dcrat | 953aacd9a29d2fcde8161d65a0279453072f1f13a1c4d776dac127a9d10dbb72

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-12-2024 23:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_953aacd9a29d2fcde8161d65a0279453072f1f13a1c4d776dac127a9d10dbb72.exe
Size

1.3MB
MD5

7e0bc3dca926a7b5294b8c30e575c275
SHA1

ec929ef0ec7348699cd343f351409a44847f790b
SHA256

953aacd9a29d2fcde8161d65a0279453072f1f13a1c4d776dac127a9d10dbb72
SHA512

5a2244d43ee41f0c06bd03924ac4b58f113d60784e06f412eb7bdf7d6f5e87add997a5c4322f872a94c77ffb6a5e115c4783454e04ec578f2f887552211819c0
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 30 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	656	5072	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3812	5072	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3928	5072	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3772	5072	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4108	5072	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3964	5072	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4928	5072	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2260	5072	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4912	5072	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2936	5072	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2216	5072	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2148	5072	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3952	5072	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2824	5072	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2424	5072	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4504	5072	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3480	5072	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2912	5072	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2244	5072	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2348	5072	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3824	5072	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3648	5072	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1296	5072	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3092	5072	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4192	5072	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1756	5072	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	628	5072	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4328	5072	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4332	5072	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4392	5072	schtasks.exe	88

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x0008000000023bee-10.dat	dcrat
behavioral2/memory/316-13-0x0000000000D60000-0x0000000000E70000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2528	powershell.exe
4244	powershell.exe
1020	powershell.exe
4824	powershell.exe
1492	powershell.exe
3020	powershell.exe
3636	powershell.exe
4264	powershell.exe
2256	powershell.exe
5032	powershell.exe
1500	powershell.exe
1848	powershell.exe

Checks computer location settings 2 TTPs 16 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	JaffaCakes118_953aacd9a29d2fcde8161d65a0279453072f1f13a1c4d776dac127a9d10dbb72.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	dllhost.exe

Executes dropped EXE 14 IoCs

pid	Process
316	DllCommonsvc.exe
1700	DllCommonsvc.exe
4328	dllhost.exe
5008	dllhost.exe
656	dllhost.exe
4824	dllhost.exe
644	dllhost.exe
2196	dllhost.exe
4868	dllhost.exe
372	dllhost.exe
840	dllhost.exe
396	dllhost.exe
924	dllhost.exe
3220	dllhost.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 13 IoCs

Web Service

T1102

flow	ioc
17	raw.githubusercontent.com
37	raw.githubusercontent.com
41	raw.githubusercontent.com
42	raw.githubusercontent.com
43	raw.githubusercontent.com
50	raw.githubusercontent.com
51	raw.githubusercontent.com
16	raw.githubusercontent.com
53	raw.githubusercontent.com
54	raw.githubusercontent.com
52	raw.githubusercontent.com
36	raw.githubusercontent.com
32	raw.githubusercontent.com

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\loc\66fc9ff0ee96c2	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\e6c9b481da804f	DllCommonsvc.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\ea9f0e6c9e2dcd	DllCommonsvc.exe
File created	C:\Program Files\Microsoft Office\root\loc\sihost.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Media Player\Media Renderer\9e8d7a4ca61bd9	DllCommonsvc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\loc\sihost.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\OfficeClickToRun.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\taskhostw.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Media Player\Media Renderer\RuntimeBroker.exe	DllCommonsvc.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\TAPI\9e8d7a4ca61bd9	DllCommonsvc.exe
File created	C:\Windows\bcastdvr\dwm.exe	DllCommonsvc.exe
File created	C:\Windows\bcastdvr\6cb0b6c459d5d3	DllCommonsvc.exe
File created	C:\Windows\TAPI\RuntimeBroker.exe	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_953aacd9a29d2fcde8161d65a0279453072f1f13a1c4d776dac127a9d10dbb72.exe

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	JaffaCakes118_953aacd9a29d2fcde8161d65a0279453072f1f13a1c4d776dac127a9d10dbb72.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	dllhost.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 30 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
656	schtasks.exe
3952	schtasks.exe
3092	schtasks.exe
4392	schtasks.exe
4928	schtasks.exe
2936	schtasks.exe
2244	schtasks.exe
1296	schtasks.exe
4504	schtasks.exe
3812	schtasks.exe
3772	schtasks.exe
3964	schtasks.exe
2424	schtasks.exe
2216	schtasks.exe
2912	schtasks.exe
2348	schtasks.exe
3928	schtasks.exe
3824	schtasks.exe
3648	schtasks.exe
4328	schtasks.exe
4912	schtasks.exe
2148	schtasks.exe
4108	schtasks.exe
2260	schtasks.exe
4192	schtasks.exe
4332	schtasks.exe
2824	schtasks.exe
3480	schtasks.exe
1756	schtasks.exe
628	schtasks.exe

Suspicious behavior: EnumeratesProcesses 54 IoCs

pid	Process
316	DllCommonsvc.exe
316	DllCommonsvc.exe
316	DllCommonsvc.exe
1492	powershell.exe
3020	powershell.exe
1848	powershell.exe
1500	powershell.exe
1492	powershell.exe
3020	powershell.exe
1848	powershell.exe
1500	powershell.exe
1700	DllCommonsvc.exe
1700	DllCommonsvc.exe
1700	DllCommonsvc.exe
1700	DllCommonsvc.exe
1700	DllCommonsvc.exe
1700	DllCommonsvc.exe
1700	DllCommonsvc.exe
3636	powershell.exe
5032	powershell.exe
2256	powershell.exe
2528	powershell.exe
4264	powershell.exe
4244	powershell.exe
4244	powershell.exe
4824	powershell.exe
4824	powershell.exe
1020	powershell.exe
1020	powershell.exe
1020	powershell.exe
3636	powershell.exe
3636	powershell.exe
2256	powershell.exe
2256	powershell.exe
5032	powershell.exe
5032	powershell.exe
2528	powershell.exe
2528	powershell.exe
4244	powershell.exe
4264	powershell.exe
4264	powershell.exe
4824	powershell.exe
4328	dllhost.exe
5008	dllhost.exe
656	dllhost.exe
4824	dllhost.exe
644	dllhost.exe
2196	dllhost.exe
4868	dllhost.exe
372	dllhost.exe
840	dllhost.exe
396	dllhost.exe
924	dllhost.exe
3220	dllhost.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: SeDebugPrivilege	316	DllCommonsvc.exe
Token: SeDebugPrivilege	1492	powershell.exe
Token: SeDebugPrivilege	3020	powershell.exe
Token: SeDebugPrivilege	1848	powershell.exe
Token: SeDebugPrivilege	1500	powershell.exe
Token: SeDebugPrivilege	1700	DllCommonsvc.exe
Token: SeDebugPrivilege	3636	powershell.exe
Token: SeDebugPrivilege	5032	powershell.exe
Token: SeDebugPrivilege	2256	powershell.exe
Token: SeDebugPrivilege	2528	powershell.exe
Token: SeDebugPrivilege	4264	powershell.exe
Token: SeDebugPrivilege	4824	powershell.exe
Token: SeDebugPrivilege	4244	powershell.exe
Token: SeDebugPrivilege	1020	powershell.exe
Token: SeDebugPrivilege	4328	dllhost.exe
Token: SeDebugPrivilege	5008	dllhost.exe
Token: SeDebugPrivilege	656	dllhost.exe
Token: SeDebugPrivilege	4824	dllhost.exe
Token: SeDebugPrivilege	644	dllhost.exe
Token: SeDebugPrivilege	2196	dllhost.exe
Token: SeDebugPrivilege	4868	dllhost.exe
Token: SeDebugPrivilege	372	dllhost.exe
Token: SeDebugPrivilege	840	dllhost.exe
Token: SeDebugPrivilege	396	dllhost.exe
Token: SeDebugPrivilege	924	dllhost.exe
Token: SeDebugPrivilege	3220	dllhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2424 wrote to memory of 3532	2424	JaffaCakes118_953aacd9a29d2fcde8161d65a0279453072f1f13a1c4d776dac127a9d10dbb72.exe	83
PID 2424 wrote to memory of 3532	2424	JaffaCakes118_953aacd9a29d2fcde8161d65a0279453072f1f13a1c4d776dac127a9d10dbb72.exe	83
PID 2424 wrote to memory of 3532	2424	JaffaCakes118_953aacd9a29d2fcde8161d65a0279453072f1f13a1c4d776dac127a9d10dbb72.exe	83
PID 3532 wrote to memory of 2376	3532	WScript.exe	85
PID 3532 wrote to memory of 2376	3532	WScript.exe	85
PID 3532 wrote to memory of 2376	3532	WScript.exe	85
PID 2376 wrote to memory of 316	2376	cmd.exe	87
PID 2376 wrote to memory of 316	2376	cmd.exe	87
PID 316 wrote to memory of 1500	316	DllCommonsvc.exe	99
PID 316 wrote to memory of 1500	316	DllCommonsvc.exe	99
PID 316 wrote to memory of 1492	316	DllCommonsvc.exe	100
PID 316 wrote to memory of 1492	316	DllCommonsvc.exe	100
PID 316 wrote to memory of 1848	316	DllCommonsvc.exe	101
PID 316 wrote to memory of 1848	316	DllCommonsvc.exe	101
PID 316 wrote to memory of 3020	316	DllCommonsvc.exe	102
PID 316 wrote to memory of 3020	316	DllCommonsvc.exe	102
PID 316 wrote to memory of 3684	316	DllCommonsvc.exe	106
PID 316 wrote to memory of 3684	316	DllCommonsvc.exe	106
PID 3684 wrote to memory of 2292	3684	cmd.exe	109
PID 3684 wrote to memory of 2292	3684	cmd.exe	109
PID 3684 wrote to memory of 1700	3684	cmd.exe	111
PID 3684 wrote to memory of 1700	3684	cmd.exe	111
PID 1700 wrote to memory of 3636	1700	DllCommonsvc.exe	133
PID 1700 wrote to memory of 3636	1700	DllCommonsvc.exe	133
PID 1700 wrote to memory of 2256	1700	DllCommonsvc.exe	134
PID 1700 wrote to memory of 2256	1700	DllCommonsvc.exe	134
PID 1700 wrote to memory of 4264	1700	DllCommonsvc.exe	135
PID 1700 wrote to memory of 4264	1700	DllCommonsvc.exe	135
PID 1700 wrote to memory of 2528	1700	DllCommonsvc.exe	136
PID 1700 wrote to memory of 2528	1700	DllCommonsvc.exe	136
PID 1700 wrote to memory of 4244	1700	DllCommonsvc.exe	137
PID 1700 wrote to memory of 4244	1700	DllCommonsvc.exe	137
PID 1700 wrote to memory of 5032	1700	DllCommonsvc.exe	139
PID 1700 wrote to memory of 5032	1700	DllCommonsvc.exe	139
PID 1700 wrote to memory of 4824	1700	DllCommonsvc.exe	140
PID 1700 wrote to memory of 4824	1700	DllCommonsvc.exe	140
PID 1700 wrote to memory of 1020	1700	DllCommonsvc.exe	141
PID 1700 wrote to memory of 1020	1700	DllCommonsvc.exe	141
PID 1700 wrote to memory of 3672	1700	DllCommonsvc.exe	149
PID 1700 wrote to memory of 3672	1700	DllCommonsvc.exe	149
PID 3672 wrote to memory of 1912	3672	cmd.exe	151
PID 3672 wrote to memory of 1912	3672	cmd.exe	151
PID 3672 wrote to memory of 4328	3672	cmd.exe	155
PID 3672 wrote to memory of 4328	3672	cmd.exe	155
PID 4328 wrote to memory of 540	4328	dllhost.exe	166
PID 4328 wrote to memory of 540	4328	dllhost.exe	166
PID 540 wrote to memory of 4880	540	cmd.exe	168
PID 540 wrote to memory of 4880	540	cmd.exe	168
PID 540 wrote to memory of 5008	540	cmd.exe	172
PID 540 wrote to memory of 5008	540	cmd.exe	172
PID 5008 wrote to memory of 3156	5008	dllhost.exe	174
PID 5008 wrote to memory of 3156	5008	dllhost.exe	174
PID 3156 wrote to memory of 4464	3156	cmd.exe	176
PID 3156 wrote to memory of 4464	3156	cmd.exe	176
PID 3156 wrote to memory of 656	3156	cmd.exe	179
PID 3156 wrote to memory of 656	3156	cmd.exe	179
PID 656 wrote to memory of 3460	656	dllhost.exe	181
PID 656 wrote to memory of 3460	656	dllhost.exe	181
PID 3460 wrote to memory of 2820	3460	cmd.exe	183
PID 3460 wrote to memory of 2820	3460	cmd.exe	183
PID 3460 wrote to memory of 4824	3460	cmd.exe	185
PID 3460 wrote to memory of 4824	3460	cmd.exe	185
PID 4824 wrote to memory of 4720	4824	dllhost.exe	187
PID 4824 wrote to memory of 4720	4824	dllhost.exe	187

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_953aacd9a29d2fcde8161d65a0279453072f1f13a1c4d776dac127a9d10dbb72.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_953aacd9a29d2fcde8161d65a0279453072f1f13a1c4d776dac127a9d10dbb72.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2424
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3532
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2376
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Program Files directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:316
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1500
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\taskhostw.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1492
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\taskhostw.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1848
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Media Player\Media Renderer\RuntimeBroker.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3020
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\P4JNtiPIdI.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3684
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:2292
      - C:\providercommon\DllCommonsvc.exe
        
        "C:\providercommon\DllCommonsvc.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Program Files directory
        Drops file in Windows directory
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1700
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3636
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Microsoft Office\root\loc\sihost.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2256
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\sppsvc.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4264
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\dllhost.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2528
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Multimedia Platform\OfficeClickToRun.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4244
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\bcastdvr\dwm.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5032
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\TAPI\RuntimeBroker.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4824
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\fontdrvhost.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1020
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Ev5ppgtdRv.bat"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:3672
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:1912
        
        C:\Users\Default\dllhost.exe
        
        "C:\Users\Default\dllhost.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4328
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\qwBPskakqG.bat"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:540
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:4880
        
        C:\Users\Default\dllhost.exe
        
        "C:\Users\Default\dllhost.exe"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5008
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\iIDKKqsGny.bat"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:3156
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:4464
        
        C:\Users\Default\dllhost.exe
        
        "C:\Users\Default\dllhost.exe"
        12⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:656
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\j95GpUP4tv.bat"
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:3460
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        14⤵
        
        PID:2820
        
        C:\Users\Default\dllhost.exe
        
        "C:\Users\Default\dllhost.exe"
        14⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4824
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\EYKlAcFNfO.bat"
        15⤵
        
        PID:4720
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        16⤵
        
        PID:3604
        
        C:\Users\Default\dllhost.exe
        
        "C:\Users\Default\dllhost.exe"
        16⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:644
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\XIQ15LoDrx.bat"
        17⤵
        
        PID:1972
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        18⤵
        
        PID:4708
        
        C:\Users\Default\dllhost.exe
        
        "C:\Users\Default\dllhost.exe"
        18⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2196
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\QOz0umrEhM.bat"
        19⤵
        
        PID:3268
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        20⤵
        
        PID:540
        
        C:\Users\Default\dllhost.exe
        
        "C:\Users\Default\dllhost.exe"
        20⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4868
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\UMOyPGkKXB.bat"
        21⤵
        
        PID:4864
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        22⤵
        
        PID:468
        
        C:\Users\Default\dllhost.exe
        
        "C:\Users\Default\dllhost.exe"
        22⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:372
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\wzkVYe0vvu.bat"
        23⤵
        
        PID:2268
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        24⤵
        
        PID:3056
        
        C:\Users\Default\dllhost.exe
        
        "C:\Users\Default\dllhost.exe"
        24⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:840
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\BlQmztffGe.bat"
        25⤵
        
        PID:3404
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        26⤵
        
        PID:4352
        
        C:\Users\Default\dllhost.exe
        
        "C:\Users\Default\dllhost.exe"
        26⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:396
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\3npectBbsF.bat"
        27⤵
        
        PID:4576
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        28⤵
        
        PID:1572
        
        C:\Users\Default\dllhost.exe
        
        "C:\Users\Default\dllhost.exe"
        28⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:924
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\pCeLVPpGxY.bat"
        29⤵
        
        PID:4952
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        30⤵
        
        PID:208
        
        C:\Users\Default\dllhost.exe
        
        "C:\Users\Default\dllhost.exe"
        30⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3220
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\WRY5ahHPmz.bat"
        31⤵
        
        PID:2944
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        32⤵
        
        PID:2388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 9 /tr "'C:\Users\Default\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Users\Default\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 14 /tr "'C:\Users\Default\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Media Player\Media Renderer\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Windows Media Player\Media Renderer\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2260

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Media Player\Media Renderer\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 11 /tr "'C:\Program Files\Microsoft Office\root\loc\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\root\loc\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 12 /tr "'C:\Program Files\Microsoft Office\root\loc\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4332

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4328

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Users\Default\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Default\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4192

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Users\Default\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2148

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Multimedia Platform\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 5 /tr "'C:\Windows\bcastdvr\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\bcastdvr\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 7 /tr "'C:\Windows\bcastdvr\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Windows\TAPI\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2424

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\TAPI\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Windows\TAPI\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1296

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\DllCommonsvc.exe.log

Filesize
1KB

MD5
7f3c0ae41f0d9ae10a8985a2c327b8fb

SHA1
d58622bf6b5071beacf3b35bb505bde2000983e3

SHA256
519fceae4d0dd4d09edd1b81bcdfa8aeab4b59eee77a4cd4b6295ce8e591a900

SHA512
8a8fd17eef071f86e672cba0d8fc2cfed6118aff816100b9d7c06eb96443c04c04bc5692259c8d7ecb1563e877921939c61726605af4f969e3f586f0913ed125

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\dllhost.exe.log

Filesize
1KB

MD5
baf55b95da4a601229647f25dad12878

SHA1
abc16954ebfd213733c4493fc1910164d825cac8

SHA256
ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

SHA512
24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
2d06ce10e4e5b9e174b5ebbdad300fad

SHA1
bcc1c231e22238cef02ae25331320060ada2f131

SHA256
87d1dd56f12a88907ba5aebca8d555443d6f77ed214497277cc8bcd31c669f2c

SHA512
38cfbeb59605854ae4fcfae8619a6b26bd916148acfb5636383672a3960b45ca41fed5c241f97465129e92eaf78c4c85dcf258f1ab501a2bf771287ce04f76a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
624e41a75a6dfd62039973dbbfdbe622

SHA1
f791e4cc85d6ae7039acef57a9025b173d7e963b

SHA256
ced1b5ac330145fa608627ad4de1dfb3533375f19b6da3d02ad202d0b7732bc1

SHA512
a13a128a5ea8aad3bcd5f3dbffa5fbfe7763370d8e43b546a1df1da3b0ec0d520cf5fcc8c25c22fd1e73ea1d00da1bee99305e028e71e193339e4fa8ce8f0b2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
a83ce2908066654f712d1858746bc3c4

SHA1
14887f0537ce076cdc91801fb5fa584b25f1089f

SHA256
7c32ae0eaa4fef7404ce708744116ab8ea17d9575bbb3b06eb41a443f963456f

SHA512
991b20116815c7db3497d0ede9a216c7b78795e65f898847ffec513692f0c24d146a123725d14a2e1e3efb5744a626dd025a364f2f55f581e21640794a0cc551

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d3e8199b4634731cf0a0c26c1f14f588

SHA1
7f8fae27eb80055a436a6b5457978f32673d9ad4

SHA256
ef33f487f93c2977e92fb08d6bdcc9d48b5d1864c402f9d3fbf3e1b30e8b3b9a

SHA512
806a123100dbc1ca1b27bbad5b93c3a9a840dc795127af8523333a71259a8c5ef8aefccb83ef390f2644e013f138c4b7b63c584acccb197aada0c70c038032e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
32b16440fab3a1055d9c22b90935bdfb

SHA1
ee350c4a65b81468487a3660dfe4f373660b9070

SHA256
ee68b728a82fefc941eba10390d9d70f5aeb442039c901eaf9a18477761cfd35

SHA512
5a1f36ab56e25548fd2875d364cfec39830e855b89628718f786bb8158147ee6fd66f2b7477d1b57b0d8cec5b8f10d173face18f4131ecec0dc67ca9ae56216c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d3716b82c5009c75652c2c932d402f5d

SHA1
0e24eac9215e30354c17dc6160f33d388b9ad0d6

SHA256
b3911ffe77953188bed116540c479628120a2ca207c67b48d201cd1a0f415489

SHA512
29955e69b15cece9f0b1cc85b217371d4504abbb4bccd9cf41e52af271be4ce87bc974ae7ee8a86c490c2c68b3159210191a62f423ffead5ecc7f8b6211f5d4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
77d622bb1a5b250869a3238b9bc1402b

SHA1
d47f4003c2554b9dfc4c16f22460b331886b191b

SHA256
f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

SHA512
d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6d3e9c29fe44e90aae6ed30ccf799ca8

SHA1
c7974ef72264bbdf13a2793ccf1aed11bc565dce

SHA256
2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

SHA512
60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6d42b6da621e8df5674e26b799c8e2aa

SHA1
ab3ce1327ea1eeedb987ec823d5e0cb146bafa48

SHA256
5ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c

SHA512
53faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29

Download Submit
C:\Users\Admin\AppData\Local\Temp\3npectBbsF.bat

Filesize
193B

MD5
c2d05b5a898f4ba5d7adca7d429c9248

SHA1
170a14f3fc13cef4a86aa36c7f8d5fb11a5a9b92

SHA256
77bb72ca91af3f93abad68e92b29b0fb8c2f4a4ca3d8e58810a10e52333dd5ea

SHA512
9b5c6efaffb053fecc3e29bcd629771d466cca1620a422783280f9a9f901520a09e0736d0e109d721c17a5b61b2f2bba1fa1ffbee2139644dec681cffa5f16ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\BlQmztffGe.bat

Filesize
193B

MD5
8af1045cc5c36b19fc8d1276f7b81bc0

SHA1
79352464beccca073ad8e0c9a2c841487b495357

SHA256
b878f9bcd1069c5a93ae802c674e39407cf999bc966bf6f5dd1590c6882798fa

SHA512
8b140189faf7ed308c5d0d0f851741d45d7d71687c402352219a4020e6e417c6e6b4a5d67031e535edaed17b35e8a4e7c86fde365b4abcef92b1f3f01c37692c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ev5ppgtdRv.bat

Filesize
193B

MD5
943858495d7e05b8675f3e3a6235b98f

SHA1
2778c6ffe7dee568df319aa603c1ec097130889b

SHA256
7a8f13bfb89975c3901569553e2a525aac9fcf63b0747fbf868a46f4f4a54dd5

SHA512
025ad5d1238459d8dbbe0dd534b8ab2b6c30cc2677667364eeab4bd25669a2fc2880391f1d50261897dba137e8d4ea32dbc5d6f14749ed906f8797e3b2015139

Download Submit
C:\Users\Admin\AppData\Local\Temp\P4JNtiPIdI.bat

Filesize
199B

MD5
bacc7daea5008c7be7a4c810cb3680f8

SHA1
fca10091778203040c90a24ff617b7f35c47e3ce

SHA256
3794644b86223d6d9b81f5d03d722a705e4b73370cf5f2f2a5897319104f75d2

SHA512
8124e6934ad136d55d7a7ded50f1eb0c7f7738228db54b9000e2e79450d4684f7de810961a87c78def2babb078a47be3a3dfc32be6d2b00f3c086386cd0185ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\QOz0umrEhM.bat

Filesize
193B

MD5
b55f2f53066c38a1db6f2bef184d0bbd

SHA1
16b84351711756adb853146cef5a48aa66ca70ee

SHA256
0b609b1c33545399c248f4c08de86f133c24e6b4175f9c08e10e745afc92fa73

SHA512
bf7a157059e9bfa46fe9e2ff3a172e1e736d09c8cb57033f908e788043913444550fc719bdb279b86bc2d27c385329281d03db250992109c3320f02b14ccf965

Download Submit
C:\Users\Admin\AppData\Local\Temp\UMOyPGkKXB.bat

Filesize
193B

MD5
80bf345702e41d53796fddf9c76a7171

SHA1
b4f604c07abdcd7d2158b9ffa08ff73d0af741a6

SHA256
a1ff9d0b77a18fe1b59975a94a982b6c556e4e173ebf73e538935cb1ac4a53fe

SHA512
f15b85f0894f7a8e9890cff49a1f976ae0db87bf5645b0323764901278037350cab9449e0114d1cf85a4ad05afd1c9c9f64cbdc12eb44dc1b127c7ca2640e113

Download Submit
C:\Users\Admin\AppData\Local\Temp\WRY5ahHPmz.bat

Filesize
193B

MD5
910c8d9baef03a43aa726c23712567ae

SHA1
26b866e046215bdf51a9aa95a3bbc45adb40e633

SHA256
26fb792dee10e06ac6494f837b725ccbeb3ffa09e68ee318622baca066ff1cb4

SHA512
5e53355128159e65b9464cf628361859bb30878e2088e64664d75d895ff2deb7165733135843b1cbe3db2bddf29d6d781094dcf270d650c910039d6eb8515ad4

Download Submit
C:\Users\Admin\AppData\Local\Temp\XIQ15LoDrx.bat

Filesize
193B

MD5
1c33a9383589fa7519ab16af07d050a6

SHA1
796713b0a75bd59a4c86d4c7d5433ac3692eb7c8

SHA256
9e265dba17951f5a5492c5277faa1190547910c1d69473c66759f08280235295

SHA512
4964986530329f79c8018eec8aacc539667ba8d8dc491b2caabdad0875f8c44f31b02de0a5d23818253508546374e9ba7e78010c38fb8f1536244a920c5c9d7b

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kl2hc2of.jui.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\iIDKKqsGny.bat

Filesize
193B

MD5
e479804632d07fb6140ee6a74ac10558

SHA1
a363941be2e7ed5c41977ea8877a4e7d22a89795

SHA256
b6f4ea2b3e179c7cf21c5e2a50efd509ef317ee970a84c4533ee1f38b79bb3ed

SHA512
31189239834a32c998eff14c6b3d850e286c71c41b57ed2d7a9dd20cfe99dc97fb0b4aea4ec5dc07c6594acfd4e71c78f947e904b2fc98258cb07f50fb2b5e8e

Download Submit
C:\Users\Admin\AppData\Local\Temp\j95GpUP4tv.bat

Filesize
193B

MD5
f4429362e3137ececa86fb29fd0744ce

SHA1
8030d1b4b93b125b1d55d6d7acbb436e8932a307

SHA256
89d611f25e8868110894d8ef6b0ceac0ca23e35fd34916e25aef74b403e6edc1

SHA512
9e216aa4294f0fc191e57c02900f934ab60cd6e81366869df5c3bbbecc590de11db6f2b5d91deb7a87e351ab20fbb86a763477ba277d3898ca86cca2bf83e929

Download Submit
C:\Users\Admin\AppData\Local\Temp\pCeLVPpGxY.bat

Filesize
193B

MD5
b2c1611f89940e09d01d7fab08d65ed8

SHA1
37f6d11f0015226aea7334b0b351e9add26e0e5a

SHA256
2b7ac4f811efb871148e34296662108c35b82d8e44e4848dfbb280d45ac7ae5f

SHA512
e9b57a643c70b2ca31fa5d8b4a8b3ea45fd27594b5c533d7e3435f4d525fc3231fbf4c3b7317cd25018a2f3daa42b061462244dbd96058c22a358695a7333df5

Download Submit
C:\Users\Admin\AppData\Local\Temp\qwBPskakqG.bat

Filesize
193B

MD5
a47225c5d75144b5dada4b91629cf672

SHA1
b3009dc5217711e7bdf10dbe8825c6e32ecda652

SHA256
b8d806387b0b1681ab0102989a7a1df545b8f9c241b24c889fe87d61ff012f2d

SHA512
4777fb58fbb7b077d9b915dd3c7fed9a42764ce00faa6d47a0be1f2367aebd419dafc8b95aa4d11cabf1bfd2fc1d1114e0ee62662732f12c671ced49fca19193

Download Submit
C:\Users\Admin\AppData\Local\Temp\wzkVYe0vvu.bat

Filesize
193B

MD5
1fb56def1a2d5d8bfd102c3b99e84b04

SHA1
a68b1ea228e516fb786bfbd31dd4c1f59b0eb367

SHA256
4a2af98f4329fc3cbb4443b096dbaa621afd5ddac810fad4cb20f589f6647ac0

SHA512
48964ec11ae6021cf491c380d41ed6ea8e8776ed952f7daac52609f4d66f8270eeef464437692db99801b9eb37ef516ed1c17f00bcb033c30b341eb5a5e9f337

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/316-15-0x0000000002F90000-0x0000000002F9C000-memory.dmp

Filesize
48KB

Download
memory/316-14-0x0000000002F80000-0x0000000002F92000-memory.dmp

Filesize
72KB

Download
memory/316-13-0x0000000000D60000-0x0000000000E70000-memory.dmp

Filesize
1.1MB

Download
memory/316-12-0x00007FF98C073000-0x00007FF98C075000-memory.dmp

Filesize
8KB

Download
memory/316-16-0x0000000002FA0000-0x0000000002FAC000-memory.dmp

Filesize
48KB

Download
memory/316-17-0x0000000002FB0000-0x0000000002FBC000-memory.dmp

Filesize
48KB

Download
memory/396-246-0x0000000001130000-0x0000000001142000-memory.dmp

Filesize
72KB

Download
memory/656-203-0x0000000002F30000-0x0000000002F42000-memory.dmp

Filesize
72KB

Download
memory/924-253-0x0000000002A30000-0x0000000002A42000-memory.dmp

Filesize
72KB

Download
memory/1492-38-0x00000225CF2E0000-0x00000225CF302000-memory.dmp

Filesize
136KB

Download
memory/2196-221-0x000000001B940000-0x000000001B952000-memory.dmp

Filesize
72KB

Download
memory/5008-196-0x0000000001260000-0x0000000001272000-memory.dmp

Filesize
72KB

Download