\Program Files\Windows Mail\sysmon.exe	WinPerfcommon.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 7 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4148	PING.EXE
4792	PING.EXE
2032	PING.EXE
4060	PING.EXE
3184	PING.EXE
3936	PING.EXE
2296	PING.EXE

Modifies registry class 16 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	WinPerfcommon.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	TextInputHost.exe

Runs ping.exe 1 TTPs 7 IoCs

Remote System Discovery

T1018

pid	Process
2032	PING.EXE
4060	PING.EXE
3184	PING.EXE
3936	PING.EXE
2296	PING.EXE
4148	PING.EXE
4792	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4168	schtasks.exe
3384	schtasks.exe
4388	schtasks.exe
4064	schtasks.exe
5096	schtasks.exe
4996	schtasks.exe
4040	schtasks.exe
3084	schtasks.exe
1176	schtasks.exe
3912	schtasks.exe
4952	schtasks.exe
3172	schtasks.exe
4144	schtasks.exe
3380	schtasks.exe
4604	schtasks.exe
4236	schtasks.exe
4224	schtasks.exe
3996	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3496	WinPerfcommon.exe
3496	WinPerfcommon.exe
3496	WinPerfcommon.exe
3496	WinPerfcommon.exe
3496	WinPerfcommon.exe
3496	WinPerfcommon.exe
3496	WinPerfcommon.exe
3496	WinPerfcommon.exe
3496	WinPerfcommon.exe
3496	WinPerfcommon.exe
3496	WinPerfcommon.exe
3496	WinPerfcommon.exe
3496	WinPerfcommon.exe
3496	WinPerfcommon.exe
3496	WinPerfcommon.exe
3496	WinPerfcommon.exe
3496	WinPerfcommon.exe
3496	WinPerfcommon.exe
3496	WinPerfcommon.exe
3496	WinPerfcommon.exe
3496	WinPerfcommon.exe
3496	WinPerfcommon.exe
3496	WinPerfcommon.exe
3496	WinPerfcommon.exe
3496	WinPerfcommon.exe
3496	WinPerfcommon.exe
3496	WinPerfcommon.exe
3496	WinPerfcommon.exe
3496	WinPerfcommon.exe
3496	WinPerfcommon.exe
3496	WinPerfcommon.exe
3496	WinPerfcommon.exe
3496	WinPerfcommon.exe
3496	WinPerfcommon.exe
3496	WinPerfcommon.exe
3496	WinPerfcommon.exe
3496	WinPerfcommon.exe
3496	WinPerfcommon.exe
3496	WinPerfcommon.exe
3496	WinPerfcommon.exe
3496	WinPerfcommon.exe
3496	WinPerfcommon.exe
3496	WinPerfcommon.exe
3496	WinPerfcommon.exe
3496	WinPerfcommon.exe
3496	WinPerfcommon.exe
3496	WinPerfcommon.exe
3496	WinPerfcommon.exe
3496	WinPerfcommon.exe
3496	WinPerfcommon.exe
3496	WinPerfcommon.exe
3496	WinPerfcommon.exe
3496	WinPerfcommon.exe
3496	WinPerfcommon.exe
3496	WinPerfcommon.exe
3496	WinPerfcommon.exe
3496	WinPerfcommon.exe
3496	WinPerfcommon.exe
3496	WinPerfcommon.exe
3496	WinPerfcommon.exe
3496	WinPerfcommon.exe
3496	WinPerfcommon.exe
3496	WinPerfcommon.exe
3496	WinPerfcommon.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	3496	WinPerfcommon.exe
Token: SeDebugPrivilege	2080	powershell.exe
Token: SeDebugPrivilege	4456	powershell.exe
Token: SeDebugPrivilege	2168	powershell.exe
Token: SeDebugPrivilege	1304	powershell.exe
Token: SeDebugPrivilege	3812	powershell.exe
Token: SeDebugPrivilege	1332	powershell.exe
Token: SeDebugPrivilege	2700	TextInputHost.exe
Token: SeDebugPrivilege	3172	TextInputHost.exe
Token: SeDebugPrivilege	2372	TextInputHost.exe
Token: SeDebugPrivilege	3672	TextInputHost.exe
Token: SeDebugPrivilege	4676	TextInputHost.exe
Token: SeDebugPrivilege	3604	TextInputHost.exe
Token: SeDebugPrivilege	4112	TextInputHost.exe
Token: SeDebugPrivilege	2736	TextInputHost.exe
Token: SeDebugPrivilege	4944	TextInputHost.exe
Token: SeDebugPrivilege	4364	TextInputHost.exe
Token: SeDebugPrivilege	5116	TextInputHost.exe
Token: SeDebugPrivilege	3832	TextInputHost.exe
Token: SeDebugPrivilege	2064	TextInputHost.exe
Token: SeDebugPrivilege	4052	TextInputHost.exe
Token: SeDebugPrivilege	688	TextInputHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3496 wrote to memory of 1128	3496	WinPerfcommon.exe	86
PID 3496 wrote to memory of 1128	3496	WinPerfcommon.exe	86
PID 1128 wrote to memory of 3364	1128	csc.exe	88
PID 1128 wrote to memory of 3364	1128	csc.exe	88
PID 3496 wrote to memory of 1332	3496	WinPerfcommon.exe	104
PID 3496 wrote to memory of 1332	3496	WinPerfcommon.exe	104
PID 3496 wrote to memory of 4456	3496	WinPerfcommon.exe	105
PID 3496 wrote to memory of 4456	3496	WinPerfcommon.exe	105
PID 3496 wrote to memory of 2168	3496	WinPerfcommon.exe	106
PID 3496 wrote to memory of 2168	3496	WinPerfcommon.exe	106
PID 3496 wrote to memory of 3812	3496	WinPerfcommon.exe	107
PID 3496 wrote to memory of 3812	3496	WinPerfcommon.exe	107
PID 3496 wrote to memory of 1304	3496	WinPerfcommon.exe	108
PID 3496 wrote to memory of 1304	3496	WinPerfcommon.exe	108
PID 3496 wrote to memory of 2080	3496	WinPerfcommon.exe	109
PID 3496 wrote to memory of 2080	3496	WinPerfcommon.exe	109
PID 3496 wrote to memory of 4116	3496	WinPerfcommon.exe	116
PID 3496 wrote to memory of 4116	3496	WinPerfcommon.exe	116
PID 4116 wrote to memory of 728	4116	cmd.exe	118
PID 4116 wrote to memory of 728	4116	cmd.exe	118
PID 4116 wrote to memory of 1468	4116	cmd.exe	119
PID 4116 wrote to memory of 1468	4116	cmd.exe	119
PID 4116 wrote to memory of 2700	4116	cmd.exe	120
PID 4116 wrote to memory of 2700	4116	cmd.exe	120
PID 2700 wrote to memory of 1924	2700	TextInputHost.exe	121
PID 2700 wrote to memory of 1924	2700	TextInputHost.exe	121
PID 1924 wrote to memory of 5016	1924	cmd.exe	123
PID 1924 wrote to memory of 5016	1924	cmd.exe	123
PID 1924 wrote to memory of 3592	1924	cmd.exe	124
PID 1924 wrote to memory of 3592	1924	cmd.exe	124
PID 1924 wrote to memory of 3172	1924	cmd.exe	129
PID 1924 wrote to memory of 3172	1924	cmd.exe	129
PID 3172 wrote to memory of 2928	3172	TextInputHost.exe	132
PID 3172 wrote to memory of 2928	3172	TextInputHost.exe	132
PID 2928 wrote to memory of 2440	2928	cmd.exe	134
PID 2928 wrote to memory of 2440	2928	cmd.exe	134
PID 2928 wrote to memory of 4792	2928	cmd.exe	135
PID 2928 wrote to memory of 4792	2928	cmd.exe	135
PID 2928 wrote to memory of 2372	2928	cmd.exe	136
PID 2928 wrote to memory of 2372	2928	cmd.exe	136
PID 2372 wrote to memory of 2856	2372	TextInputHost.exe	138
PID 2372 wrote to memory of 2856	2372	TextInputHost.exe	138
PID 2856 wrote to memory of 3916	2856	cmd.exe	140
PID 2856 wrote to memory of 3916	2856	cmd.exe	140
PID 2856 wrote to memory of 2032	2856	cmd.exe	141
PID 2856 wrote to memory of 2032	2856	cmd.exe	141
PID 2856 wrote to memory of 3672	2856	cmd.exe	143
PID 2856 wrote to memory of 3672	2856	cmd.exe	143
PID 3672 wrote to memory of 3812	3672	TextInputHost.exe	144
PID 3672 wrote to memory of 3812	3672	TextInputHost.exe	144
PID 3812 wrote to memory of 2840	3812	cmd.exe	146
PID 3812 wrote to memory of 2840	3812	cmd.exe	146
PID 3812 wrote to memory of 4060	3812	cmd.exe	147
PID 3812 wrote to memory of 4060	3812	cmd.exe	147
PID 3812 wrote to memory of 4676	3812	cmd.exe	148
PID 3812 wrote to memory of 4676	3812	cmd.exe	148
PID 4676 wrote to memory of 2400	4676	TextInputHost.exe	149
PID 4676 wrote to memory of 2400	4676	TextInputHost.exe	149
PID 2400 wrote to memory of 1508	2400	cmd.exe	151
PID 2400 wrote to memory of 1508	2400	cmd.exe	151
PID 2400 wrote to memory of 3184	2400	cmd.exe	152
PID 2400 wrote to memory of 3184	2400	cmd.exe	152
PID 2400 wrote to memory of 3604	2400	cmd.exe	153
PID 2400 wrote to memory of 3604	2400	cmd.exe	153

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\WinPerfcommon.exe
"C:\Users\Admin\AppData\Local\Temp\WinPerfcommon.exe"
1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3496
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\e4ovr0xo\e4ovr0xo.cmdline"
  2⤵
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1128
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES88B8.tmp" "c:\Windows\System32\CSCE7DED6ACE104479B32BA81D49CA36CB.TMP"
    3⤵
    PID:3364
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Google\Update\sppsvc.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1332
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Mail\sysmon.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:4456
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Java\jdk-1.8\legal\jdk\TextInputHost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2168
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Microsoft Office\upfc.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:3812
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\dllhost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1304
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\WinPerfcommon.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2080
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\4zXnhT5Y5F.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4116
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:728
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:1468
- - C:\Program Files\Java\jdk-1.8\legal\jdk\TextInputHost.exe
    "C:\Program Files\Java\jdk-1.8\legal\jdk\TextInputHost.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2700
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ndC0udATSD.bat"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1924
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:5016
    - - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        5⤵
        
        PID:3592
    - - C:\Program Files\Java\jdk-1.8\legal\jdk\TextInputHost.exe
        
        "C:\Program Files\Java\jdk-1.8\legal\jdk\TextInputHost.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3172
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\9QW9oB7wRt.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2928
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        7⤵
        
        PID:2440
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4792
        
        C:\Program Files\Java\jdk-1.8\legal\jdk\TextInputHost.exe
        
        "C:\Program Files\Java\jdk-1.8\legal\jdk\TextInputHost.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2372
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\KyXgl7nTK4.bat"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:2856
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        9⤵
        
        PID:3916
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        9⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2032
        
        C:\Program Files\Java\jdk-1.8\legal\jdk\TextInputHost.exe
        
        "C:\Program Files\Java\jdk-1.8\legal\jdk\TextInputHost.exe"
        9⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3672
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\z5PBQAYZs7.bat"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:3812
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        11⤵
        
        PID:2840
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        11⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4060
        
        C:\Program Files\Java\jdk-1.8\legal\jdk\TextInputHost.exe
        
        "C:\Program Files\Java\jdk-1.8\legal\jdk\TextInputHost.exe"
        11⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4676
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\1LArpmQ7xZ.bat"
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:2400
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        13⤵
        
        PID:1508
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        13⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3184
        
        C:\Program Files\Java\jdk-1.8\legal\jdk\TextInputHost.exe
        
        "C:\Program Files\Java\jdk-1.8\legal\jdk\TextInputHost.exe"
        13⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:3604
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\3Z0zJXQy9U.bat"
        14⤵
        
        PID:4236
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        15⤵
        
        PID:3512
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        15⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3936
        
        C:\Program Files\Java\jdk-1.8\legal\jdk\TextInputHost.exe
        
        "C:\Program Files\Java\jdk-1.8\legal\jdk\TextInputHost.exe"
        15⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:4112
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\oXOdSEs2zx.bat"
        16⤵
        
        PID:1580
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        17⤵
        
        PID:1516
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        17⤵
        
        PID:3608
        
        C:\Program Files\Java\jdk-1.8\legal\jdk\TextInputHost.exe
        
        "C:\Program Files\Java\jdk-1.8\legal\jdk\TextInputHost.exe"
        17⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:2736
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\lOMsQrAcGI.bat"
        18⤵
        
        PID:3500
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        19⤵
        
        PID:4964
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        19⤵
        
        PID:2372
        
        C:\Program Files\Java\jdk-1.8\legal\jdk\TextInputHost.exe
        
        "C:\Program Files\Java\jdk-1.8\legal\jdk\TextInputHost.exe"
        19⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:4944
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\VXTmetMh5k.bat"
        20⤵
        
        PID:4140
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        21⤵
        
        PID:2396
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        21⤵
        
        PID:3600
        
        C:\Program Files\Java\jdk-1.8\legal\jdk\TextInputHost.exe
        
        "C:\Program Files\Java\jdk-1.8\legal\jdk\TextInputHost.exe"
        21⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:4364
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\AeLHIw7ndo.bat"
        22⤵
        
        PID:3064
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        23⤵
        
        PID:4056
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        23⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2296
        
        C:\Program Files\Java\jdk-1.8\legal\jdk\TextInputHost.exe
        
        "C:\Program Files\Java\jdk-1.8\legal\jdk\TextInputHost.exe"
        23⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:5116
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\SPR0cWdHM6.bat"
        24⤵
        
        PID:1716
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        25⤵
        
        PID:4388
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        25⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4148
        
        C:\Program Files\Java\jdk-1.8\legal\jdk\TextInputHost.exe
        
        "C:\Program Files\Java\jdk-1.8\legal\jdk\TextInputHost.exe"
        25⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:3832
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Vs6Gb3dzjw.bat"
        26⤵
        
        PID:2040
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        27⤵
        
        PID:3936
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        27⤵
        
        PID:3596
        
        C:\Program Files\Java\jdk-1.8\legal\jdk\TextInputHost.exe
        
        "C:\Program Files\Java\jdk-1.8\legal\jdk\TextInputHost.exe"
        27⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:2064
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\IqQTfaxkTv.bat"
        28⤵
        
        PID:4584
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        29⤵
        
        PID:4520
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        29⤵
        
        PID:4384
        
        C:\Program Files\Java\jdk-1.8\legal\jdk\TextInputHost.exe
        
        "C:\Program Files\Java\jdk-1.8\legal\jdk\TextInputHost.exe"
        29⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:4052
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\igsUyaB4hX.bat"
        30⤵
        
        PID:904
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        31⤵
        
        PID:4316
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        31⤵
        
        PID:3856
        
        C:\Program Files\Java\jdk-1.8\legal\jdk\TextInputHost.exe
        
        "C:\Program Files\Java\jdk-1.8\legal\jdk\TextInputHost.exe"
        31⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:688
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\bjcQ5hKx2L.bat"
        32⤵
        
        PID:4028
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        33⤵
        
        PID:888
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        33⤵
        
        PID:3180

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Google\Update\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\Update\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Google\Update\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1176

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Mail\sysmon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Mail\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 7 /tr "'C:\Program Files\Java\jdk-1.8\legal\jdk\TextInputHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Program Files\Java\jdk-1.8\legal\jdk\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3384

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 12 /tr "'C:\Program Files\Java\jdk-1.8\legal\jdk\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 12 /tr "'C:\Program Files\Microsoft Office\upfc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 10 /tr "'C:\Program Files\Microsoft Office\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Users\Public\AccountPictures\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Public\AccountPictures\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5096

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Users\Public\AccountPictures\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WinPerfcommonW" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\AppData\Local\Temp\WinPerfcommon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4168

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WinPerfcommon" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\Temp\WinPerfcommon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3172

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WinPerfcommonW" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\AppData\Local\Temp\WinPerfcommon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Google\Update\sppsvc.exe

Filesize
1.9MB

MD5
6b9554367a439d39a00a0dff9a08b123

SHA1
e1d22cde90c297c10f4fcba5b3980e5d551eb0b3

SHA256
3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9

SHA512
72ffbca1a2aa7cd2bb6b963d97b43d7d5eab9a11d09c647c7679e71877927b8c021e28cd1e28ae9ac5300c8621ba97aae6699e1abddc58be89c9bb3e84d1c720

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\TextInputHost.exe.log

Filesize
1KB

MD5
935ecb30a8e13f625a9a89e3b0fcbf8f

SHA1
41cb046b7b5f89955fd53949efad8e9f3971d731

SHA256
2a7b829afe6a140bb37d24cc7711749c20cdaaf9cc7c4a182ff081180b4d99e9

SHA512
1210281612b0101ce63555a1a7855589ff68e1eac5b8a2461e10808c5b92c5dd111be72406c2923a94e10b687ceda43dc24d8c22a49dab40a4af793ee6b740aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
77d622bb1a5b250869a3238b9bc1402b

SHA1
d47f4003c2554b9dfc4c16f22460b331886b191b

SHA256
f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

SHA512
d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6d42b6da621e8df5674e26b799c8e2aa

SHA1
ab3ce1327ea1eeedb987ec823d5e0cb146bafa48

SHA256
5ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c

SHA512
53faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Temp\1LArpmQ7xZ.bat

Filesize
185B

MD5
66c4d2bcc6307b5f36dc7f5db2aabf35

SHA1
6e27acdfcaed89e2b4b6e04e1be83edbcc482d71

SHA256
1ba250036d61dc8ecf3e0c27effd4224713a068faa782a0595df2d07979c1426

SHA512
041aa277115e8a7c1382fa475182a5ebfc0b31402756aea552d67e6068a5e60076f6506d4cf81f7350b76cf6f859c3d29fbdc9d960fa76888504584a152bf70e

Download Submit
C:\Users\Admin\AppData\Local\Temp\3Z0zJXQy9U.bat

Filesize
185B

MD5
c9e9cbf82250ad46b928c1167d66b7ac

SHA1
bbf05bee6170dfb4d02c6cba77a912261092cff6

SHA256
6660c7d3dee8a61933ef9a71891326061805b3f528e13e025ed9102637374300

SHA512
5092650024788160c99e4074b82de181f10a49c528389ec93f43454c087a5b954857d5367096ec62fe22ae02c9eb15851d986d058d435ed96e3b74d7dff94804

Download Submit
C:\Users\Admin\AppData\Local\Temp\4zXnhT5Y5F.bat

Filesize
233B

MD5
32f082482e91dfb1d4a8c7fa517b239c

SHA1
c9aa8744dab4dc65484d60de2ac9a5aef86955df

SHA256
20450d2d251d3b36c6738222ac0f979f7cb55f8d9e412c037b093584f758b390

SHA512
02fc48fbbc99fa427c66c930ed8ac2707788d8940cca17a847b7f7586d7bacf131eaffcf24d063e4e9db44fac85d076fdae7e885c36f14c38723c4ecbb08a4b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\9QW9oB7wRt.bat

Filesize
185B

MD5
6335001200859318a3962404f1ae510b

SHA1
4eb5ba72bcdcef164948bba9f01f3192dcbe0d4a

SHA256
82d8b6cde442fada976b3513b4bba7e67caa3884c83913098aa2a4484b28ee88

SHA512
ed136341341952b5c15d0f83fca554688c71d26704d9c76c723268e45a47c8e14016f78c19dab8c9898cf67f4445b8fb30589ab5fcba3ab4b7476f344d702aad

Download Submit
C:\Users\Admin\AppData\Local\Temp\AeLHIw7ndo.bat

Filesize
185B

MD5
03ccb07bcd4227f71bb0e8c0e18883d6

SHA1
cf9e0eb76be2aef4929fdeab8db9d460ee780716

SHA256
0457b2dafdb104c7e41562c61ddff837e61a0d751679992be62687e13ce9f176

SHA512
868b621c49d46d74e628b8a8c9ba94fa791d8c14639fff820228ee453df199957dee9fb849dea0f562861b44ca3dc911c2834c946e46b3fac4c7f8f5d8ae57b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IqQTfaxkTv.bat

Filesize
233B

MD5
76735c6b0de3b2f45be2d94ecaa96586

SHA1
b963316ddd624d1274a89d3c2f9664472e8e25cf

SHA256
c7e35bdc552bbcaf5adb827dad6e724dc234e8d247f78c702d80d320ee52a1d9

SHA512
8540a649f34a1df66059e7437835c075bbc1e95bad18cadd2c440a4a04ea0be411dc3398e22a03ea31e6b30c8dca979ad6916d6eeb38a004ca2d7725544db36e

Download Submit
C:\Users\Admin\AppData\Local\Temp\KyXgl7nTK4.bat

Filesize
185B

MD5
0ce33d8af4a42281c681acf1d647c741

SHA1
988c934908f7a432c45fe1e4d2fb6ff7580fb36f

SHA256
3222f92bca513913574f71635f3a78aae70dde3b0a60074b32be8c44b8b3789c

SHA512
15b6a378bd8d217e25da7f531455791027e05703f7e6a972b0803620228fb471b32d0c66e8913350ddedfdd95c4e7e529d1360e930908d650fbb4e934d32032d

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES88B8.tmp

Filesize
1KB

MD5
08d900b66de3b764d07448ec8a8ea1d1

SHA1
017220edd04a6810ae1051eb1918e85c76c1e969

SHA256
56fe6309c5c275560bf429516e04a7736f40464531f6e3ab075d1c4faa23fcec

SHA512
a22fb56f11e1052380fb67805416a4d3d844cf7e0aaa76b8a77a01c3252a162d46424d0f450c303f8e4a686f019e5ca7a174ed66ea351ceb0bd49500cdceb577

Download Submit
C:\Users\Admin\AppData\Local\Temp\SPR0cWdHM6.bat

Filesize
185B

MD5
e2c23da5f4a587b6c9dd05bd61977d1f

SHA1
d83174d11b57fded9558b0bafaf6cbe49cc7a205

SHA256
dc90f314e3b170970c8cc0b11469c805c74ea982d3a8056e8d1e2c9a0b683cc6

SHA512
dcfada9fa43b47e93d60cef69eb32a02354f9e726fa01e580ca284a4e91dbb7c3591a5e6a8551edf87abc97bd3c327fd1208c72f2263220916c0185470b5b1d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\VXTmetMh5k.bat

Filesize
233B

MD5
7cbd15f49aa0d81f0f517ab2d15e38f7

SHA1
9ad292c51215a739086693816d53febc4bc7dfcc

SHA256
b906a7d0234e5db1da78cc63cc868e28f4612a027b4d02b851cebc28febb4bcc

SHA512
82390fd479ba753845588630b154ef460d6df239112591bc438c741d6c6fa889b19225327a1addef676f7517f55ab3ded9c03fe2d21e3938bd64cec4c935b28a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Vs6Gb3dzjw.bat

Filesize
233B

MD5
3b22b893ca4bcb9c1f4f67c0cba777a7

SHA1
a78b7ccd31ab84db2b8b179bb2e38d428de721ca

SHA256
a65b96496b4ecc01587b722011f0ada4c47598d850bfd49fb085b8985c2c1b83

SHA512
37ace093e9b915d067cfe2e95f9af85ec2abc864ae8da678cabf19b1884e8667222bcd2c36b6955329db67ceb38677cae29fe8ce79ffa37256cdd0da50718de6

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_sk2alqk0.ufz.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\bjcQ5hKx2L.bat

Filesize
233B

MD5
1471eb494d35ce7c76b83ce185881b87

SHA1
c6f909c4fa4d818781b8b4a3009ad9fb4fb0be01

SHA256
db6a861afb2e60de89468373fb65b81c25d93fa537500c52a1fc92fca7f1acf6

SHA512
abe7ae90169d2890b828ed6292eff6d19eebad06185665eed57df82ebec7101c078a9d6d3558d59a77e4f85a9cb47539c8e60c20ebbbb2e0b90d0fc1111b3d74

Download Submit
C:\Users\Admin\AppData\Local\Temp\igsUyaB4hX.bat

Filesize
233B

MD5
510f6f5507f5dfa68754ffebc7fea528

SHA1
42bb43783f03ccda9a3dcbecf4dc7ac77f6741e7

SHA256
4e2d12b05537404cb334ee3853b7694aa6128f1eccde8234fef3632931ca0a1c

SHA512
8c25c66d515498b98147f19e90e789692f9561cbfa8bc26a7549350f5399f2207e4f47ee4244d870ecc89a785b7e51f1cc5b72a69835e6777bdf19ddb8abd20a

Download Submit
C:\Users\Admin\AppData\Local\Temp\lOMsQrAcGI.bat

Filesize
233B

MD5
c3ba3b07e42528353f54dbc330355a29

SHA1
baf224afbf32b49d28cc3600cd2fa27769d41a91

SHA256
e370008d3b6caa5dfb20db1815256a79bce36cc0956ec0899425ea64a62d0fb1

SHA512
580bd6c0a88d6591b12331ce7882294c4b7914318ad2cb298571140001e2790c9fd9eb58206e37b923f99efffdb7513f59ff0287b01d8f527814202d3c29d42c

Download Submit
C:\Users\Admin\AppData\Local\Temp\ndC0udATSD.bat

Filesize
233B

MD5
7cc4acb3485f1c2946579f2a73b8cf2b

SHA1
392bcab921df76e1c51ec45d9678bf0cd4e206e6

SHA256
33b8b41a99c92be871cce118f9f95ff8ef009bdd7c6b43ea1195324d73e053f4

SHA512
78768a5bca26c06b8ca98b2314a71fedfa9cc165befd888c0379c67410cd4e7c3aa7d1dbaf07d0908f4fa07cc3792b1f1aa82570e57ed6aa0f04c500b8d59935

Download Submit
C:\Users\Admin\AppData\Local\Temp\oXOdSEs2zx.bat

Filesize
233B

MD5
9eb1612a84be52232b32a19a1a9a9e12

SHA1
b894a74e3ecf03173fb2f19191e64f1ed66227ac

SHA256
ad39573ad6c64bb674660a608a674a1e032b7f779ffc3d8b5a5d767bd66ce128

SHA512
1d471452bfd53a9e24c5ab4fdd050912ea25227f087a742937321ff963e3d205b145b4d4038e1d2a9e139c4047fa73ff78b27509c441f54c2b963ce51ae210e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\z5PBQAYZs7.bat

Filesize
185B

MD5
63b5fc394f1cff5b77a223086140cf40

SHA1
41a6b86ba50393074bc15f0f7417ec89390cde73

SHA256
1f9fbafb4085ccb6e7d71a911f94e04f7963e1ca1f7f78db8a3a875e457d0d34

SHA512
a2bd1af0cd8ed28de924caa0bb45ea553fb659f52c8adf6b1c97d3948a32e5dd2d0307f2e9df49ee994f2baf7be5dd4ab6d4f39a61141f1c78c6d012d2461e9b

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\e4ovr0xo\e4ovr0xo.0.cs

Filesize
379B

MD5
6e61158ff4660061662e2ea888756462

SHA1
8de33c4f0e6136652aa1f611321286657110ecba

SHA256
d6e25df5e2062f13cfdf29e2a76ea646c75b4aa36c86b7baf43f2df32fdcaebf

SHA512
a5b73689533f920a88edc26e31cf43ab8e273172f79f5548fc4698b924bfb698ab74d009fe70a93f9b15233ae7d46930f434203087353696525edffb9872f06f

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\e4ovr0xo\e4ovr0xo.cmdline

Filesize
235B

MD5
48be50e3edcc840694810608fcaedc33

SHA1
1a17e3f653716b6cea0c31b8dc1060226d49d21d

SHA256
e60b00e76a267b199bf18e5964c976f7e7bc8d344320ebb48c347d4d3d419c83

SHA512
9955c4e2f67842c6c57947dc54a7b2711f3ae820f66330c6ac6ce33d38fa333b97f2f984f0c512441ac81fc286b4e745276265d0589db6c275a2c201c58b8366

Download Submit
\??\c:\Windows\System32\CSCE7DED6ACE104479B32BA81D49CA36CB.TMP

Filesize
1KB

MD5
634e281a00b7b9f516c3048badfa1530

SHA1
af6369715ce2fe9b99609e470d4f66698880a35a

SHA256
0d990336ae793f3f6903048004c8d707d7a7191927bd7df46b7fe887116506c8

SHA512
1cb35fa0759f5362c9c7eee5546710874121005a3924bcfec2cf33ac90a257a807ce7ec0db7bc84dcb327604d708009449c34f52560ed936b54eeba49be7d27b

Download Submit
memory/3496-22-0x00007FFB85240000-0x00007FFB85D01000-memory.dmp

Filesize
10.8MB

Download
memory/3496-39-0x00007FFB85240000-0x00007FFB85D01000-memory.dmp

Filesize
10.8MB

Download
memory/3496-19-0x000000001BBA0000-0x000000001BBAE000-memory.dmp

Filesize
56KB

Download
memory/3496-95-0x00007FFB85240000-0x00007FFB85D01000-memory.dmp

Filesize
10.8MB

Download
memory/3496-17-0x0000000003170000-0x000000000317C000-memory.dmp

Filesize
48KB

Download
memory/3496-38-0x00007FFB85240000-0x00007FFB85D01000-memory.dmp

Filesize
10.8MB

Download
memory/3496-37-0x00007FFB85240000-0x00007FFB85D01000-memory.dmp

Filesize
10.8MB

Download
memory/3496-15-0x0000000003160000-0x000000000316C000-memory.dmp

Filesize
48KB

Download
memory/3496-27-0x00007FFB85240000-0x00007FFB85D01000-memory.dmp

Filesize
10.8MB

Download
memory/3496-23-0x00007FFB85240000-0x00007FFB85D01000-memory.dmp

Filesize
10.8MB

Download
memory/3496-0-0x00007FFB85243000-0x00007FFB85245000-memory.dmp

Filesize
8KB

Download
memory/3496-21-0x000000001BBB0000-0x000000001BBBC000-memory.dmp

Filesize
48KB

Download
memory/3496-1-0x0000000000D40000-0x0000000000F34000-memory.dmp

Filesize
2.0MB

Download
memory/3496-42-0x00007FFB85240000-0x00007FFB85D01000-memory.dmp

Filesize
10.8MB

Download
memory/3496-34-0x00007FFB85240000-0x00007FFB85D01000-memory.dmp

Filesize
10.8MB

Download
memory/3496-12-0x00000000031A0000-0x00000000031B8000-memory.dmp

Filesize
96KB

Download
memory/3496-13-0x00007FFB85240000-0x00007FFB85D01000-memory.dmp

Filesize
10.8MB

Download
memory/3496-10-0x000000001C050000-0x000000001C0A0000-memory.dmp

Filesize
320KB

Download
memory/3496-9-0x0000000003180000-0x000000000319C000-memory.dmp

Filesize
112KB

Download
memory/3496-7-0x00007FFB85240000-0x00007FFB85D01000-memory.dmp

Filesize
10.8MB

Download
memory/3496-6-0x0000000003150000-0x000000000315E000-memory.dmp

Filesize
56KB

Download
memory/3496-4-0x00007FFB85240000-0x00007FFB85D01000-memory.dmp

Filesize
10.8MB

Download
memory/3496-3-0x00007FFB85240000-0x00007FFB85D01000-memory.dmp

Filesize
10.8MB

Download
memory/3496-2-0x00007FFB85240000-0x00007FFB85D01000-memory.dmp

Filesize
10.8MB

Download
memory/4456-81-0x00000297F59C0000-0x00000297F59E2000-memory.dmp

Filesize
136KB

Download