dcrat | 5620417051eb113618f81a56d9d7ac4399663e6840b41d971b8e45a0566f112b

Analysis

max time kernel
146s
max time network
142s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21-12-2024 16:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5620417051eb113618f81a56d9d7ac4399663e6840b41d971b8e45a0566f112b.exe
Size

1.3MB
MD5

1e394b775120b91486eec27598ee0e1c
SHA1

c073751a00a9a056388198846fede30d18b47413
SHA256

5620417051eb113618f81a56d9d7ac4399663e6840b41d971b8e45a0566f112b
SHA512

514be567568b978639e368c0a70f94d758382a563fe0cc0be4dee1ea52f9103692eb577342887563f50041e374a1ca0e8e7e2922b5220bafab216079bc2ef0ee
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 39 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2480	2552	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3016	2552	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2044	2552	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1972	2552	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2856	2552	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2984	2552	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2232	2552	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	484	2552	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1400	2552	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1296	2552	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1788	2552	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1664	2552	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2352	2552	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2460	2552	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2788	2552	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2348	2552	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1404	2552	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2300	2552	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1996	2552	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2004	2552	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2444	2552	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2312	2552	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1772	2552	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3040	2552	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2828	2552	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3024	2552	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3008	2552	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2548	2552	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2672	2552	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2880	2552	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2148	2552	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1104	2552	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2140	2552	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	692	2552	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2508	2552	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1368	2552	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2284	2552	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1676	2552	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1784	2552	schtasks.exe	35

DCRat payload 8 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0007000000016cec-9.dat	dcrat
behavioral1/memory/2816-13-0x0000000000EE0000-0x0000000000FF0000-memory.dmp	dcrat
behavioral1/memory/616-65-0x0000000000010000-0x0000000000120000-memory.dmp	dcrat
behavioral1/memory/1400-115-0x0000000000E00000-0x0000000000F10000-memory.dmp	dcrat
behavioral1/memory/2192-151-0x0000000000390000-0x00000000004A0000-memory.dmp	dcrat
behavioral1/memory/1692-210-0x00000000009F0000-0x0000000000B00000-memory.dmp	dcrat
behavioral1/memory/2860-271-0x0000000001260000-0x0000000001370000-memory.dmp	dcrat
behavioral1/memory/2196-689-0x0000000000140000-0x0000000000250000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 16 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
680	powershell.exe
1192	powershell.exe
2528	powershell.exe
2216	powershell.exe
2592	powershell.exe
2812	powershell.exe
2332	powershell.exe
2656	powershell.exe
2492	powershell.exe
2928	powershell.exe
2840	powershell.exe
1980	powershell.exe
2972	powershell.exe
2220	powershell.exe
1828	powershell.exe
1308	powershell.exe

Executes dropped EXE 13 IoCs

pid	Process
2816	DllCommonsvc.exe
616	DllCommonsvc.exe
1400	DllCommonsvc.exe
2192	dllhost.exe
1692	dllhost.exe
2860	dllhost.exe
2356	dllhost.exe
2956	dllhost.exe
264	dllhost.exe
1076	dllhost.exe
2120	dllhost.exe
896	dllhost.exe
2196	dllhost.exe

Loads dropped DLL 2 IoCs

pid	Process
3064	cmd.exe
3064	cmd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 10 IoCs

Web Service

T1102

flow	ioc
4	raw.githubusercontent.com
5	raw.githubusercontent.com
12	raw.githubusercontent.com
26	raw.githubusercontent.com
33	raw.githubusercontent.com
9	raw.githubusercontent.com
15	raw.githubusercontent.com
19	raw.githubusercontent.com
22	raw.githubusercontent.com
29	raw.githubusercontent.com

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Google\Update\Offline\dllhost.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Google\Update\Offline\5940a34987c991	DllCommonsvc.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\addins\csrss.exe	DllCommonsvc.exe
File created	C:\Windows\addins\886983d96e3d3e	DllCommonsvc.exe
File created	C:\Windows\Tasks\c5b4cb5e9653cc	DllCommonsvc.exe
File created	C:\Windows\Boot\PCAT\cmd.exe	DllCommonsvc.exe
File created	C:\Windows\Performance\WinSAT\DataStore\dllhost.exe	DllCommonsvc.exe
File created	C:\Windows\Performance\WinSAT\DataStore\5940a34987c991	DllCommonsvc.exe
File created	C:\Windows\Microsoft.NET\authman\lsass.exe	DllCommonsvc.exe
File created	C:\Windows\Microsoft.NET\authman\6203df4a6bafc7	DllCommonsvc.exe
File created	C:\Windows\Tasks\services.exe	DllCommonsvc.exe
File opened for modification	C:\Windows\Tasks\services.exe	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5620417051eb113618f81a56d9d7ac4399663e6840b41d971b8e45a0566f112b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 39 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2984	schtasks.exe
1400	schtasks.exe
1996	schtasks.exe
2672	schtasks.exe
1664	schtasks.exe
2004	schtasks.exe
2880	schtasks.exe
2508	schtasks.exe
1972	schtasks.exe
1404	schtasks.exe
2828	schtasks.exe
3024	schtasks.exe
692	schtasks.exe
1368	schtasks.exe
2480	schtasks.exe
2352	schtasks.exe
2300	schtasks.exe
2312	schtasks.exe
2548	schtasks.exe
2444	schtasks.exe
3040	schtasks.exe
3008	schtasks.exe
3016	schtasks.exe
2044	schtasks.exe
2856	schtasks.exe
2232	schtasks.exe
484	schtasks.exe
2140	schtasks.exe
2284	schtasks.exe
2460	schtasks.exe
2348	schtasks.exe
1772	schtasks.exe
1676	schtasks.exe
1296	schtasks.exe
1788	schtasks.exe
2788	schtasks.exe
2148	schtasks.exe
1104	schtasks.exe
1784	schtasks.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
2816	DllCommonsvc.exe
2816	DllCommonsvc.exe
2816	DllCommonsvc.exe
2816	DllCommonsvc.exe
2816	DllCommonsvc.exe
2840	powershell.exe
680	powershell.exe
2528	powershell.exe
1828	powershell.exe
1980	powershell.exe
1192	powershell.exe
616	DllCommonsvc.exe
616	DllCommonsvc.exe
616	DllCommonsvc.exe
2812	powershell.exe
2332	powershell.exe
2972	powershell.exe
2656	powershell.exe
2216	powershell.exe
2592	powershell.exe
1400	DllCommonsvc.exe
2220	powershell.exe
1308	powershell.exe
2492	powershell.exe
2928	powershell.exe
2192	dllhost.exe
1692	dllhost.exe
2860	dllhost.exe
2356	dllhost.exe
2956	dllhost.exe
264	dllhost.exe
1076	dllhost.exe
2120	dllhost.exe
896	dllhost.exe
2196	dllhost.exe

Suspicious use of AdjustPrivilegeToken 29 IoCs

description	pid	Process
Token: SeDebugPrivilege	2816	DllCommonsvc.exe
Token: SeDebugPrivilege	2840	powershell.exe
Token: SeDebugPrivilege	680	powershell.exe
Token: SeDebugPrivilege	2528	powershell.exe
Token: SeDebugPrivilege	1828	powershell.exe
Token: SeDebugPrivilege	1980	powershell.exe
Token: SeDebugPrivilege	1192	powershell.exe
Token: SeDebugPrivilege	616	DllCommonsvc.exe
Token: SeDebugPrivilege	2812	powershell.exe
Token: SeDebugPrivilege	2332	powershell.exe
Token: SeDebugPrivilege	2972	powershell.exe
Token: SeDebugPrivilege	2656	powershell.exe
Token: SeDebugPrivilege	2216	powershell.exe
Token: SeDebugPrivilege	2592	powershell.exe
Token: SeDebugPrivilege	1400	DllCommonsvc.exe
Token: SeDebugPrivilege	2220	powershell.exe
Token: SeDebugPrivilege	1308	powershell.exe
Token: SeDebugPrivilege	2492	powershell.exe
Token: SeDebugPrivilege	2928	powershell.exe
Token: SeDebugPrivilege	2192	dllhost.exe
Token: SeDebugPrivilege	1692	dllhost.exe
Token: SeDebugPrivilege	2860	dllhost.exe
Token: SeDebugPrivilege	2356	dllhost.exe
Token: SeDebugPrivilege	2956	dllhost.exe
Token: SeDebugPrivilege	264	dllhost.exe
Token: SeDebugPrivilege	1076	dllhost.exe
Token: SeDebugPrivilege	2120	dllhost.exe
Token: SeDebugPrivilege	896	dllhost.exe
Token: SeDebugPrivilege	2196	dllhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1560 wrote to memory of 2652	1560	5620417051eb113618f81a56d9d7ac4399663e6840b41d971b8e45a0566f112b.exe	31
PID 1560 wrote to memory of 2652	1560	5620417051eb113618f81a56d9d7ac4399663e6840b41d971b8e45a0566f112b.exe	31
PID 1560 wrote to memory of 2652	1560	5620417051eb113618f81a56d9d7ac4399663e6840b41d971b8e45a0566f112b.exe	31
PID 1560 wrote to memory of 2652	1560	5620417051eb113618f81a56d9d7ac4399663e6840b41d971b8e45a0566f112b.exe	31
PID 2652 wrote to memory of 3064	2652	WScript.exe	32
PID 2652 wrote to memory of 3064	2652	WScript.exe	32
PID 2652 wrote to memory of 3064	2652	WScript.exe	32
PID 2652 wrote to memory of 3064	2652	WScript.exe	32
PID 3064 wrote to memory of 2816	3064	cmd.exe	34
PID 3064 wrote to memory of 2816	3064	cmd.exe	34
PID 3064 wrote to memory of 2816	3064	cmd.exe	34
PID 3064 wrote to memory of 2816	3064	cmd.exe	34
PID 2816 wrote to memory of 2528	2816	DllCommonsvc.exe	51
PID 2816 wrote to memory of 2528	2816	DllCommonsvc.exe	51
PID 2816 wrote to memory of 2528	2816	DllCommonsvc.exe	51
PID 2816 wrote to memory of 2840	2816	DllCommonsvc.exe	52
PID 2816 wrote to memory of 2840	2816	DllCommonsvc.exe	52
PID 2816 wrote to memory of 2840	2816	DllCommonsvc.exe	52
PID 2816 wrote to memory of 680	2816	DllCommonsvc.exe	53
PID 2816 wrote to memory of 680	2816	DllCommonsvc.exe	53
PID 2816 wrote to memory of 680	2816	DllCommonsvc.exe	53
PID 2816 wrote to memory of 1192	2816	DllCommonsvc.exe	54
PID 2816 wrote to memory of 1192	2816	DllCommonsvc.exe	54
PID 2816 wrote to memory of 1192	2816	DllCommonsvc.exe	54
PID 2816 wrote to memory of 1828	2816	DllCommonsvc.exe	55
PID 2816 wrote to memory of 1828	2816	DllCommonsvc.exe	55
PID 2816 wrote to memory of 1828	2816	DllCommonsvc.exe	55
PID 2816 wrote to memory of 1980	2816	DllCommonsvc.exe	57
PID 2816 wrote to memory of 1980	2816	DllCommonsvc.exe	57
PID 2816 wrote to memory of 1980	2816	DllCommonsvc.exe	57
PID 2816 wrote to memory of 2428	2816	DllCommonsvc.exe	63
PID 2816 wrote to memory of 2428	2816	DllCommonsvc.exe	63
PID 2816 wrote to memory of 2428	2816	DllCommonsvc.exe	63
PID 2428 wrote to memory of 2112	2428	cmd.exe	65
PID 2428 wrote to memory of 2112	2428	cmd.exe	65
PID 2428 wrote to memory of 2112	2428	cmd.exe	65
PID 2428 wrote to memory of 616	2428	cmd.exe	66
PID 2428 wrote to memory of 616	2428	cmd.exe	66
PID 2428 wrote to memory of 616	2428	cmd.exe	66
PID 616 wrote to memory of 2812	616	DllCommonsvc.exe	82
PID 616 wrote to memory of 2812	616	DllCommonsvc.exe	82
PID 616 wrote to memory of 2812	616	DllCommonsvc.exe	82
PID 616 wrote to memory of 2332	616	DllCommonsvc.exe	83
PID 616 wrote to memory of 2332	616	DllCommonsvc.exe	83
PID 616 wrote to memory of 2332	616	DllCommonsvc.exe	83
PID 616 wrote to memory of 2656	616	DllCommonsvc.exe	84
PID 616 wrote to memory of 2656	616	DllCommonsvc.exe	84
PID 616 wrote to memory of 2656	616	DllCommonsvc.exe	84
PID 616 wrote to memory of 2972	616	DllCommonsvc.exe	87
PID 616 wrote to memory of 2972	616	DllCommonsvc.exe	87
PID 616 wrote to memory of 2972	616	DllCommonsvc.exe	87
PID 616 wrote to memory of 2592	616	DllCommonsvc.exe	88
PID 616 wrote to memory of 2592	616	DllCommonsvc.exe	88
PID 616 wrote to memory of 2592	616	DllCommonsvc.exe	88
PID 616 wrote to memory of 2216	616	DllCommonsvc.exe	89
PID 616 wrote to memory of 2216	616	DllCommonsvc.exe	89
PID 616 wrote to memory of 2216	616	DllCommonsvc.exe	89
PID 616 wrote to memory of 1944	616	DllCommonsvc.exe	94
PID 616 wrote to memory of 1944	616	DllCommonsvc.exe	94
PID 616 wrote to memory of 1944	616	DllCommonsvc.exe	94
PID 1944 wrote to memory of 2660	1944	cmd.exe	96
PID 1944 wrote to memory of 2660	1944	cmd.exe	96
PID 1944 wrote to memory of 2660	1944	cmd.exe	96
PID 1944 wrote to memory of 1400	1944	cmd.exe	97

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\5620417051eb113618f81a56d9d7ac4399663e6840b41d971b8e45a0566f112b.exe
"C:\Users\Admin\AppData\Local\Temp\5620417051eb113618f81a56d9d7ac4399663e6840b41d971b8e45a0566f112b.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1560
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2652
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3064
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2816
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2528
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Tasks\services.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2840
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Google\Update\Offline\dllhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:680
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\smss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1192
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\addins\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1828
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\dwm.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1980
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\cxYi63xnrq.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2428
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:2112
      - C:\providercommon\DllCommonsvc.exe
        
        "C:\providercommon\DllCommonsvc.exe"
        6⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:616
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2812
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\wininit.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2332
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\lsass.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2656
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\taskhost.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2972
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Performance\WinSAT\DataStore\dllhost.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2592
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\authman\lsass.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2216
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\K0dOGdGVri.bat"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:1944
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:2660
        
        C:\providercommon\DllCommonsvc.exe
        
        "C:\providercommon\DllCommonsvc.exe"
        8⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1400
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        9⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2492
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\dllhost.exe'
        9⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2220
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\lsm.exe'
        9⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1308
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Desktop\System.exe'
        9⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2928
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\rM02WA8Et9.bat"
        9⤵
        
        PID:1868
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:2472
        
        C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\dllhost.exe
        
        "C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\dllhost.exe"
        10⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2192
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\SQTB2Yz9K3.bat"
        11⤵
        
        PID:2988
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:2412
        
        C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\dllhost.exe
        
        "C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\dllhost.exe"
        12⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1692
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\c0TJHXkWh8.bat"
        13⤵
        
        PID:1424
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        14⤵
        
        PID:2912
        
        C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\dllhost.exe
        
        "C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\dllhost.exe"
        14⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2860
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Z7DRyUOV59.bat"
        15⤵
        
        PID:2224
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        16⤵
        
        PID:1640
        
        C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\dllhost.exe
        
        "C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\dllhost.exe"
        16⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2356
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\sSDDfDN1Wn.bat"
        17⤵
        
        PID:1132
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        18⤵
        
        PID:700
        
        C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\dllhost.exe
        
        "C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\dllhost.exe"
        18⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2956
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\n7UEJyIAjk.bat"
        19⤵
        
        PID:1324
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        20⤵
        
        PID:2524
        
        C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\dllhost.exe
        
        "C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\dllhost.exe"
        20⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:264
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\cqXkQwtlzQ.bat"
        21⤵
        
        PID:928
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        22⤵
        
        PID:1968
        
        C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\dllhost.exe
        
        "C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\dllhost.exe"
        22⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1076
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\J97QZsi4Oz.bat"
        23⤵
        
        PID:2308
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        24⤵
        
        PID:2844
        
        C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\dllhost.exe
        
        "C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\dllhost.exe"
        24⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2120
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\HAJBVlyJNQ.bat"
        25⤵
        
        PID:1432
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        26⤵
        
        PID:796
        
        C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\dllhost.exe
        
        "C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\dllhost.exe"
        26⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:896
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\iqKdioc4MG.bat"
        27⤵
        
        PID:1828
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        28⤵
        
        PID:3060
        
        C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\dllhost.exe
        
        "C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\dllhost.exe"
        28⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2196

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 5 /tr "'C:\Windows\Tasks\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Windows\Tasks\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 6 /tr "'C:\Windows\Tasks\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Google\Update\Offline\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\Update\Offline\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Google\Update\Offline\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2232

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Windows\addins\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1296

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\addins\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1788

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Windows\addins\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 5 /tr "'C:\providercommon\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\providercommon\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\providercommon\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2788

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 13 /tr "'C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2312

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 12 /tr "'C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Windows\Performance\WinSAT\DataStore\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\Performance\WinSAT\DataStore\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Windows\Performance\WinSAT\DataStore\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\Windows\Microsoft.NET\authman\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\Microsoft.NET\authman\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\Windows\Microsoft.NET\authman\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2148

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2140

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 14 /tr "'C:\providercommon\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\providercommon\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 8 /tr "'C:\providercommon\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1368

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 9 /tr "'C:\Users\Default\Desktop\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Users\Default\Desktop\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 5 /tr "'C:\Users\Default\Desktop\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e5e23da18fa14bf482f334792315a09b

SHA1
6fb5eb8bd2e3b8f47be04843ac20ebc1b5c94ad8

SHA256
19e7673dd3b81db28fac2e4eb38dd35f515dd209eb363e180c7a6ffeafe9fc47

SHA512
1461b8b91786f22ec8722d8c25ebb0a39e72990b980a0f7b455bde83bcefc99ad231c6fce36ec916c2e850ed28af830e510023f9597d3a60739ecae7543d4cb1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4d4778e905488e2b3e4b26824627d2cc

SHA1
6573b5af242a85bfe352fed583840226a867df45

SHA256
f1c14c8aff9832cb7a20a2cd4ea6c0323f026a91abd239a755663e5ddaec7cde

SHA512
221c2db690b36d49af864f434ae0c7b285274a0e11b569979ab11c2b3f428033e984c187446eaddadfb2ae25294eeaa57e9cb71d82242313ca17a5661df297c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6d067d4d3ebdcad1e1e36eec1da87e2a

SHA1
a036ae7bb6fd5be564ca04f9bd9481291ee8ddaf

SHA256
d99af6f6d588e7ca2e8509cc3d1473402b0f116509eeaa04f57c21de2f711e50

SHA512
85bfd8a2643aa6b6e2b9f000bc26c1d46b63aef20d6923e1a2b138ec2ddad51f86b59c9b71ad4493b3c2af5b0522cb1e8290dab80a172354e95197e097b95e90

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f7a1d567aa3f54a21a8df21a1584fbdd

SHA1
cbebb4c7197b86350330a42179d75755f685b39c

SHA256
4acf05ce9852cab9f14df7ab8fd3ad5a7a34d4e49783848b36fc9078e3783d68

SHA512
b855c27d8a2b116f778c1cbfd4526cff7750bb87066c0b5591ba54275cd56c47fd54ebbc420d34876238bbb0e8b9c2199dd3726de9360f82a73fded5f1887b63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
496d8ee7ba50011d596899c5ba03d990

SHA1
117f36518dfbf1d251a2287457325a1702a772e0

SHA256
5839dddb376523d8fdbede0f0473af4d1bf65fd2ce7738671f0752deb1f2a8f9

SHA512
fca555ebd58f24682214154e7182e89e517644dd0ffb45d217b11733a2b5637ce494249fbfff42d6b2cabbec07423388e129b0c654a515c1b378198dde4f7a81

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6ed1250d5239b2d2c64dce60b4334d12

SHA1
5181dde16dbb78d4a59145749bf9df93199bc98c

SHA256
61144c1e65ece20da5088c24997cb55cda294812cae078394a85b37ab27947bc

SHA512
f63d870126b8dc1158fdf31b125e5e015036d7218489186d4e3a78c140594d004d27f4245d573c8a9e7105a797fe22bb8b626e6affd4a692ffdfd87f1b940d06

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
35879a1b15025a4d915d308340ab0d8d

SHA1
fbe71e4e80495154da3a26d6f266a6de6bc0f916

SHA256
a207734351b0bdf3d433f692c443d8b3837df6ebfff1c91845f70079141ef6e9

SHA512
47510e023d4cabec3f0856e0cb2ce3b63dfc99a032a16137c2a2a02ca6dc535bdaadaa7105880f547d4fabd417111863f73157c7231d7c5f2189b5c0a52e1814

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e26205e24bba3c7b50ca2f405abe9af0

SHA1
eea9861081d804b87154cec817603d453d161063

SHA256
4971cbfbd3e8f3b33db35b869315205ed793e6a71377f6ea4951df87ac6e4b82

SHA512
e47b23c589aaf850842296d4e658f5a688e03cabe019fd2289eeffedba0b5204d590eadd779887f52b2334691f41f09563b0de48a05aa6b27325fcf255a12577

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab76E7.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\HAJBVlyJNQ.bat

Filesize
239B

MD5
28dc0d0e62160e0743076218a55dd19e

SHA1
f94e23f601aab84510d30fb5d04f00841d6ca713

SHA256
2f411df67a8d3b6e5d36787b705fdcffcf566e2a1d5ebfa69803bedcc87e8766

SHA512
9f95980c12c50a12c15d1c139f2b9b1c2af5a15f95fddda2465c416036166374d8366fbb34da2711f7ac653ffd037c6eb58da0c11429b9f59f2641a933dc98ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\J97QZsi4Oz.bat

Filesize
239B

MD5
551165a502afbd5e85e479b04b95d4a1

SHA1
6e09758bcd601ef3daffaa9f943356feb6fc4a83

SHA256
996428530654f29c3f77a3dc488d37ebf0353abdf6a11ab94b34eedf1f7dfb1e

SHA512
704f8c616198a675a2b13df50a26e4417edca0440d408778a83c96ca7aafabb41c4f16c9af916cec88465a45509a5b09aa5cc0ea87dbd948c3e14347dfb1283b

Download Submit
C:\Users\Admin\AppData\Local\Temp\K0dOGdGVri.bat

Filesize
199B

MD5
3d5da08c897eac6bbda8ba8155553239

SHA1
5d8fd5a27fe390dba78eb9ac30e87a5982d7a358

SHA256
956009ff6caf88bb3d67068ca8c8a6cf8be5c00da321173550649f2a5e35e5f3

SHA512
e82e6773e742f8a4d5196a388b9293942ccb031781eeb0ba4c3c93d22b98426d8fef0ff5d6ef2b7bd60d7cddb4f05e3e3890f0e79695870de3c337f76f2518cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\SQTB2Yz9K3.bat

Filesize
239B

MD5
0e1d851f9450f666ac72e82b453f9c43

SHA1
1b6bd0787f2060e4a071a62889f15c77ed0949fd

SHA256
d5b10185b30368832588abb5bb344a7b237303f3e288ab3073358a199b1b795c

SHA512
295ac986448fac3d527035f2f901e96a925918f194c6aec5291feff28fed1fa6004cb2407b4fda188f2c0ec6667bd6661e7d0440f1d24b812fc553f4ca1ff987

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar76F9.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Z7DRyUOV59.bat

Filesize
239B

MD5
2a4ae297476d05b7ca89e63312ef742b

SHA1
faa23c250d6322769c84660ecffe3791974c360d

SHA256
69795d73d2237d79180422118f1cfe591f8dc562b88be6f2be4212491fa8f547

SHA512
6aff431004b86d9d16a37bc94f83b1b046482ec3c6c19c1e944aad797ad3d035610e7441477c02492222d6903abe69b6c9edc6c232612c4f539744440be67898

Download Submit
C:\Users\Admin\AppData\Local\Temp\c0TJHXkWh8.bat

Filesize
239B

MD5
c5b2e50d633de4c1cd9a8005025bda98

SHA1
0eb4ca77a977aae648a1ac46f55c9b85d0ad7296

SHA256
1f5d0fcc4ee66def118403703f25666aac2a04cf27bc0a3f5895d23ccb641cb5

SHA512
fb141fbbfb4d24e103f9554fbb9d64678c59432e8e0c30d91f58d6ac197bbd579a7f0dd6ccccde57e53bd0c0da13da9493af6ed0449852f6598f4d4781f99943

Download Submit
C:\Users\Admin\AppData\Local\Temp\cqXkQwtlzQ.bat

Filesize
239B

MD5
21cc567179c81802e7650ac8a5e4d11f

SHA1
9d042de5cadc02ced8d8213972d5569cbb30df61

SHA256
e8c48d70f9d21b732534d51a82d13d95b4a218485f380316371cea7928d778b6

SHA512
e7cb9301bee9b857e3b9f27f433224a0a913d01eeb8283c28491dc16058c1ad168cbedff5b95829c4cb456cb020a45c93289e4b4e73c468c542cbd60620c4c30

Download Submit
C:\Users\Admin\AppData\Local\Temp\cxYi63xnrq.bat

Filesize
199B

MD5
60ba356972fdfc8c5272f327309a2a6e

SHA1
310a149d7772b360d847772f4452556a2a9b492c

SHA256
70623f5687db101a8c4678999d655febeda0548cf8075a61a7fd10a8b0b2fbea

SHA512
1f09857efa369b5a4c9cb15abf6a6b48e5e19ae8da9e904c00ff05391ce67f5ff83b756287e2ad4bcadfea58abf4473035d9a2cab436da83a0379dd46d5274a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\iqKdioc4MG.bat

Filesize
239B

MD5
fd098c42517d5716b6617bd223e8f9b3

SHA1
4c94bfdc46f815deb3fb842fb87e98fa2c7d6a4e

SHA256
37d53aaf53b198e161db14f0f463154b4ccfe5721c6c6f359d25be1281a5815a

SHA512
bd1d50457638c6dd23198c9e5ac3af6add07ed68acf888b606e3f4303f6d474d1722c90a18cf07f62517ef1d1ad12d3fe9593b5abff3d5aa39589cd338efe03f

Download Submit
C:\Users\Admin\AppData\Local\Temp\n7UEJyIAjk.bat

Filesize
239B

MD5
565339667eee909752b26ea1296516f7

SHA1
b4cc1d4c4a723d7360ca2d2926fc97dda57189ed

SHA256
d62cd0dd0f024e9f4b403bc89f8322e93011875c2daeb83896cf3de7707ed1f4

SHA512
38c02b3d78a7e47ed3926f3e184e72cb2c352b7288df60b354b55ef802f4dc2775e9e88e15f67fde07d7f723a1617cd559f82edaec316138f8377786d6d9a197

Download Submit
C:\Users\Admin\AppData\Local\Temp\rM02WA8Et9.bat

Filesize
239B

MD5
a03e4d5a5351bb6bcae30e42e88b9eb2

SHA1
75f0c01c5a96b7a374d864684f623a1f6769ce25

SHA256
4d7ec7dd811c45117c5cc11541c78403223129dae93e712ddde6064e5af63245

SHA512
0488dfee092e1f34e0b186ad69c5e665e0d94833e7622ca3f31c054ba9bf8a285bb99e149403e80a794adfba8d8b8a992e119151f5f83427572d45558e5a940a

Download Submit
C:\Users\Admin\AppData\Local\Temp\sSDDfDN1Wn.bat

Filesize
239B

MD5
e8db8eacead9d9810022489dffc62fc4

SHA1
84c3b9e3ce6f6c187227ff333ac8173524e4bcc8

SHA256
c6de49b2eb845331f4a3ef474484c4d65e6ada3fbccaef16f6c5f4b3b5f5f280

SHA512
c3d090be0b3b47766c96f141464e85c6431f1323bd984166a2aa38c4e9bb74171c5b518c41d687eb72b159122d761d2ddf89e2112d04cebcb3fc44e14958d5d9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
15a6a45bb6ab6854ce1126f195ea1646

SHA1
7b56ea0eb4414f0a3de00939ff779bedad10d0b3

SHA256
ed13d787b03ef31399869f3a2e54bf73cc7af4cbb3ad811b1899391ce0bfd7a3

SHA512
cec0b38c22fc14798ed07b9485dd5401323cf3510a74ed3550c3d3c9e7e560bcaf7789c7edf762fbfd5f4ca23f3639c6f36c17e3ed1222d1e9a49d73d747121b

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
memory/264-451-0x0000000000760000-0x0000000000772000-memory.dmp

Filesize
72KB

Download
memory/616-65-0x0000000000010000-0x0000000000120000-memory.dmp

Filesize
1.1MB

Download
memory/896-629-0x0000000000240000-0x0000000000252000-memory.dmp

Filesize
72KB

Download
memory/1400-115-0x0000000000E00000-0x0000000000F10000-memory.dmp

Filesize
1.1MB

Download
memory/1400-116-0x0000000000240000-0x0000000000252000-memory.dmp

Filesize
72KB

Download
memory/1692-211-0x00000000002C0000-0x00000000002D2000-memory.dmp

Filesize
72KB

Download
memory/1692-210-0x00000000009F0000-0x0000000000B00000-memory.dmp

Filesize
1.1MB

Download
memory/2192-151-0x0000000000390000-0x00000000004A0000-memory.dmp

Filesize
1.1MB

Download
memory/2196-689-0x0000000000140000-0x0000000000250000-memory.dmp

Filesize
1.1MB

Download
memory/2812-91-0x0000000002860000-0x0000000002868000-memory.dmp

Filesize
32KB

Download
memory/2812-86-0x000000001B700000-0x000000001B9E2000-memory.dmp

Filesize
2.9MB

Download
memory/2816-17-0x0000000000280000-0x000000000028C000-memory.dmp

Filesize
48KB

Download
memory/2816-16-0x0000000000270000-0x000000000027C000-memory.dmp

Filesize
48KB

Download
memory/2816-15-0x0000000000250000-0x000000000025C000-memory.dmp

Filesize
48KB

Download
memory/2816-14-0x0000000000240000-0x0000000000252000-memory.dmp

Filesize
72KB

Download
memory/2816-13-0x0000000000EE0000-0x0000000000FF0000-memory.dmp

Filesize
1.1MB

Download
memory/2840-52-0x0000000002790000-0x0000000002798000-memory.dmp

Filesize
32KB

Download
memory/2840-42-0x000000001B540000-0x000000001B822000-memory.dmp

Filesize
2.9MB

Download
memory/2860-272-0x00000000005E0000-0x00000000005F2000-memory.dmp

Filesize
72KB

Download
memory/2860-271-0x0000000001260000-0x0000000001370000-memory.dmp

Filesize
1.1MB

Download
memory/2956-391-0x0000000000AD0000-0x0000000000AE2000-memory.dmp

Filesize
72KB

Download