dcrat | e1b10607e29f1532e9b58f20f334462bb599badeb313765621539016c73c44fb

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2024 00:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_e1b10607e29f1532e9b58f20f334462bb599badeb313765621539016c73c44fb.exe
Size

1.3MB
MD5

578c44f2292e6a8853e95dd5fee5410d
SHA1

9d73b0fe1c56289c91df8e7afcfdd2e18ebbd736
SHA256

e1b10607e29f1532e9b58f20f334462bb599badeb313765621539016c73c44fb
SHA512

e457ea2eed1e914f9dfc9fe579be97ba288de03cc738107e4575f6530c48b0e4b28825df3a17699e816cbec1088b4c2e11ef59a34eb2b3733bac606b3093972d
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 30 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4616	4892	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4656	4892	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	320	4892	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2184	4892	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2568	4892	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4256	4892	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4324	4892	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3840	4892	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2380	4892	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4020	4892	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3192	4892	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1508	4892	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3848	4892	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3964	4892	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3348	4892	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	700	4892	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4200	4892	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2752	4892	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1396	4892	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3292	4892	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1804	4892	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3608	4892	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2460	4892	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4012	4892	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4352	4892	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3664	4892	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1112	4892	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2684	4892	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1756	4892	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	396	4892	schtasks.exe	89

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x0007000000023c87-11.dat	dcrat
behavioral2/memory/2500-13-0x0000000000C70000-0x0000000000D80000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3948	powershell.exe
4736	powershell.exe
3616	powershell.exe
2856	powershell.exe
5000	powershell.exe
2276	powershell.exe
924	powershell.exe
2832	powershell.exe
1432	powershell.exe
4044	powershell.exe
2308	powershell.exe

Checks computer location settings 2 TTPs 15 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	JaffaCakes118_e1b10607e29f1532e9b58f20f334462bb599badeb313765621539016c73c44fb.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	cmd.exe

Executes dropped EXE 14 IoCs

pid	Process
2500	DllCommonsvc.exe
3952	cmd.exe
4400	cmd.exe
4388	cmd.exe
1720	cmd.exe
1660	cmd.exe
3608	cmd.exe
1928	cmd.exe
2588	cmd.exe
3988	cmd.exe
3596	cmd.exe
3416	cmd.exe
384	cmd.exe
4920	cmd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 13 IoCs

Web Service

T1102

flow	ioc
18	raw.githubusercontent.com
40	raw.githubusercontent.com
43	raw.githubusercontent.com
48	raw.githubusercontent.com
53	raw.githubusercontent.com
56	raw.githubusercontent.com
17	raw.githubusercontent.com
39	raw.githubusercontent.com
45	raw.githubusercontent.com
54	raw.githubusercontent.com
55	raw.githubusercontent.com
57	raw.githubusercontent.com
25	raw.githubusercontent.com

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\ImmersiveControlPanel\images\9e8d7a4ca61bd9	DllCommonsvc.exe
File created	C:\Windows\INF\SMSvcHost 3.0.0.0\0407\cmd.exe	DllCommonsvc.exe
File created	C:\Windows\ja-JP\taskhostw.exe	DllCommonsvc.exe
File opened for modification	C:\Windows\ja-JP\taskhostw.exe	DllCommonsvc.exe
File created	C:\Windows\ja-JP\ea9f0e6c9e2dcd	DllCommonsvc.exe
File created	C:\Windows\SKB\LanguageModels\dllhost.exe	DllCommonsvc.exe
File created	C:\Windows\tracing\5940a34987c991	DllCommonsvc.exe
File created	C:\Windows\SKB\LanguageModels\5940a34987c991	DllCommonsvc.exe
File created	C:\Windows\tracing\dllhost.exe	DllCommonsvc.exe
File created	C:\Windows\ImmersiveControlPanel\images\RuntimeBroker.exe	DllCommonsvc.exe
File created	C:\Windows\INF\SMSvcHost 3.0.0.0\0407\ebf1f9fa8afd6d	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_e1b10607e29f1532e9b58f20f334462bb599badeb313765621539016c73c44fb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 13 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	JaffaCakes118_e1b10607e29f1532e9b58f20f334462bb599badeb313765621539016c73c44fb.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 30 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4012	schtasks.exe
4352	schtasks.exe
4656	schtasks.exe
700	schtasks.exe
3192	schtasks.exe
4200	schtasks.exe
2752	schtasks.exe
1804	schtasks.exe
3664	schtasks.exe
4616	schtasks.exe
3840	schtasks.exe
1112	schtasks.exe
3292	schtasks.exe
2568	schtasks.exe
3348	schtasks.exe
2380	schtasks.exe
3848	schtasks.exe
320	schtasks.exe
2184	schtasks.exe
1508	schtasks.exe
2684	schtasks.exe
4256	schtasks.exe
4020	schtasks.exe
3608	schtasks.exe
4324	schtasks.exe
1396	schtasks.exe
1756	schtasks.exe
396	schtasks.exe
3964	schtasks.exe
2460	schtasks.exe

Suspicious behavior: EnumeratesProcesses 60 IoCs

pid	Process
2500	DllCommonsvc.exe
2500	DllCommonsvc.exe
2500	DllCommonsvc.exe
2500	DllCommonsvc.exe
2500	DllCommonsvc.exe
2500	DllCommonsvc.exe
2500	DllCommonsvc.exe
2500	DllCommonsvc.exe
2500	DllCommonsvc.exe
2500	DllCommonsvc.exe
2500	DllCommonsvc.exe
2500	DllCommonsvc.exe
2500	DllCommonsvc.exe
2500	DllCommonsvc.exe
1432	powershell.exe
1432	powershell.exe
2856	powershell.exe
2856	powershell.exe
2308	powershell.exe
2308	powershell.exe
5000	powershell.exe
5000	powershell.exe
4736	powershell.exe
4736	powershell.exe
3616	powershell.exe
3616	powershell.exe
2832	powershell.exe
2832	powershell.exe
4044	powershell.exe
4044	powershell.exe
2276	powershell.exe
2276	powershell.exe
3948	powershell.exe
3948	powershell.exe
924	powershell.exe
924	powershell.exe
2832	powershell.exe
3952	cmd.exe
3952	cmd.exe
1432	powershell.exe
5000	powershell.exe
2856	powershell.exe
4044	powershell.exe
4736	powershell.exe
2308	powershell.exe
3948	powershell.exe
3616	powershell.exe
924	powershell.exe
2276	powershell.exe
4400	cmd.exe
4388	cmd.exe
1720	cmd.exe
1660	cmd.exe
3608	cmd.exe
1928	cmd.exe
2588	cmd.exe
3988	cmd.exe
3596	cmd.exe
3416	cmd.exe
4920	cmd.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeDebugPrivilege	2500	DllCommonsvc.exe
Token: SeDebugPrivilege	1432	powershell.exe
Token: SeDebugPrivilege	2856	powershell.exe
Token: SeDebugPrivilege	2308	powershell.exe
Token: SeDebugPrivilege	5000	powershell.exe
Token: SeDebugPrivilege	2832	powershell.exe
Token: SeDebugPrivilege	4736	powershell.exe
Token: SeDebugPrivilege	3616	powershell.exe
Token: SeDebugPrivilege	4044	powershell.exe
Token: SeDebugPrivilege	2276	powershell.exe
Token: SeDebugPrivilege	3948	powershell.exe
Token: SeDebugPrivilege	924	powershell.exe
Token: SeDebugPrivilege	3952	cmd.exe
Token: SeDebugPrivilege	4400	cmd.exe
Token: SeDebugPrivilege	4388	cmd.exe
Token: SeDebugPrivilege	1720	cmd.exe
Token: SeDebugPrivilege	1660	cmd.exe
Token: SeDebugPrivilege	3608	cmd.exe
Token: SeDebugPrivilege	1928	cmd.exe
Token: SeDebugPrivilege	2588	cmd.exe
Token: SeDebugPrivilege	3988	cmd.exe
Token: SeDebugPrivilege	3596	cmd.exe
Token: SeDebugPrivilege	3416	cmd.exe
Token: SeDebugPrivilege	4920	cmd.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5108 wrote to memory of 2016	5108	JaffaCakes118_e1b10607e29f1532e9b58f20f334462bb599badeb313765621539016c73c44fb.exe	84
PID 5108 wrote to memory of 2016	5108	JaffaCakes118_e1b10607e29f1532e9b58f20f334462bb599badeb313765621539016c73c44fb.exe	84
PID 5108 wrote to memory of 2016	5108	JaffaCakes118_e1b10607e29f1532e9b58f20f334462bb599badeb313765621539016c73c44fb.exe	84
PID 2016 wrote to memory of 744	2016	WScript.exe	86
PID 2016 wrote to memory of 744	2016	WScript.exe	86
PID 2016 wrote to memory of 744	2016	WScript.exe	86
PID 744 wrote to memory of 2500	744	cmd.exe	88
PID 744 wrote to memory of 2500	744	cmd.exe	88
PID 2500 wrote to memory of 924	2500	DllCommonsvc.exe	121
PID 2500 wrote to memory of 924	2500	DllCommonsvc.exe	121
PID 2500 wrote to memory of 2832	2500	DllCommonsvc.exe	122
PID 2500 wrote to memory of 2832	2500	DllCommonsvc.exe	122
PID 2500 wrote to memory of 2276	2500	DllCommonsvc.exe	123
PID 2500 wrote to memory of 2276	2500	DllCommonsvc.exe	123
PID 2500 wrote to memory of 5000	2500	DllCommonsvc.exe	124
PID 2500 wrote to memory of 5000	2500	DllCommonsvc.exe	124
PID 2500 wrote to memory of 2308	2500	DllCommonsvc.exe	125
PID 2500 wrote to memory of 2308	2500	DllCommonsvc.exe	125
PID 2500 wrote to memory of 2856	2500	DllCommonsvc.exe	126
PID 2500 wrote to memory of 2856	2500	DllCommonsvc.exe	126
PID 2500 wrote to memory of 4044	2500	DllCommonsvc.exe	127
PID 2500 wrote to memory of 4044	2500	DllCommonsvc.exe	127
PID 2500 wrote to memory of 3616	2500	DllCommonsvc.exe	128
PID 2500 wrote to memory of 3616	2500	DllCommonsvc.exe	128
PID 2500 wrote to memory of 4736	2500	DllCommonsvc.exe	129
PID 2500 wrote to memory of 4736	2500	DllCommonsvc.exe	129
PID 2500 wrote to memory of 3948	2500	DllCommonsvc.exe	130
PID 2500 wrote to memory of 3948	2500	DllCommonsvc.exe	130
PID 2500 wrote to memory of 1432	2500	DllCommonsvc.exe	131
PID 2500 wrote to memory of 1432	2500	DllCommonsvc.exe	131
PID 2500 wrote to memory of 3952	2500	DllCommonsvc.exe	142
PID 2500 wrote to memory of 3952	2500	DllCommonsvc.exe	142
PID 3952 wrote to memory of 4180	3952	cmd.exe	152
PID 3952 wrote to memory of 4180	3952	cmd.exe	152
PID 4180 wrote to memory of 2532	4180	cmd.exe	154
PID 4180 wrote to memory of 2532	4180	cmd.exe	154
PID 4180 wrote to memory of 4400	4180	cmd.exe	160
PID 4180 wrote to memory of 4400	4180	cmd.exe	160
PID 4400 wrote to memory of 2300	4400	cmd.exe	162
PID 4400 wrote to memory of 2300	4400	cmd.exe	162
PID 2300 wrote to memory of 3100	2300	cmd.exe	165
PID 2300 wrote to memory of 3100	2300	cmd.exe	165
PID 2300 wrote to memory of 4388	2300	cmd.exe	169
PID 2300 wrote to memory of 4388	2300	cmd.exe	169
PID 4388 wrote to memory of 2548	4388	cmd.exe	171
PID 4388 wrote to memory of 2548	4388	cmd.exe	171
PID 2548 wrote to memory of 2640	2548	cmd.exe	173
PID 2548 wrote to memory of 2640	2548	cmd.exe	173
PID 2548 wrote to memory of 1720	2548	cmd.exe	175
PID 2548 wrote to memory of 1720	2548	cmd.exe	175
PID 1720 wrote to memory of 1508	1720	cmd.exe	177
PID 1720 wrote to memory of 1508	1720	cmd.exe	177
PID 1508 wrote to memory of 3680	1508	cmd.exe	179
PID 1508 wrote to memory of 3680	1508	cmd.exe	179
PID 1508 wrote to memory of 1660	1508	cmd.exe	181
PID 1508 wrote to memory of 1660	1508	cmd.exe	181
PID 1660 wrote to memory of 4068	1660	cmd.exe	184
PID 1660 wrote to memory of 4068	1660	cmd.exe	184
PID 4068 wrote to memory of 2204	4068	cmd.exe	186
PID 4068 wrote to memory of 2204	4068	cmd.exe	186
PID 4068 wrote to memory of 3608	4068	cmd.exe	188
PID 4068 wrote to memory of 3608	4068	cmd.exe	188
PID 3608 wrote to memory of 4628	3608	cmd.exe	190
PID 3608 wrote to memory of 4628	3608	cmd.exe	190

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e1b10607e29f1532e9b58f20f334462bb599badeb313765621539016c73c44fb.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e1b10607e29f1532e9b58f20f334462bb599badeb313765621539016c73c44fb.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5108
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2016
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:744
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2500
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:924
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\ja-JP\taskhostw.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2832
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\sihost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2276
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\fontdrvhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5000
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\SKB\LanguageModels\dllhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2308
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\tracing\dllhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2856
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\RuntimeBroker.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4044
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\OfficeClickToRun.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3616
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\ImmersiveControlPanel\images\RuntimeBroker.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4736
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\fontdrvhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3948
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\INF\SMSvcHost 3.0.0.0\0407\cmd.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1432
    - - C:\Windows\INF\SMSvcHost 3.0.0.0\0407\cmd.exe
        
        "C:\Windows\INF\SMSvcHost 3.0.0.0\0407\cmd.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3952
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\s2EHkno7yQ.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4180
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:2532
        
        C:\Windows\INF\SMSvcHost 3.0.0.0\0407\cmd.exe
        
        "C:\Windows\INF\SMSvcHost 3.0.0.0\0407\cmd.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4400
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\6uGRILFBWR.bat"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:2300
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:3100
        
        C:\Windows\INF\SMSvcHost 3.0.0.0\0407\cmd.exe
        
        "C:\Windows\INF\SMSvcHost 3.0.0.0\0407\cmd.exe"
        9⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4388
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\53OVnhiNRT.bat"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:2548
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:2640
        
        C:\Windows\INF\SMSvcHost 3.0.0.0\0407\cmd.exe
        
        "C:\Windows\INF\SMSvcHost 3.0.0.0\0407\cmd.exe"
        11⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1720
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\cOf3pucYXi.bat"
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:1508
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:3680
        
        C:\Windows\INF\SMSvcHost 3.0.0.0\0407\cmd.exe
        
        "C:\Windows\INF\SMSvcHost 3.0.0.0\0407\cmd.exe"
        13⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1660
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\GptcLQn9Ec.bat"
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:4068
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        15⤵
        
        PID:2204
        
        C:\Windows\INF\SMSvcHost 3.0.0.0\0407\cmd.exe
        
        "C:\Windows\INF\SMSvcHost 3.0.0.0\0407\cmd.exe"
        15⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3608
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\z9xTb8lNHs.bat"
        16⤵
        
        PID:4628
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        17⤵
        
        PID:1532
        
        C:\Windows\INF\SMSvcHost 3.0.0.0\0407\cmd.exe
        
        "C:\Windows\INF\SMSvcHost 3.0.0.0\0407\cmd.exe"
        17⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1928
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\GptcLQn9Ec.bat"
        18⤵
        
        PID:924
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        19⤵
        
        PID:4688
        
        C:\Windows\INF\SMSvcHost 3.0.0.0\0407\cmd.exe
        
        "C:\Windows\INF\SMSvcHost 3.0.0.0\0407\cmd.exe"
        19⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2588
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\4stVUxPy0P.bat"
        20⤵
        
        PID:1336
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        21⤵
        
        PID:4372
        
        C:\Windows\INF\SMSvcHost 3.0.0.0\0407\cmd.exe
        
        "C:\Windows\INF\SMSvcHost 3.0.0.0\0407\cmd.exe"
        21⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3988
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\aTd08pZfDw.bat"
        22⤵
        
        PID:1268
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        23⤵
        
        PID:2728
        
        C:\Windows\INF\SMSvcHost 3.0.0.0\0407\cmd.exe
        
        "C:\Windows\INF\SMSvcHost 3.0.0.0\0407\cmd.exe"
        23⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3596
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\OoUlhQHDc2.bat"
        24⤵
        
        PID:760
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        25⤵
        
        PID:1832
        
        C:\Windows\INF\SMSvcHost 3.0.0.0\0407\cmd.exe
        
        "C:\Windows\INF\SMSvcHost 3.0.0.0\0407\cmd.exe"
        25⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3416
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\4stVUxPy0P.bat"
        26⤵
        
        PID:4952
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        27⤵
        
        PID:3864
        
        C:\Windows\INF\SMSvcHost 3.0.0.0\0407\cmd.exe
        
        "C:\Windows\INF\SMSvcHost 3.0.0.0\0407\cmd.exe"
        27⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        
        PID:384
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\rHhDMS4c5i.bat"
        28⤵
        
        PID:3344
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        29⤵
        
        PID:3268
        
        C:\Windows\INF\SMSvcHost 3.0.0.0\0407\cmd.exe
        
        "C:\Windows\INF\SMSvcHost 3.0.0.0\0407\cmd.exe"
        29⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 14 /tr "'C:\Windows\ja-JP\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Windows\ja-JP\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 10 /tr "'C:\Windows\ja-JP\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 10 /tr "'C:\providercommon\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\providercommon\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 14 /tr "'C:\providercommon\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4256

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Windows\SKB\LanguageModels\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\SKB\LanguageModels\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3192

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Windows\SKB\LanguageModels\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Windows\tracing\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\tracing\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Windows\tracing\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Windows\ImmersiveControlPanel\images\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\ImmersiveControlPanel\images\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Windows\ImmersiveControlPanel\images\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 14 /tr "'C:\Windows\INF\SMSvcHost 3.0.0.0\0407\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Windows\INF\SMSvcHost 3.0.0.0\0407\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 12 /tr "'C:\Windows\INF\SMSvcHost 3.0.0.0\0407\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\cmd.exe.log

Filesize
1KB

MD5
baf55b95da4a601229647f25dad12878

SHA1
abc16954ebfd213733c4493fc1910164d825cac8

SHA256
ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

SHA512
24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6d42b6da621e8df5674e26b799c8e2aa

SHA1
ab3ce1327ea1eeedb987ec823d5e0cb146bafa48

SHA256
5ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c

SHA512
53faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6d3e9c29fe44e90aae6ed30ccf799ca8

SHA1
c7974ef72264bbdf13a2793ccf1aed11bc565dce

SHA256
2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

SHA512
60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
62623d22bd9e037191765d5083ce16a3

SHA1
4a07da6872672f715a4780513d95ed8ddeefd259

SHA256
95d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010

SHA512
9a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
cadef9abd087803c630df65264a6c81c

SHA1
babbf3636c347c8727c35f3eef2ee643dbcc4bd2

SHA256
cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

SHA512
7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
2e907f77659a6601fcc408274894da2e

SHA1
9f5b72abef1cd7145bf37547cdb1b9254b4efe9d

SHA256
385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233

SHA512
34fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
120B

MD5
8b6fadaecc382ff82da19a6e9d383a08

SHA1
fb54b49b29217e622de68fbe7fe82bddc85f5627

SHA256
81f7faf702d3553b4f9e951f48c1e50603627d2c02c030eaca239aa4d893e868

SHA512
a4762d0f45714cf471136d46ef30256c9b21f20b94b2421181ad0a51bcd711d8a71204b4c621c8cce264d8c2eef1461498ef7229d6304cf29aaf3ad401346efb

Download Submit
C:\Users\Admin\AppData\Local\Temp\4stVUxPy0P.bat

Filesize
210B

MD5
ee97a90303ca8e43ed2c6d9013f2cb28

SHA1
a39142fe212815c2f8a9ee402e625441d7672816

SHA256
ae2abd8922b08ca38f64e78757f86d0e302bfd3d79b2a5388b4ef8aac947a022

SHA512
c9b0ba924839cfbf95d7075c3ac38003ba8f54f3aa99c445ba2c2fbd8b6ea4544ecc4891ea3c48a2501a5bb722023bd3b2f78ccfcc7ced9495216b888f125baf

Download Submit
C:\Users\Admin\AppData\Local\Temp\53OVnhiNRT.bat

Filesize
210B

MD5
4f5629b1b17ec476c9d9535851c60008

SHA1
cc4c66ecda094b49459832798c1355859f34fced

SHA256
e1fe773bd5c11c89260f4ac817102d4042de10ee434490e8683c35a319bdd6c9

SHA512
baa58c3330d43820ae1c5359cd0dad775f2cd556b1de0e3152596e5c85c22998bf44ec822a38ad0d9efc8f3e998ac4b99de1e257ce78c39035d3e03ce70dab51

Download Submit
C:\Users\Admin\AppData\Local\Temp\6uGRILFBWR.bat

Filesize
210B

MD5
866f76f9f6c6158bddd6e3f5373b40c4

SHA1
4e6d16c3b250b20e101b2d16aaa0513d7b5763b9

SHA256
cf957a73b826f489b1b3d7edc431a7ffd3f5a1bb2f7611eabee826b64fb91ca8

SHA512
a47f7202519f95c6491b2c796efcc06ee3fa028dd3bbca3db6674be40408f0413dbc214038774179efb3d736db41dcd306992bcca49b3ff51f8ba02f6b3c9462

Download Submit
C:\Users\Admin\AppData\Local\Temp\GptcLQn9Ec.bat

Filesize
210B

MD5
977eae6877149706f216076ef3f5b5b2

SHA1
cf11f42d514040e148236138516698817d0c5d1c

SHA256
2ca4dde8c9c443c8cc7aa6ad89227af272a14416d3324db6a267df7c7c3596bf

SHA512
0d318936f246eaee108e0be986ac2102637f641b2d2e2cbc9df2099801cbf1a8273faab3e26b4f689a6df5265b74f7f9cdf31538efcc34da3e572ca4ba216614

Download Submit
C:\Users\Admin\AppData\Local\Temp\OoUlhQHDc2.bat

Filesize
210B

MD5
6f5247bbfda693a2433c8b52655a2551

SHA1
c515642ea9097a863e39dabfad1b2fdc8698a320

SHA256
793c0ced2126e8e0407c4750698ff6f444d97152daeeb1548eeaedb496ddad77

SHA512
bfdf381f47be5d1d865d5e0a1553374ed720d6619fc82e0d9de4a015f1d0874b88782e74f6354b968f09f3204acb9bc230978979962e1dedde5d995999e735fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_w0ad2lac.5tc.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\aTd08pZfDw.bat

Filesize
210B

MD5
17ec6bf7f9733091e5159da79ff62c0c

SHA1
dbcfba937491c1a0ccec697b54adf82bb062aac8

SHA256
f853db29f492f24284f3a243478779b6cf0ebe6757e37c6b16b433d038b1da1e

SHA512
8a9a8d773de9f988d133d7eacc43e248c451ae2691c52ff7925a92ef8329978d66303f92b4fee58726444b1a1715c7ca95124b5d76cecabf26b3ba51375b2cfe

Download Submit
C:\Users\Admin\AppData\Local\Temp\cOf3pucYXi.bat

Filesize
210B

MD5
f0ab066758724cf3695f071758f9dd6b

SHA1
8b5490822a5388d23e3c5a8eb1930afbb9ccc3fc

SHA256
b2d7f0c3a82aebc029df7dd47ba1009d9450062eee776ba0001f1004f8ef7a5b

SHA512
bb44e0fee57351b593e84a66c91b4808e88d09ea1c659ba52e09d83dddc8fda8abf4a3d9fc21e585566dddc1054f7638a27acfb9d519917dc740ea13b1bc54ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\s2EHkno7yQ.bat

Filesize
210B

MD5
82de7efc156d5d05bae424381df932d8

SHA1
b6d399f46b67cdbb17fd3c921ada74c3e24c348c

SHA256
417937c3a2f1a226e3581f478116d66ecf9d7fe4f164a91c9af0d55bf8221d60

SHA512
c77aa8fb191ea0f72db2765ea409e5d58a941727fe3e578dfc64936a6860c0108278f4cae16c576376a82bbbd4af065981fb294199ca3379855e73081b417fd3

Download Submit
C:\Users\Admin\AppData\Local\Temp\z9xTb8lNHs.bat

Filesize
210B

MD5
1ab471c257f35135d2d588185c2c2a79

SHA1
dfaddad7072d8447bbc3609ab4c1dff4df861c28

SHA256
db73ac7e97b65696c06cc6b37c35ab6ba1792cc7a8f87551ac00cac6608d6f3c

SHA512
182e30b83bdbff5bf523b864b32ad071dee2df83a7bfea749b5bd80509743fdf29fec58c79119ca3a5a4641832f5727b608c66d2731589f0e23608803f55ab5a

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/1432-58-0x00000235E5280000-0x00000235E52A2000-memory.dmp

Filesize
136KB

Download
memory/1660-201-0x0000000002450000-0x0000000002462000-memory.dmp

Filesize
72KB

Download
memory/2500-17-0x0000000002EB0000-0x0000000002EBC000-memory.dmp

Filesize
48KB

Download
memory/2500-16-0x0000000002E90000-0x0000000002E9C000-memory.dmp

Filesize
48KB

Download
memory/2500-15-0x0000000002EA0000-0x0000000002EAC000-memory.dmp

Filesize
48KB

Download
memory/2500-14-0x0000000001640000-0x0000000001652000-memory.dmp

Filesize
72KB

Download
memory/2500-13-0x0000000000C70000-0x0000000000D80000-memory.dmp

Filesize
1.1MB

Download
memory/2500-12-0x00007FF909403000-0x00007FF909405000-memory.dmp

Filesize
8KB

Download
memory/2588-220-0x0000000000E60000-0x0000000000E72000-memory.dmp

Filesize
72KB

Download
memory/3952-149-0x00000000027C0000-0x00000000027D2000-memory.dmp

Filesize
72KB

Download
memory/3988-227-0x0000000002AE0000-0x0000000002AF2000-memory.dmp

Filesize
72KB

Download
memory/4388-188-0x0000000002880000-0x0000000002892000-memory.dmp

Filesize
72KB

Download
memory/4400-181-0x0000000002630000-0x0000000002642000-memory.dmp

Filesize
72KB

Download