dcrat | 7b97974c3d06cd76a00fa846f9d8587211d810116ffa8005b145caee80e8d122

Analysis

max time kernel
146s
max time network
142s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
21-12-2024 23:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_7b97974c3d06cd76a00fa846f9d8587211d810116ffa8005b145caee80e8d122.exe
Size

1.3MB
MD5

6ffad70f32d3c553e71c34c4848be86e
SHA1

0d6ce2c05e8b4029b1cd3a9feacd7e4f95b24280
SHA256

7b97974c3d06cd76a00fa846f9d8587211d810116ffa8005b145caee80e8d122
SHA512

d10cc9f3c27cd7fde54090194e02e7cba2c593c247c49f2f7a9f1a93d3178c2601a51c4ac72502ad2078de97d4754c91ceee4917252a0750fa82e353c09a3d84
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 48 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3036	1932	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	568	1932	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	316	1932	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1076	1932	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	840	1932	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2536	1932	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2164	1932	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	844	1932	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2256	1932	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2188	1932	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2828	1932	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2648	1932	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1620	1932	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2744	1932	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1904	1932	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1064	1932	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2184	1932	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2020	1932	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2448	1932	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	744	1932	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1372	1932	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1868	1932	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2212	1932	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1848	1932	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1768	1932	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1492	1932	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1908	1932	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1648	1932	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1224	1932	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1804	1932	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	888	1932	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1040	1932	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2984	1932	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1728	1932	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2420	1932	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1436	1932	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2324	1932	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1980	1932	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2016	1932	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2992	1932	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1464	1932	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2524	1932	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1476	1932	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1760	1932	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2312	1932	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1412	1932	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2224	1932	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1724	1932	schtasks.exe	34

DCRat payload 7 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0007000000018634-9.dat	dcrat
behavioral1/memory/2748-13-0x0000000000DF0000-0x0000000000F00000-memory.dmp	dcrat
behavioral1/memory/2024-111-0x0000000000B10000-0x0000000000C20000-memory.dmp	dcrat
behavioral1/memory/1692-255-0x0000000000F40000-0x0000000001050000-memory.dmp	dcrat
behavioral1/memory/336-316-0x0000000001030000-0x0000000001140000-memory.dmp	dcrat
behavioral1/memory/2168-435-0x0000000001170000-0x0000000001280000-memory.dmp	dcrat
behavioral1/memory/1476-554-0x00000000012A0000-0x00000000013B0000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 17 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2928	powershell.exe
2764	powershell.exe
2720	powershell.exe
2476	powershell.exe
1544	powershell.exe
1668	powershell.exe
2808	powershell.exe
1056	powershell.exe
2768	powershell.exe
2804	powershell.exe
2504	powershell.exe
2776	powershell.exe
2668	powershell.exe
868	powershell.exe
1660	powershell.exe
1580	powershell.exe
2652	powershell.exe

Executes dropped EXE 9 IoCs

pid	Process
2748	DllCommonsvc.exe
2024	services.exe
2836	services.exe
1692	services.exe
336	services.exe
2500	services.exe
2168	services.exe
1596	services.exe
1476	services.exe

Loads dropped DLL 2 IoCs

pid	Process
2128	cmd.exe
2128	cmd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 8 IoCs

Web Service

T1102

flow	ioc
9	raw.githubusercontent.com
12	raw.githubusercontent.com
16	raw.githubusercontent.com
20	raw.githubusercontent.com
23	raw.githubusercontent.com
26	raw.githubusercontent.com
4	raw.githubusercontent.com
5	raw.githubusercontent.com

Drops file in Program Files directory 11 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Google\Update\1.3.36.151\0a1fd5f707cd16	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Media Player\es-ES\explorer.exe	DllCommonsvc.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\es-ES\explorer.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Mail\en-US\1610b97d3ab4a7	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft Office\27d1bcfc3c54e0	DllCommonsvc.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.151\sppsvc.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Media Player\es-ES\7a0fd90576e088	DllCommonsvc.exe
File created	C:\Program Files\Windows Photo Viewer\de-DE\taskhost.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Photo Viewer\de-DE\b75386f1303e64	DllCommonsvc.exe
File created	C:\Program Files\Windows Mail\en-US\OSPPSVC.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft Office\System.exe	DllCommonsvc.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\IME\IMESC5\HELP\services.exe	DllCommonsvc.exe
File created	C:\Windows\IME\IMESC5\HELP\c5b4cb5e9653cc	DllCommonsvc.exe
File created	C:\Windows\Speech\taskhost.exe	DllCommonsvc.exe
File created	C:\Windows\Speech\b75386f1303e64	DllCommonsvc.exe
File created	C:\Windows\PLA\System\System.exe	DllCommonsvc.exe
File created	C:\Windows\PLA\System\27d1bcfc3c54e0	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_7b97974c3d06cd76a00fa846f9d8587211d810116ffa8005b145caee80e8d122.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 48 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1464	schtasks.exe
1476	schtasks.exe
1724	schtasks.exe
840	schtasks.exe
2256	schtasks.exe
2992	schtasks.exe
1372	schtasks.exe
1492	schtasks.exe
2324	schtasks.exe
2016	schtasks.exe
1412	schtasks.exe
844	schtasks.exe
1224	schtasks.exe
2212	schtasks.exe
1648	schtasks.exe
1804	schtasks.exe
1040	schtasks.exe
2984	schtasks.exe
1436	schtasks.exe
568	schtasks.exe
2744	schtasks.exe
2312	schtasks.exe
1908	schtasks.exe
2648	schtasks.exe
1620	schtasks.exe
2164	schtasks.exe
2184	schtasks.exe
2020	schtasks.exe
744	schtasks.exe
1768	schtasks.exe
1728	schtasks.exe
316	schtasks.exe
1076	schtasks.exe
1980	schtasks.exe
2524	schtasks.exe
2188	schtasks.exe
1064	schtasks.exe
2448	schtasks.exe
1868	schtasks.exe
1848	schtasks.exe
2420	schtasks.exe
3036	schtasks.exe
2536	schtasks.exe
2224	schtasks.exe
888	schtasks.exe
1760	schtasks.exe
2828	schtasks.exe
1904	schtasks.exe

Suspicious behavior: EnumeratesProcesses 27 IoCs

pid	Process
2748	DllCommonsvc.exe
2748	DllCommonsvc.exe
2748	DllCommonsvc.exe
868	powershell.exe
2476	powershell.exe
2652	powershell.exe
1544	powershell.exe
2768	powershell.exe
2804	powershell.exe
2764	powershell.exe
1668	powershell.exe
2928	powershell.exe
2668	powershell.exe
2504	powershell.exe
2808	powershell.exe
1580	powershell.exe
1056	powershell.exe
2776	powershell.exe
2720	powershell.exe
2024	services.exe
2836	services.exe
1692	services.exe
336	services.exe
2500	services.exe
2168	services.exe
1596	services.exe
1476	services.exe

Suspicious use of AdjustPrivilegeToken 25 IoCs

description	pid	Process
Token: SeDebugPrivilege	2748	DllCommonsvc.exe
Token: SeDebugPrivilege	868	powershell.exe
Token: SeDebugPrivilege	2476	powershell.exe
Token: SeDebugPrivilege	2652	powershell.exe
Token: SeDebugPrivilege	1544	powershell.exe
Token: SeDebugPrivilege	2768	powershell.exe
Token: SeDebugPrivilege	2804	powershell.exe
Token: SeDebugPrivilege	2764	powershell.exe
Token: SeDebugPrivilege	1668	powershell.exe
Token: SeDebugPrivilege	2928	powershell.exe
Token: SeDebugPrivilege	2668	powershell.exe
Token: SeDebugPrivilege	2504	powershell.exe
Token: SeDebugPrivilege	2808	powershell.exe
Token: SeDebugPrivilege	1580	powershell.exe
Token: SeDebugPrivilege	1056	powershell.exe
Token: SeDebugPrivilege	2776	powershell.exe
Token: SeDebugPrivilege	2720	powershell.exe
Token: SeDebugPrivilege	2024	services.exe
Token: SeDebugPrivilege	2836	services.exe
Token: SeDebugPrivilege	1692	services.exe
Token: SeDebugPrivilege	336	services.exe
Token: SeDebugPrivilege	2500	services.exe
Token: SeDebugPrivilege	2168	services.exe
Token: SeDebugPrivilege	1596	services.exe
Token: SeDebugPrivilege	1476	services.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2668 wrote to memory of 2824	2668	JaffaCakes118_7b97974c3d06cd76a00fa846f9d8587211d810116ffa8005b145caee80e8d122.exe	30
PID 2668 wrote to memory of 2824	2668	JaffaCakes118_7b97974c3d06cd76a00fa846f9d8587211d810116ffa8005b145caee80e8d122.exe	30
PID 2668 wrote to memory of 2824	2668	JaffaCakes118_7b97974c3d06cd76a00fa846f9d8587211d810116ffa8005b145caee80e8d122.exe	30
PID 2668 wrote to memory of 2824	2668	JaffaCakes118_7b97974c3d06cd76a00fa846f9d8587211d810116ffa8005b145caee80e8d122.exe	30
PID 2824 wrote to memory of 2128	2824	WScript.exe	31
PID 2824 wrote to memory of 2128	2824	WScript.exe	31
PID 2824 wrote to memory of 2128	2824	WScript.exe	31
PID 2824 wrote to memory of 2128	2824	WScript.exe	31
PID 2128 wrote to memory of 2748	2128	cmd.exe	33
PID 2128 wrote to memory of 2748	2128	cmd.exe	33
PID 2128 wrote to memory of 2748	2128	cmd.exe	33
PID 2128 wrote to memory of 2748	2128	cmd.exe	33
PID 2748 wrote to memory of 868	2748	DllCommonsvc.exe	83
PID 2748 wrote to memory of 868	2748	DllCommonsvc.exe	83
PID 2748 wrote to memory of 868	2748	DllCommonsvc.exe	83
PID 2748 wrote to memory of 1056	2748	DllCommonsvc.exe	84
PID 2748 wrote to memory of 1056	2748	DllCommonsvc.exe	84
PID 2748 wrote to memory of 1056	2748	DllCommonsvc.exe	84
PID 2748 wrote to memory of 2476	2748	DllCommonsvc.exe	85
PID 2748 wrote to memory of 2476	2748	DllCommonsvc.exe	85
PID 2748 wrote to memory of 2476	2748	DllCommonsvc.exe	85
PID 2748 wrote to memory of 2504	2748	DllCommonsvc.exe	86
PID 2748 wrote to memory of 2504	2748	DllCommonsvc.exe	86
PID 2748 wrote to memory of 2504	2748	DllCommonsvc.exe	86
PID 2748 wrote to memory of 1660	2748	DllCommonsvc.exe	87
PID 2748 wrote to memory of 1660	2748	DllCommonsvc.exe	87
PID 2748 wrote to memory of 1660	2748	DllCommonsvc.exe	87
PID 2748 wrote to memory of 2768	2748	DllCommonsvc.exe	88
PID 2748 wrote to memory of 2768	2748	DllCommonsvc.exe	88
PID 2748 wrote to memory of 2768	2748	DllCommonsvc.exe	88
PID 2748 wrote to memory of 2776	2748	DllCommonsvc.exe	89
PID 2748 wrote to memory of 2776	2748	DllCommonsvc.exe	89
PID 2748 wrote to memory of 2776	2748	DllCommonsvc.exe	89
PID 2748 wrote to memory of 1544	2748	DllCommonsvc.exe	90
PID 2748 wrote to memory of 1544	2748	DllCommonsvc.exe	90
PID 2748 wrote to memory of 1544	2748	DllCommonsvc.exe	90
PID 2748 wrote to memory of 1580	2748	DllCommonsvc.exe	91
PID 2748 wrote to memory of 1580	2748	DllCommonsvc.exe	91
PID 2748 wrote to memory of 1580	2748	DllCommonsvc.exe	91
PID 2748 wrote to memory of 2652	2748	DllCommonsvc.exe	92
PID 2748 wrote to memory of 2652	2748	DllCommonsvc.exe	92
PID 2748 wrote to memory of 2652	2748	DllCommonsvc.exe	92
PID 2748 wrote to memory of 1668	2748	DllCommonsvc.exe	93
PID 2748 wrote to memory of 1668	2748	DllCommonsvc.exe	93
PID 2748 wrote to memory of 1668	2748	DllCommonsvc.exe	93
PID 2748 wrote to memory of 2808	2748	DllCommonsvc.exe	94
PID 2748 wrote to memory of 2808	2748	DllCommonsvc.exe	94
PID 2748 wrote to memory of 2808	2748	DllCommonsvc.exe	94
PID 2748 wrote to memory of 2928	2748	DllCommonsvc.exe	95
PID 2748 wrote to memory of 2928	2748	DllCommonsvc.exe	95
PID 2748 wrote to memory of 2928	2748	DllCommonsvc.exe	95
PID 2748 wrote to memory of 2764	2748	DllCommonsvc.exe	96
PID 2748 wrote to memory of 2764	2748	DllCommonsvc.exe	96
PID 2748 wrote to memory of 2764	2748	DllCommonsvc.exe	96
PID 2748 wrote to memory of 2804	2748	DllCommonsvc.exe	97
PID 2748 wrote to memory of 2804	2748	DllCommonsvc.exe	97
PID 2748 wrote to memory of 2804	2748	DllCommonsvc.exe	97
PID 2748 wrote to memory of 2668	2748	DllCommonsvc.exe	99
PID 2748 wrote to memory of 2668	2748	DllCommonsvc.exe	99
PID 2748 wrote to memory of 2668	2748	DllCommonsvc.exe	99
PID 2748 wrote to memory of 2720	2748	DllCommonsvc.exe	100
PID 2748 wrote to memory of 2720	2748	DllCommonsvc.exe	100
PID 2748 wrote to memory of 2720	2748	DllCommonsvc.exe	100
PID 2748 wrote to memory of 2024	2748	DllCommonsvc.exe	117

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7b97974c3d06cd76a00fa846f9d8587211d810116ffa8005b145caee80e8d122.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7b97974c3d06cd76a00fa846f9d8587211d810116ffa8005b145caee80e8d122.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2668
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2824
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2128
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2748
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:868
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Media Player\es-ES\explorer.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1056
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Microsoft Help\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2476
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Speech\taskhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2504
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\PLA\System\System.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1660
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\cmd.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2768
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\conhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2776
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Photo Viewer\de-DE\taskhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1544
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\IME\IMESC5\HELP\services.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1580
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\taskhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2652
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1668
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Start Menu\OSPPSVC.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2808
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Application Data\taskhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2928
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Mail\en-US\OSPPSVC.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2764
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft Office\System.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2804
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Google\Update\1.3.36.151\sppsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2668
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\smss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2720
    - - C:\Windows\IME\IMESC5\HELP\services.exe
        
        "C:\Windows\IME\IMESC5\HELP\services.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2024
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\5ldsg1wMto.bat"
        6⤵
        
        PID:2620
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:2124
        
        C:\Windows\IME\IMESC5\HELP\services.exe
        
        "C:\Windows\IME\IMESC5\HELP\services.exe"
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2836
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\D9KWG0zl28.bat"
        8⤵
        
        PID:1716
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:2700
        
        C:\Windows\IME\IMESC5\HELP\services.exe
        
        "C:\Windows\IME\IMESC5\HELP\services.exe"
        9⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1692
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\sQQ1IAg9p0.bat"
        10⤵
        
        PID:2748
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:2932
        
        C:\Windows\IME\IMESC5\HELP\services.exe
        
        "C:\Windows\IME\IMESC5\HELP\services.exe"
        11⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:336
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\VDNADHaqjn.bat"
        12⤵
        
        PID:1060
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:2856
        
        C:\Windows\IME\IMESC5\HELP\services.exe
        
        "C:\Windows\IME\IMESC5\HELP\services.exe"
        13⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2500
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\kKaF7FiTK0.bat"
        14⤵
        
        PID:1568
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        15⤵
        
        PID:2632
        
        C:\Windows\IME\IMESC5\HELP\services.exe
        
        "C:\Windows\IME\IMESC5\HELP\services.exe"
        15⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2168
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\UJpHfzfs2i.bat"
        16⤵
        
        PID:572
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        17⤵
        
        PID:3036
        
        C:\Windows\IME\IMESC5\HELP\services.exe
        
        "C:\Windows\IME\IMESC5\HELP\services.exe"
        17⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1596
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\4NR89d4K3E.bat"
        18⤵
        
        PID:876
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        19⤵
        
        PID:1620
        
        C:\Windows\IME\IMESC5\HELP\services.exe
        
        "C:\Windows\IME\IMESC5\HELP\services.exe"
        19⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Media Player\es-ES\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\es-ES\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Media Player\es-ES\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\Microsoft Help\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\All Users\Microsoft Help\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\Microsoft Help\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 10 /tr "'C:\Windows\Speech\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2164

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Windows\Speech\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 13 /tr "'C:\Windows\Speech\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2256

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 13 /tr "'C:\Windows\PLA\System\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2188

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Windows\PLA\System\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 6 /tr "'C:\Windows\PLA\System\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Photo Viewer\de-DE\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\de-DE\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Photo Viewer\de-DE\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 12 /tr "'C:\Windows\IME\IMESC5\HELP\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Windows\IME\IMESC5\HELP\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2212

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 6 /tr "'C:\Windows\IME\IMESC5\HELP\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 9 /tr "'C:\providercommon\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\providercommon\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 7 /tr "'C:\providercommon\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\Start Menu\OSPPSVC.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Users\All Users\Start Menu\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\Start Menu\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\Application Data\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Users\All Users\Application Data\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2420

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\Application Data\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Mail\en-US\OSPPSVC.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\en-US\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Mail\en-US\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Microsoft Office\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Office\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Microsoft Office\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Google\Update\1.3.36.151\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\Update\1.3.36.151\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Google\Update\1.3.36.151\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2312

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\providercommon\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\providercommon\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\providercommon\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fd5357ae3a9323b69afd76a541ca5510

SHA1
5a9bf4ebf434e1ea8d9c6fff9447a2ce279d4db5

SHA256
851dfae693dd17972fd47166491d845ca392bf5fb6b84e65215e8a65078a3682

SHA512
c4611629aeb8d9688e60a7bb8d14ef3d91ffe6adbaeb5908f84854a046f6c7bfbc5255e8b542dfab40af07db9322b8a258b70d1cbc7b8bbb0940977a738ea0b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0abd5d95acff41c90f3945cc74094eca

SHA1
e06c30eb7775fa05b55f59eaa8b10723f22f3586

SHA256
65e87f92d1851d503a7788f3c546966efb386933ac80b0a4506599eb80940696

SHA512
c065af1fba281344ed932f44e440028072f6262b7f1b9ab0954a8ce9e5786d6157631534d8f0ae3b02749609c480ef40d4095cc620057edf412677b8342f2f4c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ca758d66355dc82443319ea1d742d344

SHA1
48bf76d6063d311237ff862046ccfca49bb4d52e

SHA256
549fbca77023f9b85176308ba67bd8901523e58745cb8a80f7d7d6733befc208

SHA512
3eb858b86c808e735292697b068749d308e0086f556dacd769e52a9adf2036f783baeb71b7a54852337a6f5f8b79b04de8cda427bd9bccffc1131b5b89f477cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d8a4a0a2572d7c232abbc09a2d23e88e

SHA1
c567757eb54a22a90da239ee9f5ee0f2c69b7d4b

SHA256
d56724cbcd532992d589c437af9cc02ddd786eb493a2d93b18e3423b556f51ea

SHA512
837856fe504134faf68271590bc83a206aa188724d9a392575463782d2af30b01f5f021261286ea2a143b51ae4dd9ecdfbb408fe281c6c2a9939c212d2fd096f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1ccd3ac6a146466d69b540f11d27ff32

SHA1
1b26ca6c3b894065c8e7fcc3c8f3f5ac64da0160

SHA256
3763daf3832dcecb08f657f37b09992bc176e035a4f33989aa75dbfa2ed6e7e3

SHA512
0c925d18893eae8bd33c2c9747b445bdd34140d31ca9066d8e793c0b9560a22610626a7f96caa441cebac8efabc5efd08aff15685ce9de2dbdfd1ca256fd6507

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c4dc64191c9144aa18b13e37cc4169bf

SHA1
a7a083c4e82def282ab30e4189221c779f9fcd98

SHA256
49e78d1dd969f3b523dd2b6fb85925e4d464a83c22f16944c66ffadaf39eaacd

SHA512
cb76ea46edff8ef478c8f4e791568fbef52c69c29ec530552f00b8b132fa6d1879ca32b27e6508cad3f7524a333e46e13f7d91d187f275548b8f2552a5d3aade

Download Submit
C:\Users\Admin\AppData\Local\Temp\4NR89d4K3E.bat

Filesize
204B

MD5
d13c56e22232b856db5d23bdddd6f678

SHA1
f4a914748bc9f1dde27ef27d801124e43f188306

SHA256
f5922fa564361ed95ccdd624bfbcab357991f53b2d2fc09755f51171dc2871f4

SHA512
7ed1759ab7b05cf4e31278e3f499a021f1c048cfab293542164928a4d677632d2efd8eb2b7b9650fc20fc84fa2a4436f3ececbc6f616c431d0dc5aed41b78642

Download Submit
C:\Users\Admin\AppData\Local\Temp\5ldsg1wMto.bat

Filesize
204B

MD5
861a122c7484ba66bb22341abbaa24a8

SHA1
fd7b2dbc35a225d6bd30252cc1e0c3124fc405e4

SHA256
dc5401e66f88c3859f78aa5e3e24ba7bf551bf49886d81a190325a9fe63619d6

SHA512
b1ecf0817fadcdd549ce351ea6f94b2297ffab293386199c43873ca1a4e4519874e0fe89efe9a4ade201168f8cbf8180fb46c0a284dca896c98e88ca0c9c2be4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9964.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\D9KWG0zl28.bat

Filesize
204B

MD5
3c3227334a775a4e374cee9060444363

SHA1
b64dfa3fee34c2a64c549baeeefd690d99d304bd

SHA256
a83bfae4ca3c0ed518340b784a5e9d0cd30b0cf782e40793b91226dcfce3f888

SHA512
4d12e3206dd33bbe26b2f2af930645789d73ee263fd8778e7c45b8905e2081c1420007e25582e65ada660e228c7a5c0ed32dd7a0336c85cfb91d2266a7adc579

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9977.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\UJpHfzfs2i.bat

Filesize
204B

MD5
31849dc5152c591d54d6ca9a6ccb98c8

SHA1
3cdbbc37ff88e01b9e1a04aca71c2318d41311ca

SHA256
c6ca2964bdc3e5643b04dd598b237a668ad6b191ef0932110da5f5600e62863d

SHA512
11cfe38765de782125647f8b06e48c4b0fa7cb781b1bd49ed386364c50ecf47c75679e943ac4443665fcaffd201e9c45230f1f1da9184746d10d79af14426218

Download Submit
C:\Users\Admin\AppData\Local\Temp\VDNADHaqjn.bat

Filesize
204B

MD5
cae335f939dfa171268687bcdc62c590

SHA1
b308b2128be316937109d677f25466e21d0a31cd

SHA256
1a9078ad7731160f04c689263722958e4b06522da89bae623556b0938e85cb4c

SHA512
09f806bb4b2accea4c0f87016661329a13869846b09b6e4ce0da9e723058c634c8cc3945da7e8a86206c7e6099bca1b03d86a1c618a260f11de3d6ce34469f1b

Download Submit
C:\Users\Admin\AppData\Local\Temp\kKaF7FiTK0.bat

Filesize
204B

MD5
9c76ebddec707639f6d1fdfcd13dd30c

SHA1
ff0d5330ed6309b1be5ccc3f0e5762bd5b30392b

SHA256
75aa538fa0ab07371c2652fc988e9a63038a72f4a9ebc1c27af77a58bb14c2ad

SHA512
06363b76845a5326177517646791fee3511c52e084f4de815b6ab571439fd3ec992425cb6952993a6c621ed3bd897561dce3749b2d137322db2cc2633a6c1f4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\sQQ1IAg9p0.bat

Filesize
204B

MD5
189276f7d9b102b5f91945f9bbaf8e89

SHA1
e4824af8cee2fd02d50c2fc9559b2f5b39ad3bc5

SHA256
424a0430f3db406f5d3a0d52536c810e56f21917ced10f5b1ce877976d5b1d0c

SHA512
f1c97be4ca3c0297e339ff40b9627bbad632c2986aa3166cd679128a8af3dba86df65618fd86d4c1ddf0bf0eec1ad74473199a753fca1916a0f8b85fec223675

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
be5cc65152c020f0bc05c24dd2b2eaed

SHA1
71b2c4ac8a076a22545d4967b1931b77fbf9b976

SHA256
6405d2dcdb11c828cdf3ccd24b519ca3624b438e2bfca4fc440de488a239e90d

SHA512
ed5e18b333c2fe91c817f31d8900e6e04cb931389c2cd89b6430af9d16da9ddf08bc4ed798af27d5034f5e69f6715bb240c353a7b7cc989c8cf2e818eac2300a

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
memory/336-316-0x0000000001030000-0x0000000001140000-memory.dmp

Filesize
1.1MB

Download
memory/868-79-0x000000001B5B0000-0x000000001B892000-memory.dmp

Filesize
2.9MB

Download
memory/868-80-0x0000000002820000-0x0000000002828000-memory.dmp

Filesize
32KB

Download
memory/1476-554-0x00000000012A0000-0x00000000013B0000-memory.dmp

Filesize
1.1MB

Download
memory/1692-256-0x0000000000450000-0x0000000000462000-memory.dmp

Filesize
72KB

Download
memory/1692-255-0x0000000000F40000-0x0000000001050000-memory.dmp

Filesize
1.1MB

Download
memory/2024-111-0x0000000000B10000-0x0000000000C20000-memory.dmp

Filesize
1.1MB

Download
memory/2168-435-0x0000000001170000-0x0000000001280000-memory.dmp

Filesize
1.1MB

Download
memory/2748-16-0x00000000001F0000-0x00000000001FC000-memory.dmp

Filesize
48KB

Download
memory/2748-14-0x00000000001D0000-0x00000000001E2000-memory.dmp

Filesize
72KB

Download
memory/2748-13-0x0000000000DF0000-0x0000000000F00000-memory.dmp

Filesize
1.1MB

Download
memory/2748-15-0x00000000001E0000-0x00000000001EC000-memory.dmp

Filesize
48KB

Download
memory/2748-17-0x0000000000580000-0x000000000058C000-memory.dmp

Filesize
48KB

Download
memory/2836-195-0x0000000000350000-0x0000000000362000-memory.dmp

Filesize
72KB

Download