dcrat | 3cef79896027667329445893f16586fbb058bab5261e3b92e0d9cf3f7b877287

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-12-2024 23:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_3cef79896027667329445893f16586fbb058bab5261e3b92e0d9cf3f7b877287.exe
Size

1.3MB
MD5

76a688820a85b18f8ec7623d5b013d37
SHA1

01688be448bb5a48626a9e1f86291d32a80902d1
SHA256

3cef79896027667329445893f16586fbb058bab5261e3b92e0d9cf3f7b877287
SHA512

152419bb7f10733886bb2f239a1bb4ab6b2e337a9d2529de682289b3408c023f2322c49fea5c5d764685e013f7093c11c78dc0792d945e89e11ecfe6ffd01961
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 33 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2020	1304	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1428	1304	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1824	1304	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1128	1304	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1724	1304	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2620	1304	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4992	1304	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2652	1304	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4256	1304	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1764	1304	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1972	1304	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1696	1304	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2664	1304	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4612	1304	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2152	1304	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4956	1304	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4284	1304	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4052	1304	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2708	1304	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2352	1304	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2200	1304	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4172	1304	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3968	1304	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1988	1304	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1100	1304	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	956	1304	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1536	1304	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3340	1304	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3268	1304	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3084	1304	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1668	1304	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1484	1304	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2776	1304	schtasks.exe	86

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x0007000000023c89-10.dat	dcrat
behavioral2/memory/4856-13-0x0000000000F20000-0x0000000001030000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1760	powershell.exe
5088	powershell.exe
2684	powershell.exe
2244	powershell.exe
3696	powershell.exe
844	powershell.exe
1016	powershell.exe
4580	powershell.exe
2468	powershell.exe
4672	powershell.exe
4464	powershell.exe
440	powershell.exe

Checks computer location settings 2 TTPs 16 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	wininit.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	wininit.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	wininit.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	wininit.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	wininit.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	wininit.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	wininit.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	wininit.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	wininit.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	wininit.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	wininit.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	wininit.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	wininit.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	JaffaCakes118_3cef79896027667329445893f16586fbb058bab5261e3b92e0d9cf3f7b877287.exe

Executes dropped EXE 15 IoCs

pid	Process
4856	DllCommonsvc.exe
4468	wininit.exe
4284	wininit.exe
3320	wininit.exe
3324	wininit.exe
3656	wininit.exe
1436	wininit.exe
2664	wininit.exe
4372	wininit.exe
3864	wininit.exe
516	wininit.exe
1580	wininit.exe
1504	wininit.exe
2356	wininit.exe
4796	wininit.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 14 IoCs

Web Service

T1102

flow	ioc
20	raw.githubusercontent.com
45	raw.githubusercontent.com
53	raw.githubusercontent.com
54	raw.githubusercontent.com
15	raw.githubusercontent.com
16	raw.githubusercontent.com
35	raw.githubusercontent.com
55	raw.githubusercontent.com
39	raw.githubusercontent.com
44	raw.githubusercontent.com
52	raw.githubusercontent.com
40	raw.githubusercontent.com
46	raw.githubusercontent.com
56	raw.githubusercontent.com

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File created	C:\Program Files\Google\5940a34987c991	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Media Player\en-US\csrss.exe	DllCommonsvc.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\csrss.exe	DllCommonsvc.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\886983d96e3d3e	DllCommonsvc.exe
File created	C:\Program Files\Windows Portable Devices\smss.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Portable Devices\69ddcba757bf72	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Mail\csrss.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Mail\886983d96e3d3e	DllCommonsvc.exe
File created	C:\Program Files\Google\dllhost.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Media Player\en-US\886983d96e3d3e	DllCommonsvc.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Help\Windows\ContentStore\en-US\winlogon.exe	DllCommonsvc.exe
File created	C:\Windows\Help\Windows\ContentStore\en-US\cc11b995f2a76d	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_3cef79896027667329445893f16586fbb058bab5261e3b92e0d9cf3f7b877287.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 14 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	wininit.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	wininit.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	wininit.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	wininit.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	wininit.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	JaffaCakes118_3cef79896027667329445893f16586fbb058bab5261e3b92e0d9cf3f7b877287.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	wininit.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	wininit.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	wininit.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	wininit.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	wininit.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	wininit.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	wininit.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	wininit.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 33 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2664	schtasks.exe
2152	schtasks.exe
4284	schtasks.exe
1536	schtasks.exe
1824	schtasks.exe
4256	schtasks.exe
956	schtasks.exe
3084	schtasks.exe
1724	schtasks.exe
4052	schtasks.exe
1972	schtasks.exe
2708	schtasks.exe
2200	schtasks.exe
3968	schtasks.exe
3268	schtasks.exe
1668	schtasks.exe
2020	schtasks.exe
1128	schtasks.exe
1696	schtasks.exe
2352	schtasks.exe
2620	schtasks.exe
1764	schtasks.exe
1484	schtasks.exe
1988	schtasks.exe
3340	schtasks.exe
4612	schtasks.exe
1100	schtasks.exe
4992	schtasks.exe
2652	schtasks.exe
4172	schtasks.exe
1428	schtasks.exe
4956	schtasks.exe
2776	schtasks.exe

Suspicious behavior: EnumeratesProcesses 52 IoCs

pid	Process
4856	DllCommonsvc.exe
4672	powershell.exe
4672	powershell.exe
844	powershell.exe
844	powershell.exe
440	powershell.exe
440	powershell.exe
2244	powershell.exe
2244	powershell.exe
4464	powershell.exe
4464	powershell.exe
5088	powershell.exe
5088	powershell.exe
2684	powershell.exe
2684	powershell.exe
4580	powershell.exe
4580	powershell.exe
3696	powershell.exe
3696	powershell.exe
1760	powershell.exe
1760	powershell.exe
1016	powershell.exe
1016	powershell.exe
2468	powershell.exe
2468	powershell.exe
4468	wininit.exe
4468	wininit.exe
4672	powershell.exe
844	powershell.exe
440	powershell.exe
2244	powershell.exe
1760	powershell.exe
5088	powershell.exe
2684	powershell.exe
4464	powershell.exe
4580	powershell.exe
2468	powershell.exe
3696	powershell.exe
1016	powershell.exe
4284	wininit.exe
3320	wininit.exe
3324	wininit.exe
3656	wininit.exe
1436	wininit.exe
2664	wininit.exe
4372	wininit.exe
3864	wininit.exe
516	wininit.exe
1580	wininit.exe
1504	wininit.exe
2356	wininit.exe
4796	wininit.exe

Suspicious use of AdjustPrivilegeToken 27 IoCs

description	pid	Process
Token: SeDebugPrivilege	4856	DllCommonsvc.exe
Token: SeDebugPrivilege	4672	powershell.exe
Token: SeDebugPrivilege	844	powershell.exe
Token: SeDebugPrivilege	440	powershell.exe
Token: SeDebugPrivilege	2244	powershell.exe
Token: SeDebugPrivilege	4464	powershell.exe
Token: SeDebugPrivilege	5088	powershell.exe
Token: SeDebugPrivilege	2684	powershell.exe
Token: SeDebugPrivilege	4580	powershell.exe
Token: SeDebugPrivilege	4468	wininit.exe
Token: SeDebugPrivilege	3696	powershell.exe
Token: SeDebugPrivilege	1760	powershell.exe
Token: SeDebugPrivilege	1016	powershell.exe
Token: SeDebugPrivilege	2468	powershell.exe
Token: SeDebugPrivilege	4284	wininit.exe
Token: SeDebugPrivilege	3320	wininit.exe
Token: SeDebugPrivilege	3324	wininit.exe
Token: SeDebugPrivilege	3656	wininit.exe
Token: SeDebugPrivilege	1436	wininit.exe
Token: SeDebugPrivilege	2664	wininit.exe
Token: SeDebugPrivilege	4372	wininit.exe
Token: SeDebugPrivilege	3864	wininit.exe
Token: SeDebugPrivilege	516	wininit.exe
Token: SeDebugPrivilege	1580	wininit.exe
Token: SeDebugPrivilege	1504	wininit.exe
Token: SeDebugPrivilege	2356	wininit.exe
Token: SeDebugPrivilege	4796	wininit.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4740 wrote to memory of 5072	4740	JaffaCakes118_3cef79896027667329445893f16586fbb058bab5261e3b92e0d9cf3f7b877287.exe	82
PID 4740 wrote to memory of 5072	4740	JaffaCakes118_3cef79896027667329445893f16586fbb058bab5261e3b92e0d9cf3f7b877287.exe	82
PID 4740 wrote to memory of 5072	4740	JaffaCakes118_3cef79896027667329445893f16586fbb058bab5261e3b92e0d9cf3f7b877287.exe	82
PID 5072 wrote to memory of 3080	5072	WScript.exe	83
PID 5072 wrote to memory of 3080	5072	WScript.exe	83
PID 5072 wrote to memory of 3080	5072	WScript.exe	83
PID 3080 wrote to memory of 4856	3080	cmd.exe	85
PID 3080 wrote to memory of 4856	3080	cmd.exe	85
PID 4856 wrote to memory of 844	4856	DllCommonsvc.exe	120
PID 4856 wrote to memory of 844	4856	DllCommonsvc.exe	120
PID 4856 wrote to memory of 1016	4856	DllCommonsvc.exe	121
PID 4856 wrote to memory of 1016	4856	DllCommonsvc.exe	121
PID 4856 wrote to memory of 4580	4856	DllCommonsvc.exe	122
PID 4856 wrote to memory of 4580	4856	DllCommonsvc.exe	122
PID 4856 wrote to memory of 1760	4856	DllCommonsvc.exe	123
PID 4856 wrote to memory of 1760	4856	DllCommonsvc.exe	123
PID 4856 wrote to memory of 5088	4856	DllCommonsvc.exe	124
PID 4856 wrote to memory of 5088	4856	DllCommonsvc.exe	124
PID 4856 wrote to memory of 2684	4856	DllCommonsvc.exe	125
PID 4856 wrote to memory of 2684	4856	DllCommonsvc.exe	125
PID 4856 wrote to memory of 2244	4856	DllCommonsvc.exe	126
PID 4856 wrote to memory of 2244	4856	DllCommonsvc.exe	126
PID 4856 wrote to memory of 4672	4856	DllCommonsvc.exe	127
PID 4856 wrote to memory of 4672	4856	DllCommonsvc.exe	127
PID 4856 wrote to memory of 4464	4856	DllCommonsvc.exe	128
PID 4856 wrote to memory of 4464	4856	DllCommonsvc.exe	128
PID 4856 wrote to memory of 3696	4856	DllCommonsvc.exe	129
PID 4856 wrote to memory of 3696	4856	DllCommonsvc.exe	129
PID 4856 wrote to memory of 440	4856	DllCommonsvc.exe	130
PID 4856 wrote to memory of 440	4856	DllCommonsvc.exe	130
PID 4856 wrote to memory of 2468	4856	DllCommonsvc.exe	131
PID 4856 wrote to memory of 2468	4856	DllCommonsvc.exe	131
PID 4856 wrote to memory of 4468	4856	DllCommonsvc.exe	144
PID 4856 wrote to memory of 4468	4856	DllCommonsvc.exe	144
PID 4468 wrote to memory of 4988	4468	wininit.exe	145
PID 4468 wrote to memory of 4988	4468	wininit.exe	145
PID 4988 wrote to memory of 1428	4988	cmd.exe	147
PID 4988 wrote to memory of 1428	4988	cmd.exe	147
PID 4988 wrote to memory of 4284	4988	cmd.exe	151
PID 4988 wrote to memory of 4284	4988	cmd.exe	151
PID 4284 wrote to memory of 5068	4284	wininit.exe	153
PID 4284 wrote to memory of 5068	4284	wininit.exe	153
PID 5068 wrote to memory of 624	5068	cmd.exe	155
PID 5068 wrote to memory of 624	5068	cmd.exe	155
PID 5068 wrote to memory of 3320	5068	cmd.exe	158
PID 5068 wrote to memory of 3320	5068	cmd.exe	158
PID 3320 wrote to memory of 224	3320	wininit.exe	160
PID 3320 wrote to memory of 224	3320	wininit.exe	160
PID 224 wrote to memory of 2936	224	cmd.exe	162
PID 224 wrote to memory of 2936	224	cmd.exe	162
PID 224 wrote to memory of 3324	224	cmd.exe	164
PID 224 wrote to memory of 3324	224	cmd.exe	164
PID 3324 wrote to memory of 4160	3324	wininit.exe	165
PID 3324 wrote to memory of 4160	3324	wininit.exe	165
PID 4160 wrote to memory of 3832	4160	cmd.exe	167
PID 4160 wrote to memory of 3832	4160	cmd.exe	167
PID 4160 wrote to memory of 3656	4160	cmd.exe	168
PID 4160 wrote to memory of 3656	4160	cmd.exe	168
PID 3656 wrote to memory of 3480	3656	wininit.exe	169
PID 3656 wrote to memory of 3480	3656	wininit.exe	169
PID 3480 wrote to memory of 2264	3480	cmd.exe	171
PID 3480 wrote to memory of 2264	3480	cmd.exe	171
PID 3480 wrote to memory of 1436	3480	cmd.exe	172
PID 3480 wrote to memory of 1436	3480	cmd.exe	172

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3cef79896027667329445893f16586fbb058bab5261e3b92e0d9cf3f7b877287.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3cef79896027667329445893f16586fbb058bab5261e3b92e0d9cf3f7b877287.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4740
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5072
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3080
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4856
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:844
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\wininit.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1016
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Mail\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4580
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Videos\fontdrvhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1760
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\Registry.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5088
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\lsass.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2684
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\services.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2244
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Microsoft Office 15\ClientX64\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4672
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Portable Devices\smss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4464
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Google\dllhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3696
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Help\Windows\ContentStore\en-US\winlogon.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:440
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Media Player\en-US\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2468
    - - C:\providercommon\wininit.exe
        
        "C:\providercommon\wininit.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4468
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\X8VSEkwS9E.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4988
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:1428
        
        C:\providercommon\wininit.exe
        
        "C:\providercommon\wininit.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4284
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\R5wNYqVH5b.bat"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:5068
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:624
        
        C:\providercommon\wininit.exe
        
        "C:\providercommon\wininit.exe"
        9⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3320
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\xghrCifyI9.bat"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:224
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:2936
        
        C:\providercommon\wininit.exe
        
        "C:\providercommon\wininit.exe"
        11⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3324
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\FFH8oguQ3d.bat"
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:4160
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:3832
        
        C:\providercommon\wininit.exe
        
        "C:\providercommon\wininit.exe"
        13⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3656
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\GKRF07RVHS.bat"
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:3480
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        15⤵
        
        PID:2264
        
        C:\providercommon\wininit.exe
        
        "C:\providercommon\wininit.exe"
        15⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1436
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Ys2Wc5gw2w.bat"
        16⤵
        
        PID:3500
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        17⤵
        
        PID:4700
        
        C:\providercommon\wininit.exe
        
        "C:\providercommon\wininit.exe"
        17⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2664
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\bo4ZIAkpMj.bat"
        18⤵
        
        PID:4984
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        19⤵
        
        PID:1324
        
        C:\providercommon\wininit.exe
        
        "C:\providercommon\wininit.exe"
        19⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4372
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\CSN9cxKiet.bat"
        20⤵
        
        PID:1812
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        21⤵
        
        PID:852
        
        C:\providercommon\wininit.exe
        
        "C:\providercommon\wininit.exe"
        21⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3864
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\5Yw7RONjUI.bat"
        22⤵
        
        PID:2076
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        23⤵
        
        PID:368
        
        C:\providercommon\wininit.exe
        
        "C:\providercommon\wininit.exe"
        23⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:516
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\RE4R3BzSze.bat"
        24⤵
        
        PID:1668
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        25⤵
        
        PID:3180
        
        C:\providercommon\wininit.exe
        
        "C:\providercommon\wininit.exe"
        25⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1580
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\yQDva2PSBr.bat"
        26⤵
        
        PID:1536
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        27⤵
        
        PID:1952
        
        C:\providercommon\wininit.exe
        
        "C:\providercommon\wininit.exe"
        27⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1504
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\LBVLNHYHv1.bat"
        28⤵
        
        PID:1552
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        29⤵
        
        PID:2172
        
        C:\providercommon\wininit.exe
        
        "C:\providercommon\wininit.exe"
        29⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2356
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\vdJwOJplm6.bat"
        30⤵
        
        PID:3500
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        31⤵
        
        PID:4508
        
        C:\providercommon\wininit.exe
        
        "C:\providercommon\wininit.exe"
        31⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 14 /tr "'C:\providercommon\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\providercommon\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\providercommon\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Mail\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1128

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Mail\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\Videos\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\Admin\Videos\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\Videos\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4256

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 13 /tr "'C:\providercommon\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\providercommon\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 7 /tr "'C:\providercommon\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 7 /tr "'C:\Users\Default User\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Users\Default User\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\Users\Default User\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2152

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 11 /tr "'C:\providercommon\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\providercommon\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 12 /tr "'C:\providercommon\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office 15\ClientX64\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Portable Devices\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4172

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Portable Devices\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Program Files\Google\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1100

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\Google\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Program Files\Google\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'C:\Windows\Help\Windows\ContentStore\en-US\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\Help\Windows\ContentStore\en-US\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'C:\Windows\Help\Windows\ContentStore\en-US\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Media Player\en-US\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\en-US\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Media Player\en-US\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\wininit.exe.log

Filesize
1KB

MD5
baf55b95da4a601229647f25dad12878

SHA1
abc16954ebfd213733c4493fc1910164d825cac8

SHA256
ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

SHA512
24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
cadef9abd087803c630df65264a6c81c

SHA1
babbf3636c347c8727c35f3eef2ee643dbcc4bd2

SHA256
cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

SHA512
7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
77d622bb1a5b250869a3238b9bc1402b

SHA1
d47f4003c2554b9dfc4c16f22460b331886b191b

SHA256
f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

SHA512
d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
2e907f77659a6601fcc408274894da2e

SHA1
9f5b72abef1cd7145bf37547cdb1b9254b4efe9d

SHA256
385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233

SHA512
34fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3a6bad9528f8e23fb5c77fbd81fa28e8

SHA1
f127317c3bc6407f536c0f0600dcbcf1aabfba36

SHA256
986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

SHA512
846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\5Yw7RONjUI.bat

Filesize
194B

MD5
2d4b47ea9642dfe0e87dab8f46758079

SHA1
d4770cf5bf934d9cbe053eb7f109cbbdf433302a

SHA256
039eae4a042ffb4047aaaf23689e52248045277ad5c53cb49c20aa34a73d18db

SHA512
53da8aa404e2f888e1ae32b475f980c8ef40b4e70620f9c16a4c1a82d875fda4be642b049ff79efdf91c0142d4df50c2ee9ce6ddbbed94ee88f090a86d3caf29

Download Submit
C:\Users\Admin\AppData\Local\Temp\CSN9cxKiet.bat

Filesize
194B

MD5
3af3ae6d27b6063c90fbf7d51d719162

SHA1
e9b5502930a3add05a8880845432d4b5d368aaad

SHA256
43a359779d4523836eaf17ccdecf05e23dbed0be95784907fad29eb7087e03af

SHA512
8c07611c19553c272e7866fe792524ae2bc5e6d58d2fc15dcd4e22c131552f7e200e05a35bfd1bf01c15cd8f800f37dc1fae34546d5a3d619f889863c6eacfe8

Download Submit
C:\Users\Admin\AppData\Local\Temp\FFH8oguQ3d.bat

Filesize
194B

MD5
0e4a4a59aa66e43124c2697f6e1f3c2b

SHA1
85eb2e4d69d4baeef4008125231fd199c092691f

SHA256
7951103be7b00807460c9b61273deffce3c408c139e0e0ade1d953acc241ddfc

SHA512
1fd7b118b98c18135dba327c7dbfb70cce86db7bedaabfa7a31bbec50e966c1fa7205bac2b5d145491d878cf6ea0623091dcb827c97b840b90b57be51cd5162d

Download Submit
C:\Users\Admin\AppData\Local\Temp\GKRF07RVHS.bat

Filesize
194B

MD5
a0860b7e23be4e3d13387ef2850f4f8a

SHA1
4f1df509b34ca7b2004fb746fa3abbc761808421

SHA256
100c762b59f231135a45418cede1fb3ebceb6826ef2ccf7b5a4605b0bbdd1a8e

SHA512
718fb2be53ba0d7aeed4224c3b0d6cc8042325030e4e354a54c37a27df099f4bfcc833f46793086d607617d6e16ccc56285e46ce4f925b252014bb3f33243655

Download Submit
C:\Users\Admin\AppData\Local\Temp\LBVLNHYHv1.bat

Filesize
194B

MD5
5c2f25b775deaf6717cb502026e446af

SHA1
3c4d9325ed8f35979ce6dd76bdcd789bdd140b04

SHA256
49b4225dafef2a9456b955e5b292fa09c0b5bd30ac5ec5e35c214e46f4a21540

SHA512
a0264240c13c65e28f6f6e541202e992fcd7edf5f6a78ee12a365a0f9953d0a293c45fe013029215d28c27e5bc8496a2754ab98aeb2f6d40901d0f74bea67fe2

Download Submit
C:\Users\Admin\AppData\Local\Temp\R5wNYqVH5b.bat

Filesize
194B

MD5
f9959af1d2e00d670260ba5fa1fa09d5

SHA1
793d2b3756a5d741c876b9c59d45282c361284c2

SHA256
ec71c21111bb7e550a2b2beca92a0d02008150cc7c4f13b4f8b79f714e5a0ead

SHA512
f8e36576893c9021b351c7303990f1503968efcf8cfb48f6a31f94d6507d62e596c77ec690a4ff2c7e323653bd84051ce358003b61213dddcd2875cddbadbb00

Download Submit
C:\Users\Admin\AppData\Local\Temp\RE4R3BzSze.bat

Filesize
194B

MD5
6ae7352750aac1944cbe2e3ef67b437c

SHA1
e2ae8112cf07dfdd0084d71279ce0473b6532ac4

SHA256
264ec3cf7d005be93d304f41ae52c878a2eda09017d5ca2ae94a9e272942b73d

SHA512
4ac1d8da9d3de2ca6ba4478f2140bf0f388fe056ae66ebe55873fe2a43a29cfbca9b6b3457606037c18acd28e854ebce067f5aded3818554cfddf37e42b594fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\X8VSEkwS9E.bat

Filesize
194B

MD5
f6c77c902e0a07584c3c0821f765afbe

SHA1
8bff00851374c51aada40adf32a4feeeda25a7df

SHA256
4dc7c62a2278829279b4a0dfec6fae69a4fe0021e2144edecf0ef07f3ae65669

SHA512
214f22ee61aec0afd506755ee5c94ba702141a337acd805f9b313ae9f5291c8ed0b47eb00ab944ca711d3a36fb4a0a2c75ea5764cecd934ba9973921b5113305

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ys2Wc5gw2w.bat

Filesize
194B

MD5
12ab6d44cf6fdd0696705694138dbbd9

SHA1
621abbb105c28c2daa15411bc556418c95121223

SHA256
615171fdb66396050f4165b1f59d10f8038ea48f38c2ef5a4ed407e920a3a216

SHA512
058232436adcfb71f07202219aea7044320a5af119c91cf44ce3baecbb846717553f70fb63f886d3aac8f6b002b4c25fb177c0e575da3471a92e04b23117ce48

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rndxn3ky.c1q.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\bo4ZIAkpMj.bat

Filesize
194B

MD5
b62a27d3b66c9dd87c5c8027e02b0254

SHA1
f082d4d0e7db390163f16c3a92ac529d53fed5e5

SHA256
39d1ac223a706cab14f65f902471114ea12cff2c205fb370eb93d7bba4853f2d

SHA512
10b547e7b99875e210940998212362ba54bc4d2943a4b287aaf3a2b22ed783b4ffbe47f92a5cf50fa92d1d1511b1222ab89171d7de4e03e8bb03262727215984

Download Submit
C:\Users\Admin\AppData\Local\Temp\vdJwOJplm6.bat

Filesize
194B

MD5
1daf7ed675f3c3c6a04fc13aa11e8b1c

SHA1
7fc93448d89da23256c02c388b404baba5ce35e9

SHA256
d7888badf3561fc372dda0cd7b9523104bb9c9b6e14a9efc4a9f7b856878756b

SHA512
c65e7dc864bfa93d24a0a982341931f0c3d1b8ad7dbf6ed48155bd05eb927f1e0888aa4fa95222e4e4dcf98fc69f5b51e18c2c0005b35f70daad57e64aadef39

Download Submit
C:\Users\Admin\AppData\Local\Temp\xghrCifyI9.bat

Filesize
194B

MD5
fd2bb9aa927a9074af634a270cef351f

SHA1
eab601609cb5f0d161c762396a8559078d55495d

SHA256
e214e1fb54ec7aadfbefea0a7e3fa51793c5e9a18a9156df08daf3e75b1b25ec

SHA512
f894aece7d9cc78762ca1b8288eb83a370bfb4eb63af5020eef812e23254198723df7d16a4b4fbe9633ee2064caa5fb308c744bda3b502ffc482ae3a4649ac40

Download Submit
C:\Users\Admin\AppData\Local\Temp\yQDva2PSBr.bat

Filesize
194B

MD5
4a24a3b2fdf9dbc423b3bb19a8adb0ff

SHA1
74d622a9bd9e354c22c3dc5569e2d3422eac7d12

SHA256
1bd9d273511993e8238f0769cb37f84121b6618f513941ac84422a9aa7ffd83f

SHA512
55213e48c0e39b9aacd69457ef511e4b7bf29df71354582b02baa009ebf5c10ece89544219fc5b510ff15c1cc4ae3c7e736f6fd262102d6d1824853feb606df8

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/516-244-0x0000000002510000-0x0000000002522000-memory.dmp

Filesize
72KB

Download
memory/2664-224-0x0000000001660000-0x0000000001672000-memory.dmp

Filesize
72KB

Download
memory/3864-237-0x0000000002530000-0x0000000002542000-memory.dmp

Filesize
72KB

Download
memory/4468-190-0x000000001C490000-0x000000001C639000-memory.dmp

Filesize
1.7MB

Download
memory/4672-56-0x000001743E980000-0x000001743E9A2000-memory.dmp

Filesize
136KB

Download
memory/4856-17-0x000000001C360000-0x000000001C36C000-memory.dmp

Filesize
48KB

Download
memory/4856-16-0x000000001C350000-0x000000001C35C000-memory.dmp

Filesize
48KB

Download
memory/4856-15-0x000000001BC30000-0x000000001BC3C000-memory.dmp

Filesize
48KB

Download
memory/4856-14-0x000000001BC20000-0x000000001BC32000-memory.dmp

Filesize
72KB

Download
memory/4856-13-0x0000000000F20000-0x0000000001030000-memory.dmp

Filesize
1.1MB

Download
memory/4856-12-0x00007FFCC5D33000-0x00007FFCC5D35000-memory.dmp

Filesize
8KB

Download