dcrat | fb541d074284a12cd503775e8387216dab54816303a08b94f7eacfc7387fa14c

Analysis

max time kernel
150s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-12-2024 19:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_fb541d074284a12cd503775e8387216dab54816303a08b94f7eacfc7387fa14c.exe
Size

1.3MB
MD5

3fce60b6bf907780d774d81fa981bfe4
SHA1

30d3019e6c5ab5719cd192d097d0989a92b8c54e
SHA256

fb541d074284a12cd503775e8387216dab54816303a08b94f7eacfc7387fa14c
SHA512

cb7ee9398e5492d0b5df6b423ada0739f02e59ae1d49328a11df90c4da0c612efa938220e940f8b5c2a33d85094422fa29603c5155a6c7cddcb1680dbcc32f0a
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 27 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2436	2268	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	224	2268	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3756	2268	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2104	2268	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3792	2268	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2360	2268	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4296	2268	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4452	2268	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2076	2268	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3004	2268	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2356	2268	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1340	2268	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4564	2268	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2972	2268	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3192	2268	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1328	2268	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1752	2268	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3816	2268	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2132	2268	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4380	2268	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5036	2268	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1104	2268	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1280	2268	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2200	2268	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4776	2268	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2664	2268	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4324	2268	schtasks.exe	90

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x000a000000023b7c-10.dat	dcrat
behavioral2/memory/3020-13-0x0000000000910000-0x0000000000A20000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4980	powershell.exe
4108	powershell.exe
3448	powershell.exe
4844	powershell.exe
3640	powershell.exe
4936	powershell.exe
1036	powershell.exe
792	powershell.exe
2920	powershell.exe
2976	powershell.exe

Checks computer location settings 2 TTPs 17 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	JaffaCakes118_fb541d074284a12cd503775e8387216dab54816303a08b94f7eacfc7387fa14c.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe

Executes dropped EXE 16 IoCs

pid	Process
3020	DllCommonsvc.exe
1324	RuntimeBroker.exe
4380	RuntimeBroker.exe
4352	RuntimeBroker.exe
3384	RuntimeBroker.exe
4764	RuntimeBroker.exe
3476	RuntimeBroker.exe
1808	RuntimeBroker.exe
4584	RuntimeBroker.exe
3956	RuntimeBroker.exe
1272	RuntimeBroker.exe
3476	RuntimeBroker.exe
2132	RuntimeBroker.exe
3548	RuntimeBroker.exe
4228	RuntimeBroker.exe
4076	RuntimeBroker.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 15 IoCs

Web Service

T1102

flow	ioc
15	raw.githubusercontent.com
53	raw.githubusercontent.com
55	raw.githubusercontent.com
46	raw.githubusercontent.com
57	raw.githubusercontent.com
58	raw.githubusercontent.com
20	raw.githubusercontent.com
40	raw.githubusercontent.com
42	raw.githubusercontent.com
41	raw.githubusercontent.com
54	raw.githubusercontent.com
56	raw.githubusercontent.com
16	raw.githubusercontent.com
30	raw.githubusercontent.com
45	raw.githubusercontent.com

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\swidtag\dwm.exe	DllCommonsvc.exe
File opened for modification	C:\Program Files\dotnet\swidtag\dwm.exe	DllCommonsvc.exe
File created	C:\Program Files\dotnet\swidtag\6cb0b6c459d5d3	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows NT\Accessories\en-US\RuntimeBroker.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows NT\Accessories\en-US\9e8d7a4ca61bd9	DllCommonsvc.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Registration\RuntimeBroker.exe	DllCommonsvc.exe
File created	C:\Windows\Registration\9e8d7a4ca61bd9	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_fb541d074284a12cd503775e8387216dab54816303a08b94f7eacfc7387fa14c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	JaffaCakes118_fb541d074284a12cd503775e8387216dab54816303a08b94f7eacfc7387fa14c.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	RuntimeBroker.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 27 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3192	schtasks.exe
4380	schtasks.exe
2200	schtasks.exe
4452	schtasks.exe
3004	schtasks.exe
1340	schtasks.exe
4564	schtasks.exe
2972	schtasks.exe
224	schtasks.exe
4296	schtasks.exe
2076	schtasks.exe
2356	schtasks.exe
2132	schtasks.exe
4324	schtasks.exe
3816	schtasks.exe
5036	schtasks.exe
2436	schtasks.exe
3756	schtasks.exe
2104	schtasks.exe
3792	schtasks.exe
2664	schtasks.exe
2360	schtasks.exe
1328	schtasks.exe
1752	schtasks.exe
1104	schtasks.exe
1280	schtasks.exe
4776	schtasks.exe

Suspicious behavior: EnumeratesProcesses 58 IoCs

pid	Process
3020	DllCommonsvc.exe
3020	DllCommonsvc.exe
3020	DllCommonsvc.exe
3020	DllCommonsvc.exe
3020	DllCommonsvc.exe
3020	DllCommonsvc.exe
3020	DllCommonsvc.exe
3020	DllCommonsvc.exe
3020	DllCommonsvc.exe
3020	DllCommonsvc.exe
3020	DllCommonsvc.exe
3020	DllCommonsvc.exe
4980	powershell.exe
4980	powershell.exe
4936	powershell.exe
4936	powershell.exe
1036	powershell.exe
1036	powershell.exe
4844	powershell.exe
4844	powershell.exe
2976	powershell.exe
2976	powershell.exe
4108	powershell.exe
4108	powershell.exe
2920	powershell.exe
2920	powershell.exe
792	powershell.exe
792	powershell.exe
3448	powershell.exe
3448	powershell.exe
3640	powershell.exe
3640	powershell.exe
2976	powershell.exe
2920	powershell.exe
792	powershell.exe
1324	RuntimeBroker.exe
1324	RuntimeBroker.exe
4844	powershell.exe
1036	powershell.exe
4980	powershell.exe
4936	powershell.exe
3448	powershell.exe
3640	powershell.exe
4108	powershell.exe
4380	RuntimeBroker.exe
4352	RuntimeBroker.exe
3384	RuntimeBroker.exe
4764	RuntimeBroker.exe
3476	RuntimeBroker.exe
1808	RuntimeBroker.exe
4584	RuntimeBroker.exe
3956	RuntimeBroker.exe
1272	RuntimeBroker.exe
3476	RuntimeBroker.exe
2132	RuntimeBroker.exe
3548	RuntimeBroker.exe
4228	RuntimeBroker.exe
4076	RuntimeBroker.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: SeDebugPrivilege	3020	DllCommonsvc.exe
Token: SeDebugPrivilege	4980	powershell.exe
Token: SeDebugPrivilege	4936	powershell.exe
Token: SeDebugPrivilege	3448	powershell.exe
Token: SeDebugPrivilege	1036	powershell.exe
Token: SeDebugPrivilege	4844	powershell.exe
Token: SeDebugPrivilege	2976	powershell.exe
Token: SeDebugPrivilege	4108	powershell.exe
Token: SeDebugPrivilege	2920	powershell.exe
Token: SeDebugPrivilege	792	powershell.exe
Token: SeDebugPrivilege	3640	powershell.exe
Token: SeDebugPrivilege	1324	RuntimeBroker.exe
Token: SeDebugPrivilege	4380	RuntimeBroker.exe
Token: SeDebugPrivilege	4352	RuntimeBroker.exe
Token: SeDebugPrivilege	3384	RuntimeBroker.exe
Token: SeDebugPrivilege	4764	RuntimeBroker.exe
Token: SeDebugPrivilege	3476	RuntimeBroker.exe
Token: SeDebugPrivilege	1808	RuntimeBroker.exe
Token: SeDebugPrivilege	4584	RuntimeBroker.exe
Token: SeDebugPrivilege	3956	RuntimeBroker.exe
Token: SeDebugPrivilege	1272	RuntimeBroker.exe
Token: SeDebugPrivilege	3476	RuntimeBroker.exe
Token: SeDebugPrivilege	2132	RuntimeBroker.exe
Token: SeDebugPrivilege	3548	RuntimeBroker.exe
Token: SeDebugPrivilege	4228	RuntimeBroker.exe
Token: SeDebugPrivilege	4076	RuntimeBroker.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 3488	2372	JaffaCakes118_fb541d074284a12cd503775e8387216dab54816303a08b94f7eacfc7387fa14c.exe	85
PID 2372 wrote to memory of 3488	2372	JaffaCakes118_fb541d074284a12cd503775e8387216dab54816303a08b94f7eacfc7387fa14c.exe	85
PID 2372 wrote to memory of 3488	2372	JaffaCakes118_fb541d074284a12cd503775e8387216dab54816303a08b94f7eacfc7387fa14c.exe	85
PID 3488 wrote to memory of 4828	3488	WScript.exe	87
PID 3488 wrote to memory of 4828	3488	WScript.exe	87
PID 3488 wrote to memory of 4828	3488	WScript.exe	87
PID 4828 wrote to memory of 3020	4828	cmd.exe	89
PID 4828 wrote to memory of 3020	4828	cmd.exe	89
PID 3020 wrote to memory of 4844	3020	DllCommonsvc.exe	119
PID 3020 wrote to memory of 4844	3020	DllCommonsvc.exe	119
PID 3020 wrote to memory of 3640	3020	DllCommonsvc.exe	120
PID 3020 wrote to memory of 3640	3020	DllCommonsvc.exe	120
PID 3020 wrote to memory of 792	3020	DllCommonsvc.exe	121
PID 3020 wrote to memory of 792	3020	DllCommonsvc.exe	121
PID 3020 wrote to memory of 4980	3020	DllCommonsvc.exe	122
PID 3020 wrote to memory of 4980	3020	DllCommonsvc.exe	122
PID 3020 wrote to memory of 4936	3020	DllCommonsvc.exe	123
PID 3020 wrote to memory of 4936	3020	DllCommonsvc.exe	123
PID 3020 wrote to memory of 2920	3020	DllCommonsvc.exe	124
PID 3020 wrote to memory of 2920	3020	DllCommonsvc.exe	124
PID 3020 wrote to memory of 3448	3020	DllCommonsvc.exe	125
PID 3020 wrote to memory of 3448	3020	DllCommonsvc.exe	125
PID 3020 wrote to memory of 1036	3020	DllCommonsvc.exe	126
PID 3020 wrote to memory of 1036	3020	DllCommonsvc.exe	126
PID 3020 wrote to memory of 4108	3020	DllCommonsvc.exe	127
PID 3020 wrote to memory of 4108	3020	DllCommonsvc.exe	127
PID 3020 wrote to memory of 2976	3020	DllCommonsvc.exe	128
PID 3020 wrote to memory of 2976	3020	DllCommonsvc.exe	128
PID 3020 wrote to memory of 1324	3020	DllCommonsvc.exe	139
PID 3020 wrote to memory of 1324	3020	DllCommonsvc.exe	139
PID 1324 wrote to memory of 3792	1324	RuntimeBroker.exe	141
PID 1324 wrote to memory of 3792	1324	RuntimeBroker.exe	141
PID 3792 wrote to memory of 1424	3792	cmd.exe	143
PID 3792 wrote to memory of 1424	3792	cmd.exe	143
PID 3792 wrote to memory of 4380	3792	cmd.exe	147
PID 3792 wrote to memory of 4380	3792	cmd.exe	147
PID 4380 wrote to memory of 5092	4380	RuntimeBroker.exe	153
PID 4380 wrote to memory of 5092	4380	RuntimeBroker.exe	153
PID 5092 wrote to memory of 4780	5092	cmd.exe	156
PID 5092 wrote to memory of 4780	5092	cmd.exe	156
PID 5092 wrote to memory of 4352	5092	cmd.exe	162
PID 5092 wrote to memory of 4352	5092	cmd.exe	162
PID 4352 wrote to memory of 4432	4352	RuntimeBroker.exe	166
PID 4352 wrote to memory of 4432	4352	RuntimeBroker.exe	166
PID 4432 wrote to memory of 4940	4432	cmd.exe	168
PID 4432 wrote to memory of 4940	4432	cmd.exe	168
PID 4432 wrote to memory of 3384	4432	cmd.exe	171
PID 4432 wrote to memory of 3384	4432	cmd.exe	171
PID 3384 wrote to memory of 2372	3384	RuntimeBroker.exe	173
PID 3384 wrote to memory of 2372	3384	RuntimeBroker.exe	173
PID 2372 wrote to memory of 3684	2372	cmd.exe	175
PID 2372 wrote to memory of 3684	2372	cmd.exe	175
PID 2372 wrote to memory of 4764	2372	cmd.exe	177
PID 2372 wrote to memory of 4764	2372	cmd.exe	177
PID 4764 wrote to memory of 3560	4764	RuntimeBroker.exe	179
PID 4764 wrote to memory of 3560	4764	RuntimeBroker.exe	179
PID 3560 wrote to memory of 4032	3560	cmd.exe	181
PID 3560 wrote to memory of 4032	3560	cmd.exe	181
PID 3560 wrote to memory of 3476	3560	cmd.exe	183
PID 3560 wrote to memory of 3476	3560	cmd.exe	183
PID 3476 wrote to memory of 4952	3476	RuntimeBroker.exe	185
PID 3476 wrote to memory of 4952	3476	RuntimeBroker.exe	185
PID 4952 wrote to memory of 3652	4952	cmd.exe	187
PID 4952 wrote to memory of 3652	4952	cmd.exe	187

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_fb541d074284a12cd503775e8387216dab54816303a08b94f7eacfc7387fa14c.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_fb541d074284a12cd503775e8387216dab54816303a08b94f7eacfc7387fa14c.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3488
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4828
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3020
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4844
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\dotnet\swidtag\dwm.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3640
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\unsecapp.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:792
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Downloads\unsecapp.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4980
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Registration\RuntimeBroker.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4936
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2920
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\conhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3448
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows NT\Accessories\en-US\RuntimeBroker.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1036
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\OfficeClickToRun.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4108
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Registry.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2976
    - - C:\Program Files (x86)\Windows NT\Accessories\en-US\RuntimeBroker.exe
        
        "C:\Program Files (x86)\Windows NT\Accessories\en-US\RuntimeBroker.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1324
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\IycQG8Pfyu.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3792
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:1424
        
        C:\Program Files (x86)\Windows NT\Accessories\en-US\RuntimeBroker.exe
        
        "C:\Program Files (x86)\Windows NT\Accessories\en-US\RuntimeBroker.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4380
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\45aGjaybPu.bat"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:5092
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:4780
        
        C:\Program Files (x86)\Windows NT\Accessories\en-US\RuntimeBroker.exe
        
        "C:\Program Files (x86)\Windows NT\Accessories\en-US\RuntimeBroker.exe"
        9⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4352
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\IycQG8Pfyu.bat"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:4432
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:4940
        
        C:\Program Files (x86)\Windows NT\Accessories\en-US\RuntimeBroker.exe
        
        "C:\Program Files (x86)\Windows NT\Accessories\en-US\RuntimeBroker.exe"
        11⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3384
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\B4BP5ZSgoJ.bat"
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:2372
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:3684
        
        C:\Program Files (x86)\Windows NT\Accessories\en-US\RuntimeBroker.exe
        
        "C:\Program Files (x86)\Windows NT\Accessories\en-US\RuntimeBroker.exe"
        13⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4764
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\DFgOOKl5EO.bat"
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:3560
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        15⤵
        
        PID:4032
        
        C:\Program Files (x86)\Windows NT\Accessories\en-US\RuntimeBroker.exe
        
        "C:\Program Files (x86)\Windows NT\Accessories\en-US\RuntimeBroker.exe"
        15⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3476
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\TdlfhXh7Yo.bat"
        16⤵
        Suspicious use of WriteProcessMemory
        
        PID:4952
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        17⤵
        
        PID:3652
        
        C:\Program Files (x86)\Windows NT\Accessories\en-US\RuntimeBroker.exe
        
        "C:\Program Files (x86)\Windows NT\Accessories\en-US\RuntimeBroker.exe"
        17⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1808
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\UxOjVeUiuv.bat"
        18⤵
        
        PID:4624
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        19⤵
        
        PID:2284
        
        C:\Program Files (x86)\Windows NT\Accessories\en-US\RuntimeBroker.exe
        
        "C:\Program Files (x86)\Windows NT\Accessories\en-US\RuntimeBroker.exe"
        19⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4584
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\uMS4yFj28m.bat"
        20⤵
        
        PID:3304
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        21⤵
        
        PID:4832
        
        C:\Program Files (x86)\Windows NT\Accessories\en-US\RuntimeBroker.exe
        
        "C:\Program Files (x86)\Windows NT\Accessories\en-US\RuntimeBroker.exe"
        21⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3956
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\bbMo3XBCxD.bat"
        22⤵
        
        PID:3884
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        23⤵
        
        PID:4564
        
        C:\Program Files (x86)\Windows NT\Accessories\en-US\RuntimeBroker.exe
        
        "C:\Program Files (x86)\Windows NT\Accessories\en-US\RuntimeBroker.exe"
        23⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1272
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\arqkgCRh4V.bat"
        24⤵
        
        PID:4976
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        25⤵
        
        PID:1376
        
        C:\Program Files (x86)\Windows NT\Accessories\en-US\RuntimeBroker.exe
        
        "C:\Program Files (x86)\Windows NT\Accessories\en-US\RuntimeBroker.exe"
        25⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3476
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Yvohz7Nokj.bat"
        26⤵
        
        PID:4952
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        27⤵
        
        PID:1692
        
        C:\Program Files (x86)\Windows NT\Accessories\en-US\RuntimeBroker.exe
        
        "C:\Program Files (x86)\Windows NT\Accessories\en-US\RuntimeBroker.exe"
        27⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2132
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\mWzz7cjAeP.bat"
        28⤵
        
        PID:4504
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        29⤵
        
        PID:1320
        
        C:\Program Files (x86)\Windows NT\Accessories\en-US\RuntimeBroker.exe
        
        "C:\Program Files (x86)\Windows NT\Accessories\en-US\RuntimeBroker.exe"
        29⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3548
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Rhkc0SdEF2.bat"
        30⤵
        
        PID:2224
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        31⤵
        
        PID:5012
        
        C:\Program Files (x86)\Windows NT\Accessories\en-US\RuntimeBroker.exe
        
        "C:\Program Files (x86)\Windows NT\Accessories\en-US\RuntimeBroker.exe"
        31⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4228
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\yTz6y56Ktd.bat"
        32⤵
        
        PID:3684
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        33⤵
        
        PID:4316
        
        C:\Program Files (x86)\Windows NT\Accessories\en-US\RuntimeBroker.exe
        
        "C:\Program Files (x86)\Windows NT\Accessories\en-US\RuntimeBroker.exe"
        33⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\Program Files\dotnet\swidtag\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files\dotnet\swidtag\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 5 /tr "'C:\Program Files\dotnet\swidtag\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\unsecapp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 6 /tr "'C:\Users\Default\Downloads\unsecapp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4296

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Users\Default\Downloads\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4452

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 11 /tr "'C:\Users\Default\Downloads\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Windows\Registration\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\Registration\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Windows\Registration\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3192

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1328

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2132

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1280

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Users\Admin\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4324

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\RuntimeBroker.exe.log

Filesize
1KB

MD5
baf55b95da4a601229647f25dad12878

SHA1
abc16954ebfd213733c4493fc1910164d825cac8

SHA256
ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

SHA512
24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
440cb38dbee06645cc8b74d51f6e5f71

SHA1
d7e61da91dc4502e9ae83281b88c1e48584edb7c

SHA256
8ef7a682dfd99ff5b7e9de0e1be43f0016d68695a43c33c028af2635cc15ecfe

SHA512
3aab19578535e6ba0f6beb5690c87d970292100704209d2dcebddcdd46c6bead27588ef5d98729bfd50606a54cc1edf608b3d15bef42c13b9982aaaf15de7fd6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
bd5940f08d0be56e65e5f2aaf47c538e

SHA1
d7e31b87866e5e383ab5499da64aba50f03e8443

SHA256
2d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6

SHA512
c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6d3e9c29fe44e90aae6ed30ccf799ca8

SHA1
c7974ef72264bbdf13a2793ccf1aed11bc565dce

SHA256
2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

SHA512
60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
cadef9abd087803c630df65264a6c81c

SHA1
babbf3636c347c8727c35f3eef2ee643dbcc4bd2

SHA256
cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

SHA512
7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
2e907f77659a6601fcc408274894da2e

SHA1
9f5b72abef1cd7145bf37547cdb1b9254b4efe9d

SHA256
385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233

SHA512
34fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
5f0ddc7f3691c81ee14d17b419ba220d

SHA1
f0ef5fde8bab9d17c0b47137e014c91be888ee53

SHA256
a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

SHA512
2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
59d97011e091004eaffb9816aa0b9abd

SHA1
1602a56b01dd4b7c577ca27d3117e4bcc1aa657b

SHA256
18f381e0db020a763b8c515c346ef58679ab9c403267eacfef5359e272f7e71d

SHA512
d9ca49c1a17580981e2c1a50d73c0eecaa7a62f8514741512172e395af2a3d80aeb0f71c58bc7f52c18246d57ba67af09b6bff4776877d6cc6f0245c30e092d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\45aGjaybPu.bat

Filesize
234B

MD5
8644ee54e80f01a91c1a83112322c2ae

SHA1
9ed27641b3a73f1f8086081eb822cb5eac04aa93

SHA256
d139dd3f653ced12312e481946fdb2afbf335ef15d585dd3e34fe39dbc39d114

SHA512
09ad0f2ec561ccdd049c3385e6172f67c26eef344f2ae0cebb5c7669bbb59147d2174ead9a31575d653268fe442f38a16f935c9d0c57aff72b3c47e20a39e0d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\B4BP5ZSgoJ.bat

Filesize
234B

MD5
02016d715591da7bb2b08d821e1086c8

SHA1
9da987e194e072f729d300b735fbd6e1a2bc627c

SHA256
759b7d08acd1462c60cb0dba8098e5fcbd740d67dba8245e79b115bb8f99abcd

SHA512
e84ed237234e6812b68465b350e238dfc77537024683f3567a40fd08a81b5fbbd3b5ebd6d7770b9516aeb99f5b43394b343ae4c102adfdb1db3babd27caaede5

Download Submit
C:\Users\Admin\AppData\Local\Temp\DFgOOKl5EO.bat

Filesize
234B

MD5
e878ff602c07b97df146b546ce2b0d76

SHA1
557da6d5bb9daefe25508ba3b27b743b3d380b2b

SHA256
866eb456f9f6e65a27ee324b973de476fe5089cefe89eaef69ef594556af12dd

SHA512
9cdb6df0602acfc8f6eb88f2bafae3fd26fe6cdcd7ef18ea0c047786d6e84399c66e5b5cdd8c57e80c701e5702be470872ef6d935075b9836903b1f4bfe6aa3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IycQG8Pfyu.bat

Filesize
234B

MD5
87071de033245198e2833005963bd4dd

SHA1
06e186f180cc762216e55a9b64bc63b1868d2a06

SHA256
9d9ba23c06261fe51e4b862af56acb7bbd2489124d53f0fb6bf96a0c8c022a0a

SHA512
4da2ba68d52779b5bbd1648d2c750576a9aa40d2077ea417371f823d87632d92dc85d2ebfbf0b80183d1abab937b93a71c684eed8612c3155f41283851117fd4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Rhkc0SdEF2.bat

Filesize
234B

MD5
9b0e5a322c0b14b4933d6c7a14eb03a7

SHA1
391330ee39228931678c19ff4949995ca66c432c

SHA256
5d35f7af140f257cd3a1e373775a160aa2532c9f8b9493b4da68233da1d89123

SHA512
b1156df07947f60a5a4d414380a132a3958152bfcd6a1cbbb44f46931ce31f135b53d08038d51a04599b7b4e90e1a4046c3fd1768370e5bdb68f94143f712772

Download Submit
C:\Users\Admin\AppData\Local\Temp\TdlfhXh7Yo.bat

Filesize
234B

MD5
5b717291e80e51045d131c1b4ebce6f6

SHA1
e25ff428c2c9390f23623566b2ff5242463471a6

SHA256
b2784c1e6f8ce272f95482fbe71bf7f67a3a0d7c171a5e59fe421f0fb5876424

SHA512
58d6e95ea0621c6e80b5e1f800e0a1c789a32f72df4798c579e2a6c47aceea5bb40e2ca1bfd18229d5d993c683c61a2c81cc4ad2c4d885219a56f992a0d9605c

Download Submit
C:\Users\Admin\AppData\Local\Temp\UxOjVeUiuv.bat

Filesize
234B

MD5
6d28aedef70c453e2213120b55440497

SHA1
eb804f6296a99f09f3a88f7e16c2cfdb94c52e46

SHA256
506aec7e057a101e95dabb790d011a80ea529110ad31b177aab689e16e09f1a2

SHA512
6607a940c536484b000e89eb3f00a3cd01c4c9b9a33ce4b71a309963ea84aa8c97781e7d8acc038f7f792b555717af6bb9dad07b06bc1177fa5601521fa9efef

Download Submit
C:\Users\Admin\AppData\Local\Temp\Yvohz7Nokj.bat

Filesize
234B

MD5
9e0d1023e7753192eadf75311149bbb8

SHA1
1f1885b392b354468de9045dccb5961a515e20ab

SHA256
ca5718335944c948d43833e4d8406221ef18eded049bafe9e65f52238e1537e2

SHA512
563605a35ca685b1e5749f23ecfece20cc5f7d02451292ecf3fe649be0e42bec7082589389f042254b14507350d5873d3dbf5fa7ffaa260ee868a474e292f628

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vi422lvo.ybg.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\arqkgCRh4V.bat

Filesize
234B

MD5
9ee18c72ad9204ce8ccaec7a819e4f45

SHA1
fb0ca5073305d89499e802f371e9b9f27e04626e

SHA256
7d13f30739ea6251fdfebc7cd4da01963a67c0d4023ca95ed5d6d4cc68135f88

SHA512
bf991673795898716f732ed3c6302982718d1286c07b563ae80831fdf0c45db01bd975c1d0252e98802b07ee983df7a1df637a48e789cc880b5e20847c5d8813

Download Submit
C:\Users\Admin\AppData\Local\Temp\bbMo3XBCxD.bat

Filesize
234B

MD5
5561d7a15c5103c3395a10c9fc8951fa

SHA1
f2d15455a04e6ece9cfdb6c5eecf4c9b7905c2ea

SHA256
e78d3a9560f0b8654dbb7547feac5a2e956ec033bc7197afc9a4bc19780991b2

SHA512
e7fb32e8aa377f345a9e44ea1cc028a5ece26ceadba728610af25bde83f1fc25a0b0ab67ec9f6e8cd3802f0e66a13e646e17ac6287e527fdb7e55c2c1e554679

Download Submit
C:\Users\Admin\AppData\Local\Temp\mWzz7cjAeP.bat

Filesize
234B

MD5
011942e1f1741cb2e80bac46578cc2c8

SHA1
c68c0549a16de16c1e111cb91c29fe098eaf3fb6

SHA256
19c263ddc432195f870711e5a9463722bde819d4d33b79f697a8e8a27d995631

SHA512
15aa13308f4f7463cad902b177c4a2f04dc197ce8068a1b73430e57b82818bef28f8a1181f85716009304a6e88cc47a0206350826f3106bf9b44b80d1d2fb23b

Download Submit
C:\Users\Admin\AppData\Local\Temp\uMS4yFj28m.bat

Filesize
234B

MD5
a81b990dfadc0a8184e4b7dd39ae642e

SHA1
ef46b4ea313f01b142542805015a3a74da9070a4

SHA256
136c8a3b03f5c9692dcd1996e2cd75751830007c691ca5e214ed187605b592e9

SHA512
df5328141d6413996e882843cb2303eea5f7db3f8f598d3909a8459eb73489640501ffdff51567f4a398fb33391879ac0804ce76718d2446e916c20113910c48

Download Submit
C:\Users\Admin\AppData\Local\Temp\yTz6y56Ktd.bat

Filesize
234B

MD5
3266531f41078999c03b7ad1ae62c0b2

SHA1
fc6e5b8db7fae80185283ff6ae31d12d1cb32357

SHA256
29e650d839b4511888d4645d3bc44b902471cb2cbda939c2a3d0be52012eeeb6

SHA512
2834d066731b8739962ba160faae4e8672d3c6141163a084fd64246063c0cfa0fb4122dfe5962badb7531561c330bcc084a9b9765d068c2686850e0afed35803

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/1272-228-0x000000001D7A0000-0x000000001D90A000-memory.dmp

Filesize
1.4MB

Download
memory/1324-138-0x000000001C910000-0x000000001C922000-memory.dmp

Filesize
72KB

Download
memory/1808-208-0x000000001D340000-0x000000001D4E9000-memory.dmp

Filesize
1.7MB

Download
memory/1808-203-0x000000001ADF0000-0x000000001AE02000-memory.dmp

Filesize
72KB

Download
memory/2132-244-0x000000001D540000-0x000000001D6AA000-memory.dmp

Filesize
1.4MB

Download
memory/2132-243-0x000000001D540000-0x000000001D6AA000-memory.dmp

Filesize
1.4MB

Download
memory/3020-17-0x0000000001280000-0x000000000128C000-memory.dmp

Filesize
48KB

Download
memory/3020-15-0x0000000001260000-0x000000000126C000-memory.dmp

Filesize
48KB

Download
memory/3020-16-0x0000000001250000-0x000000000125C000-memory.dmp

Filesize
48KB

Download
memory/3020-14-0x00000000011E0000-0x00000000011F2000-memory.dmp

Filesize
72KB

Download
memory/3020-12-0x00007FFB67663000-0x00007FFB67665000-memory.dmp

Filesize
8KB

Download
memory/3020-13-0x0000000000910000-0x0000000000A20000-memory.dmp

Filesize
1.1MB

Download
memory/3384-186-0x000000001D740000-0x000000001D8E9000-memory.dmp

Filesize
1.7MB

Download
memory/3476-231-0x000000001C3F0000-0x000000001C402000-memory.dmp

Filesize
72KB

Download
memory/3476-236-0x000000001D640000-0x000000001D7AA000-memory.dmp

Filesize
1.4MB

Download
memory/3476-200-0x000000001D340000-0x000000001D4E9000-memory.dmp

Filesize
1.7MB

Download
memory/4352-179-0x000000001CF00000-0x000000001D002000-memory.dmp

Filesize
1.0MB

Download
memory/4380-172-0x000000001D5A0000-0x000000001D70A000-memory.dmp

Filesize
1.4MB

Download
memory/4584-216-0x000000001D140000-0x000000001D2E9000-memory.dmp

Filesize
1.7MB

Download
memory/4764-193-0x000000001DB40000-0x000000001DCE9000-memory.dmp

Filesize
1.7MB

Download
memory/4980-52-0x000001D8C8F20000-0x000001D8C8F42000-memory.dmp

Filesize
136KB

Download