dcrat | a42c1b99cb5b3e5374801aea56d1181187ed34c8a15c35e2b190aa89dbae56d4

Analysis

max time kernel
145s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21/12/2024, 22:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_a42c1b99cb5b3e5374801aea56d1181187ed34c8a15c35e2b190aa89dbae56d4.exe
Size

1.3MB
MD5

b02780fe26f301f340c8d5b909e5df32
SHA1

fb0d072d1a0d35446af2fcf615920b0dfb337601
SHA256

a42c1b99cb5b3e5374801aea56d1181187ed34c8a15c35e2b190aa89dbae56d4
SHA512

1da3e5d0cdf62f0b9879f0de1c2902b0a48e62eded3fb87d2f9ffec804e72c52e0dc35c20144881d377708f5c69675362886cc560f673ace288bc148ba3e21a0
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 36 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	636	2764	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3012	2764	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3056	2764	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3568	2764	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3384	2764	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2960	2764	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2384	2764	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1372	2764	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4232	2764	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	736	2764	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4864	2764	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2616	2764	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4616	2764	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2552	2764	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2312	2764	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2828	2764	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4404	2764	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3608	2764	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2720	2764	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2548	2764	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2028	2764	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4428	2764	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3080	2764	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4056	2764	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3460	2764	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4420	2764	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2800	2764	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3432	2764	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4004	2764	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3600	2764	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2636	2764	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3288	2764	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3400	2764	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	944	2764	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3532	2764	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4360	2764	schtasks.exe	87

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x0007000000023c9b-10.dat	dcrat
behavioral2/memory/2108-13-0x0000000000A20000-0x0000000000B30000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 13 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2280	powershell.exe
1524	powershell.exe
2288	powershell.exe
2908	powershell.exe
3572	powershell.exe
2680	powershell.exe
2736	powershell.exe
3924	powershell.exe
1284	powershell.exe
332	powershell.exe
4784	powershell.exe
2400	powershell.exe
544	powershell.exe

Checks computer location settings 2 TTPs 15 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	JaffaCakes118_a42c1b99cb5b3e5374801aea56d1181187ed34c8a15c35e2b190aa89dbae56d4.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	wininit.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	wininit.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	wininit.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	wininit.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	wininit.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	wininit.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	wininit.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	wininit.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	wininit.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	wininit.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	wininit.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	wininit.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes dropped EXE 14 IoCs

pid	Process
2108	DllCommonsvc.exe
1628	wininit.exe
3476	wininit.exe
3080	wininit.exe
2520	wininit.exe
2872	wininit.exe
1956	wininit.exe
3096	wininit.exe
2244	wininit.exe
4700	wininit.exe
2408	wininit.exe
1004	wininit.exe
4484	wininit.exe
4428	wininit.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 13 IoCs

Web Service

T1102

flow	ioc
41	raw.githubusercontent.com
45	raw.githubusercontent.com
49	raw.githubusercontent.com
55	raw.githubusercontent.com
56	raw.githubusercontent.com
21	raw.githubusercontent.com
35	raw.githubusercontent.com
42	raw.githubusercontent.com
46	raw.githubusercontent.com
54	raw.githubusercontent.com
57	raw.githubusercontent.com
15	raw.githubusercontent.com
16	raw.githubusercontent.com

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft.NET\services.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft.NET\c5b4cb5e9653cc	DllCommonsvc.exe
File created	C:\Program Files\Windows Security\BrowserCore\sysmon.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Security\BrowserCore\121e5b5079f7c0	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft\OfficeClickToRun.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft\e6c9b481da804f	DllCommonsvc.exe
File created	C:\Program Files\Crashpad\attachments\upfc.exe	DllCommonsvc.exe
File created	C:\Program Files\Crashpad\attachments\ea1d8f6d871115	DllCommonsvc.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\RemotePackages\OfficeClickToRun.exe	DllCommonsvc.exe
File created	C:\Windows\RemotePackages\e6c9b481da804f	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_a42c1b99cb5b3e5374801aea56d1181187ed34c8a15c35e2b190aa89dbae56d4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 13 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	wininit.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	wininit.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	wininit.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	wininit.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	wininit.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	wininit.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	wininit.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	wininit.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	wininit.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	JaffaCakes118_a42c1b99cb5b3e5374801aea56d1181187ed34c8a15c35e2b190aa89dbae56d4.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	wininit.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	wininit.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	wininit.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 36 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3080	schtasks.exe
3432	schtasks.exe
3568	schtasks.exe
3384	schtasks.exe
736	schtasks.exe
4428	schtasks.exe
3460	schtasks.exe
2636	schtasks.exe
3056	schtasks.exe
2384	schtasks.exe
2028	schtasks.exe
4360	schtasks.exe
2552	schtasks.exe
2828	schtasks.exe
4404	schtasks.exe
2720	schtasks.exe
4004	schtasks.exe
3600	schtasks.exe
944	schtasks.exe
636	schtasks.exe
4232	schtasks.exe
3608	schtasks.exe
2616	schtasks.exe
4616	schtasks.exe
4420	schtasks.exe
3288	schtasks.exe
2960	schtasks.exe
4864	schtasks.exe
4056	schtasks.exe
2548	schtasks.exe
2800	schtasks.exe
3400	schtasks.exe
3532	schtasks.exe
3012	schtasks.exe
1372	schtasks.exe
2312	schtasks.exe

Suspicious behavior: EnumeratesProcesses 56 IoCs

pid	Process
2108	DllCommonsvc.exe
2108	DllCommonsvc.exe
2108	DllCommonsvc.exe
4784	powershell.exe
4784	powershell.exe
2288	powershell.exe
2288	powershell.exe
2680	powershell.exe
2680	powershell.exe
3924	powershell.exe
3924	powershell.exe
2400	powershell.exe
2400	powershell.exe
2280	powershell.exe
2280	powershell.exe
3572	powershell.exe
3572	powershell.exe
2908	powershell.exe
2908	powershell.exe
332	powershell.exe
332	powershell.exe
1284	powershell.exe
1284	powershell.exe
2736	powershell.exe
2736	powershell.exe
1524	powershell.exe
1524	powershell.exe
1628	wininit.exe
1628	wininit.exe
544	powershell.exe
544	powershell.exe
332	powershell.exe
1524	powershell.exe
2288	powershell.exe
1284	powershell.exe
2680	powershell.exe
4784	powershell.exe
2400	powershell.exe
2736	powershell.exe
2908	powershell.exe
3924	powershell.exe
544	powershell.exe
2280	powershell.exe
3572	powershell.exe
3476	wininit.exe
3080	wininit.exe
2520	wininit.exe
2872	wininit.exe
1956	wininit.exe
3096	wininit.exe
2244	wininit.exe
4700	wininit.exe
2408	wininit.exe
1004	wininit.exe
4484	wininit.exe
4428	wininit.exe

Suspicious use of AdjustPrivilegeToken 27 IoCs

description	pid	Process
Token: SeDebugPrivilege	2108	DllCommonsvc.exe
Token: SeDebugPrivilege	332	powershell.exe
Token: SeDebugPrivilege	1628	wininit.exe
Token: SeDebugPrivilege	4784	powershell.exe
Token: SeDebugPrivilege	2288	powershell.exe
Token: SeDebugPrivilege	1524	powershell.exe
Token: SeDebugPrivilege	2680	powershell.exe
Token: SeDebugPrivilege	3572	powershell.exe
Token: SeDebugPrivilege	2280	powershell.exe
Token: SeDebugPrivilege	2400	powershell.exe
Token: SeDebugPrivilege	3924	powershell.exe
Token: SeDebugPrivilege	2908	powershell.exe
Token: SeDebugPrivilege	1284	powershell.exe
Token: SeDebugPrivilege	2736	powershell.exe
Token: SeDebugPrivilege	544	powershell.exe
Token: SeDebugPrivilege	3476	wininit.exe
Token: SeDebugPrivilege	3080	wininit.exe
Token: SeDebugPrivilege	2520	wininit.exe
Token: SeDebugPrivilege	2872	wininit.exe
Token: SeDebugPrivilege	1956	wininit.exe
Token: SeDebugPrivilege	3096	wininit.exe
Token: SeDebugPrivilege	2244	wininit.exe
Token: SeDebugPrivilege	4700	wininit.exe
Token: SeDebugPrivilege	2408	wininit.exe
Token: SeDebugPrivilege	1004	wininit.exe
Token: SeDebugPrivilege	4484	wininit.exe
Token: SeDebugPrivilege	4428	wininit.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1236 wrote to memory of 452	1236	JaffaCakes118_a42c1b99cb5b3e5374801aea56d1181187ed34c8a15c35e2b190aa89dbae56d4.exe	83
PID 1236 wrote to memory of 452	1236	JaffaCakes118_a42c1b99cb5b3e5374801aea56d1181187ed34c8a15c35e2b190aa89dbae56d4.exe	83
PID 1236 wrote to memory of 452	1236	JaffaCakes118_a42c1b99cb5b3e5374801aea56d1181187ed34c8a15c35e2b190aa89dbae56d4.exe	83
PID 452 wrote to memory of 5088	452	WScript.exe	84
PID 452 wrote to memory of 5088	452	WScript.exe	84
PID 452 wrote to memory of 5088	452	WScript.exe	84
PID 5088 wrote to memory of 2108	5088	cmd.exe	86
PID 5088 wrote to memory of 2108	5088	cmd.exe	86
PID 2108 wrote to memory of 2400	2108	DllCommonsvc.exe	125
PID 2108 wrote to memory of 2400	2108	DllCommonsvc.exe	125
PID 2108 wrote to memory of 4784	2108	DllCommonsvc.exe	126
PID 2108 wrote to memory of 4784	2108	DllCommonsvc.exe	126
PID 2108 wrote to memory of 332	2108	DllCommonsvc.exe	127
PID 2108 wrote to memory of 332	2108	DllCommonsvc.exe	127
PID 2108 wrote to memory of 2680	2108	DllCommonsvc.exe	128
PID 2108 wrote to memory of 2680	2108	DllCommonsvc.exe	128
PID 2108 wrote to memory of 1284	2108	DllCommonsvc.exe	129
PID 2108 wrote to memory of 1284	2108	DllCommonsvc.exe	129
PID 2108 wrote to memory of 3572	2108	DllCommonsvc.exe	130
PID 2108 wrote to memory of 3572	2108	DllCommonsvc.exe	130
PID 2108 wrote to memory of 2908	2108	DllCommonsvc.exe	131
PID 2108 wrote to memory of 2908	2108	DllCommonsvc.exe	131
PID 2108 wrote to memory of 3924	2108	DllCommonsvc.exe	132
PID 2108 wrote to memory of 3924	2108	DllCommonsvc.exe	132
PID 2108 wrote to memory of 2288	2108	DllCommonsvc.exe	133
PID 2108 wrote to memory of 2288	2108	DllCommonsvc.exe	133
PID 2108 wrote to memory of 1524	2108	DllCommonsvc.exe	135
PID 2108 wrote to memory of 1524	2108	DllCommonsvc.exe	135
PID 2108 wrote to memory of 2280	2108	DllCommonsvc.exe	136
PID 2108 wrote to memory of 2280	2108	DllCommonsvc.exe	136
PID 2108 wrote to memory of 544	2108	DllCommonsvc.exe	137
PID 2108 wrote to memory of 544	2108	DllCommonsvc.exe	137
PID 2108 wrote to memory of 2736	2108	DllCommonsvc.exe	138
PID 2108 wrote to memory of 2736	2108	DllCommonsvc.exe	138
PID 2108 wrote to memory of 1628	2108	DllCommonsvc.exe	151
PID 2108 wrote to memory of 1628	2108	DllCommonsvc.exe	151
PID 1628 wrote to memory of 2932	1628	wininit.exe	153
PID 1628 wrote to memory of 2932	1628	wininit.exe	153
PID 2932 wrote to memory of 1632	2932	cmd.exe	155
PID 2932 wrote to memory of 1632	2932	cmd.exe	155
PID 2932 wrote to memory of 3476	2932	cmd.exe	162
PID 2932 wrote to memory of 3476	2932	cmd.exe	162
PID 3476 wrote to memory of 536	3476	wininit.exe	166
PID 3476 wrote to memory of 536	3476	wininit.exe	166
PID 536 wrote to memory of 3116	536	cmd.exe	168
PID 536 wrote to memory of 3116	536	cmd.exe	168
PID 536 wrote to memory of 3080	536	cmd.exe	176
PID 536 wrote to memory of 3080	536	cmd.exe	176
PID 3080 wrote to memory of 3952	3080	wininit.exe	178
PID 3080 wrote to memory of 3952	3080	wininit.exe	178
PID 3952 wrote to memory of 3056	3952	cmd.exe	180
PID 3952 wrote to memory of 3056	3952	cmd.exe	180
PID 3952 wrote to memory of 2520	3952	cmd.exe	183
PID 3952 wrote to memory of 2520	3952	cmd.exe	183
PID 2520 wrote to memory of 4756	2520	wininit.exe	185
PID 2520 wrote to memory of 4756	2520	wininit.exe	185
PID 4756 wrote to memory of 4064	4756	cmd.exe	187
PID 4756 wrote to memory of 4064	4756	cmd.exe	187
PID 4756 wrote to memory of 2872	4756	cmd.exe	189
PID 4756 wrote to memory of 2872	4756	cmd.exe	189
PID 2872 wrote to memory of 1632	2872	wininit.exe	191
PID 2872 wrote to memory of 1632	2872	wininit.exe	191
PID 1632 wrote to memory of 1524	1632	cmd.exe	193
PID 1632 wrote to memory of 1524	1632	cmd.exe	193

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a42c1b99cb5b3e5374801aea56d1181187ed34c8a15c35e2b190aa89dbae56d4.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a42c1b99cb5b3e5374801aea56d1181187ed34c8a15c35e2b190aa89dbae56d4.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1236
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:452
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5088
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2108
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2400
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4784
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Cookies\Idle.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:332
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Crashpad\attachments\upfc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2680
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\RuntimeBroker.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1284
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft.NET\services.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3572
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\taskhostw.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2908
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\RemotePackages\OfficeClickToRun.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3924
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Security\BrowserCore\sysmon.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2288
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\services.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1524
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\sppsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2280
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft\OfficeClickToRun.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:544
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\wininit.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2736
    - - C:\providercommon\wininit.exe
        
        "C:\providercommon\wininit.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1628
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\AsgPmp9HNF.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2932
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:1632
        
        C:\providercommon\wininit.exe
        
        "C:\providercommon\wininit.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3476
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\EzDSmeWZ76.bat"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:536
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:3116
        
        C:\providercommon\wininit.exe
        
        "C:\providercommon\wininit.exe"
        9⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3080
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\XdxpZ3I66P.bat"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:3952
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:3056
        
        C:\providercommon\wininit.exe
        
        "C:\providercommon\wininit.exe"
        11⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2520
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\eXOrkcF5G0.bat"
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:4756
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:4064
        
        C:\providercommon\wininit.exe
        
        "C:\providercommon\wininit.exe"
        13⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2872
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\989MOUOnUX.bat"
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:1632
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        15⤵
        
        PID:1524
        
        C:\providercommon\wininit.exe
        
        "C:\providercommon\wininit.exe"
        15⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1956
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ZZzsG8LzQB.bat"
        16⤵
        
        PID:2028
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        17⤵
        
        PID:2160
        
        C:\providercommon\wininit.exe
        
        "C:\providercommon\wininit.exe"
        17⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3096
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\J2mXRZwkCj.bat"
        18⤵
        
        PID:2752
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        19⤵
        
        PID:2700
        
        C:\providercommon\wininit.exe
        
        "C:\providercommon\wininit.exe"
        19⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2244
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\sJ59Arupck.bat"
        20⤵
        
        PID:3628
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        21⤵
        
        PID:3400
        
        C:\providercommon\wininit.exe
        
        "C:\providercommon\wininit.exe"
        21⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4700
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\J2mXRZwkCj.bat"
        22⤵
        
        PID:2880
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        23⤵
        
        PID:2312
        
        C:\providercommon\wininit.exe
        
        "C:\providercommon\wininit.exe"
        23⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2408
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\AsgPmp9HNF.bat"
        24⤵
        
        PID:32
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        25⤵
        
        PID:1656
        
        C:\providercommon\wininit.exe
        
        "C:\providercommon\wininit.exe"
        25⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1004
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\qO35UmqwIy.bat"
        26⤵
        
        PID:2332
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        27⤵
        
        PID:868
        
        C:\providercommon\wininit.exe
        
        "C:\providercommon\wininit.exe"
        27⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4484
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\IrGY9odMle.bat"
        28⤵
        
        PID:1980
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        29⤵
        
        PID:840
        
        C:\providercommon\wininit.exe
        
        "C:\providercommon\wininit.exe"
        29⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\Cookies\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Users\Admin\Cookies\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3384

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\Cookies\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 9 /tr "'C:\Program Files\Crashpad\attachments\upfc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2384

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Program Files\Crashpad\attachments\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 11 /tr "'C:\Program Files\Crashpad\attachments\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4232

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\providercommon\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\providercommon\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\providercommon\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Microsoft.NET\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Microsoft.NET\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2312

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 13 /tr "'C:\providercommon\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\providercommon\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 10 /tr "'C:\providercommon\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 14 /tr "'C:\Windows\RemotePackages\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Windows\RemotePackages\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 6 /tr "'C:\Windows\RemotePackages\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Security\BrowserCore\sysmon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Program Files\Windows Security\BrowserCore\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Security\BrowserCore\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 11 /tr "'C:\providercommon\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\providercommon\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4420

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 8 /tr "'C:\providercommon\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 11 /tr "'C:\providercommon\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\providercommon\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 13 /tr "'C:\providercommon\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Microsoft\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3288

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Microsoft\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'C:\providercommon\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\providercommon\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\providercommon\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\wininit.exe.log

Filesize
1KB

MD5
baf55b95da4a601229647f25dad12878

SHA1
abc16954ebfd213733c4493fc1910164d825cac8

SHA256
ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

SHA512
24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
cadef9abd087803c630df65264a6c81c

SHA1
babbf3636c347c8727c35f3eef2ee643dbcc4bd2

SHA256
cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

SHA512
7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
bd5940f08d0be56e65e5f2aaf47c538e

SHA1
d7e31b87866e5e383ab5499da64aba50f03e8443

SHA256
2d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6

SHA512
c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
ecceac16628651c18879d836acfcb062

SHA1
420502b3e5220a01586c59504e94aa1ee11982c9

SHA256
58238de09a8817ed9f894ed8e5bf06a897fd08e0b0bd77e508d37b2598edd2a9

SHA512
be3c7cb529cafb00f58790a6f8b35c4ff6db9f7f43a507d2218fd80cebc88413e46f71b1bc35b8afcc36b68f9409c946470d1e74a4fe225400eeb6f3f898f5b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e243a38635ff9a06c87c2a61a2200656

SHA1
ecd95ed5bf1a9fbe96a8448fc2814a0210fa2afc

SHA256
af5782703f3f2d5a29fb313dae6680a64134db26064d4a321a3f23b75f6ca00f

SHA512
4418957a1b10eee44cf270c81816ae707352411c4f5ac14b6b61ab537c91480e24e0a0a2c276a6291081b4984c123cf673a45dcedb0ceeef682054ba0fc19cb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
119B

MD5
903463f28b35ab46a121a6d9cc0fe788

SHA1
807a702bb15aba52f9be6009b0e8a43689a469a7

SHA256
316f6879cd59bd1f439236bc00f60b57502565144f1f42b44bf921ee9409952d

SHA512
3e0db477fbe53ab0922425ec9e089243ebe83979b09ff1036b88a6d7692764c38ddea459f939daa07ac7428db7433f3834e2790be1ce47c898350b890d2f5162

Download Submit
C:\Users\Admin\AppData\Local\Temp\989MOUOnUX.bat

Filesize
194B

MD5
861d0204d95e8a2d8cb1dd64415f178b

SHA1
bb408d8e081979fb247eda86dd40e85d50b26ea1

SHA256
c8a79f47da23a5f1e8a6a703e6551015cff133165c7b53dc27db4b87818a7921

SHA512
604fb506241ed85ece4a613237ad93f0b0668b987a4cb6243a93c6573857da40ca902a1051c5494fede3fc45de233e64e128047dd45f2833d9f5f8ed11d19ff0

Download Submit
C:\Users\Admin\AppData\Local\Temp\AsgPmp9HNF.bat

Filesize
194B

MD5
4bcf9e8479bcdb8d72b1bd28e30f2f10

SHA1
06f5d2a322de2c9b8c65d436ebf0f6f2614ba756

SHA256
72184ff05e4eb3453c88808021c6fc1d597188a4a8d989b81a5cec8f9b391e0a

SHA512
2ee37b95a5ceffcdc6619ea87cc3629543cf7e87d31a7a5459982f51af76cbaa47aa4180f04131a7b38bada695179b7e3c69d88826ab199a874d9643ba7c2e50

Download Submit
C:\Users\Admin\AppData\Local\Temp\EzDSmeWZ76.bat

Filesize
194B

MD5
7fe8d6c821fda186163da8d7e1afe436

SHA1
bfecfb28b816afa90a8952ee16e41bc97cec3161

SHA256
73f51d0049c43c1d2c2e8fc096d9741cc242914e66f28e3bcfbc35077604ea7c

SHA512
ab0a3e1c1d4b751b05fd77abfd2c4e5aaf243f78dda8c682dce081f323e09dc665405619ec233d9cc77024d0142157812b8ae9a0a4ccb563b14cc023d8b66987

Download Submit
C:\Users\Admin\AppData\Local\Temp\IrGY9odMle.bat

Filesize
194B

MD5
cd2c105b1aaada552d389c911038e506

SHA1
16a375f06adb8fe744e4326facce1130cf768c97

SHA256
3536e2fad17f428b8d174a00fa73670a30c692e8ea6865fe2c97593996262c56

SHA512
e33d4d135a8303bcac71298810c797da616628cc8a2468bcdac5b45f7d53d315ff52f4d743b4cc82990a8589a4255ef5a3a9342d5c4e8481f6808d5b714dc6dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\J2mXRZwkCj.bat

Filesize
194B

MD5
c6ccea3dcef75db4fec9c150e74dfc89

SHA1
851ec6563bb1b917e07819ed80c8d106e739870f

SHA256
86cbaf7a9ad41565ee7e4745056acd11ab8660df9781060c033624b37da63215

SHA512
93df229411f426445899d6378d0abdd0bfe788631e7b59535f15af87d445ae1a3bb155174a2f92d8faab7c1df9682751bd1421c19d1272e37f0a2d8c17bd60d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\XdxpZ3I66P.bat

Filesize
194B

MD5
d9ca6495c35b5869759e95f414abb0ec

SHA1
40eb17720b62f4cc713a336fdd15f93d6963b748

SHA256
af86702a88c667db9e1f95def6bdb23e89b65f88d862255df93449f57ad5f04a

SHA512
efd341e2f28a7b9d0e81c62f56ceeb247bd11e8cfed458130cfd9f7f26fc9f5fa55e801c8f99dd42cce07213367ff60d2843280f599fb3932f5c4b513e20eccc

Download Submit
C:\Users\Admin\AppData\Local\Temp\ZZzsG8LzQB.bat

Filesize
194B

MD5
2b9ef5daba25a7a76444b1033ccd448e

SHA1
ce333ac2f3ae89e7074dddb17749816b3f997996

SHA256
a7849ecdc7847a22b17e2d43595ac1b229804b389d51f850322c7246cbb7e42e

SHA512
a8215e96be957e5cc51b764a7a3773d38cf732dacf5f8e158a44fba67c78ec6ba067ab9af460d0506b576ffe935c59178946e6812992564ee1acaafaf4a781be

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5jjchmau.phq.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\eXOrkcF5G0.bat

Filesize
194B

MD5
ff1b59d88b7caa7433a6ba6396745f7a

SHA1
8b019bb694eea9c924551c6cbd816c610be595d3

SHA256
5df00a13a47148cff3a03689f29a0ab738898081dc085eca791b59481934e65a

SHA512
b6acf7875a3bd1d61aca1427d09c7faf366d71514852cc5588c7f55f5401b8ee5a7bf6ac09a5be77535bb18a21c15d367ad86ae9096d86d848cafe99bdd38a59

Download Submit
C:\Users\Admin\AppData\Local\Temp\qO35UmqwIy.bat

Filesize
194B

MD5
cc35b56e446843963756123cf2f47c48

SHA1
9f4a25b2b4cf55531256d0b8f67c3fa9093a665b

SHA256
2a76e4fb04f021b425c4af9f835b79d81b207fb469a8a454dd6891bfa2b62fa1

SHA512
e7017801128cf5d62b0bd99fd5ea9fed5077725765465ccf7b2223288f19d7fc89bf6ee7bc3f78afa5a2a88964ad4972bb93b6f8c8e0e5cba2cba3b4e0d91ae5

Download Submit
C:\Users\Admin\AppData\Local\Temp\sJ59Arupck.bat

Filesize
194B

MD5
ecd2740ce96e70cae29874aae3193f41

SHA1
ac97c492d9dc49cea91dac1480fc17b603d65d1f

SHA256
8127d5b3329849a879aebe6278132511dc0db6f6deac623d1ca967f90a8e05ac

SHA512
cdc1d49e7d5eb7dee6f04b4baaaddd495b5258ad3d760982676f2a6046cf885ed59bbed0c37f9d93b5f0e62da3659a313503600506c4b6dc2545cd53adc17c7a

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/332-53-0x000001DC02DA0000-0x000001DC02DC2000-memory.dmp

Filesize
136KB

Download
memory/1628-54-0x00000000017D0000-0x00000000017E2000-memory.dmp

Filesize
72KB

Download
memory/1956-234-0x0000000002C80000-0x0000000002C92000-memory.dmp

Filesize
72KB

Download
memory/1956-240-0x000000001BF50000-0x000000001C052000-memory.dmp

Filesize
1.0MB

Download
memory/1956-238-0x000000001BF50000-0x000000001C052000-memory.dmp

Filesize
1.0MB

Download
memory/2108-14-0x0000000002B50000-0x0000000002B62000-memory.dmp

Filesize
72KB

Download
memory/2108-12-0x00007FFAD94E3000-0x00007FFAD94E5000-memory.dmp

Filesize
8KB

Download
memory/2108-17-0x0000000002B80000-0x0000000002B8C000-memory.dmp

Filesize
48KB

Download
memory/2108-16-0x0000000002B70000-0x0000000002B7C000-memory.dmp

Filesize
48KB

Download
memory/2108-13-0x0000000000A20000-0x0000000000B30000-memory.dmp

Filesize
1.1MB

Download
memory/2108-15-0x0000000002B60000-0x0000000002B6C000-memory.dmp

Filesize
48KB

Download
memory/2244-251-0x0000000002650000-0x0000000002662000-memory.dmp

Filesize
72KB

Download
memory/2408-264-0x0000000002C60000-0x0000000002C72000-memory.dmp

Filesize
72KB

Download
memory/2520-218-0x0000000000BC0000-0x0000000000BD2000-memory.dmp

Filesize
72KB

Download
memory/2520-223-0x000000001B590000-0x000000001B692000-memory.dmp

Filesize
1.0MB

Download
memory/2872-231-0x000000001B560000-0x000000001B662000-memory.dmp

Filesize
1.0MB

Download
memory/2872-226-0x00000000022C0000-0x00000000022D2000-memory.dmp

Filesize
72KB

Download
memory/3096-248-0x000000001C070000-0x000000001C172000-memory.dmp

Filesize
1.0MB

Download
memory/3096-243-0x0000000002B10000-0x0000000002B22000-memory.dmp

Filesize
72KB

Download
memory/3476-209-0x000000001BE00000-0x000000001BF02000-memory.dmp

Filesize
1.0MB

Download
memory/4428-284-0x00000000021F0000-0x0000000002202000-memory.dmp

Filesize
72KB

Download
memory/4484-277-0x0000000002740000-0x0000000002752000-memory.dmp

Filesize
72KB

Download