dcrat | 9884a8279a5dfe48b4d1873d822e1dc76253bba3367880c281d7bdd5ef90c57d

Analysis

max time kernel
145s
max time network
146s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22-12-2024 01:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_9884a8279a5dfe48b4d1873d822e1dc76253bba3367880c281d7bdd5ef90c57d.exe
Size

1.3MB
MD5

fcf359ddec24818a6ab3da2348a4052a
SHA1

0609ca44b82f470aceff93ef6d08ef84d919f245
SHA256

9884a8279a5dfe48b4d1873d822e1dc76253bba3367880c281d7bdd5ef90c57d
SHA512

760d4dbcf359b551c7a4adb70c4a395d6fa38c6b5afcda0c23fb853181dcbb364118347d4c7097d8ed02458565443e2e318dea756cb8e8640ff977c7d50c6c58
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 51 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2580	2800	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2692	2800	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2320	2800	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2612	2800	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2796	2800	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	684	2800	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2604	2800	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2652	2800	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2128	2800	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1528	2800	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1508	2800	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2940	2800	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2560	2800	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2888	2800	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2892	2800	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1312	2800	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	496	2800	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2056	2800	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2036	2800	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1388	2800	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2192	2800	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2980	2800	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2132	2800	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2528	2800	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2236	2800	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2184	2800	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1196	2800	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	884	2800	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1076	2800	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2480	2800	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3064	2800	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	600	2800	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1320	2800	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	548	2800	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	992	2800	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1956	2800	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1588	2800	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1428	2800	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	568	2800	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1564	2800	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1668	2800	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2992	2800	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2428	2800	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1352	2800	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1484	2800	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1656	2800	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	964	2800	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2496	2800	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3056	2800	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	300	2800	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	760	2800	schtasks.exe	35

DCRat payload 8 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0008000000016858-9.dat	dcrat
behavioral1/memory/2148-13-0x0000000000E20000-0x0000000000F30000-memory.dmp	dcrat
behavioral1/memory/1660-148-0x0000000000C90000-0x0000000000DA0000-memory.dmp	dcrat
behavioral1/memory/2336-207-0x0000000001390000-0x00000000014A0000-memory.dmp	dcrat
behavioral1/memory/352-385-0x00000000000D0000-0x00000000001E0000-memory.dmp	dcrat
behavioral1/memory/2956-445-0x0000000000970000-0x0000000000A80000-memory.dmp	dcrat
behavioral1/memory/1792-505-0x00000000011A0000-0x00000000012B0000-memory.dmp	dcrat
behavioral1/memory/892-624-0x0000000000350000-0x0000000000460000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 18 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2456	powershell.exe
1796	powershell.exe
2724	powershell.exe
2784	powershell.exe
316	powershell.exe
688	powershell.exe
2316	powershell.exe
1860	powershell.exe
2640	powershell.exe
2688	powershell.exe
2844	powershell.exe
2684	powershell.exe
1660	powershell.exe
2076	powershell.exe
348	powershell.exe
2180	powershell.exe
2160	powershell.exe
2008	powershell.exe

Executes dropped EXE 10 IoCs

pid	Process
2148	DllCommonsvc.exe
1660	DllCommonsvc.exe
2336	DllCommonsvc.exe
1856	DllCommonsvc.exe
840	DllCommonsvc.exe
352	DllCommonsvc.exe
2956	DllCommonsvc.exe
1792	DllCommonsvc.exe
1636	DllCommonsvc.exe
892	DllCommonsvc.exe

Loads dropped DLL 2 IoCs

pid	Process
484	cmd.exe
484	cmd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 10 IoCs

Web Service

T1102

flow	ioc
12	raw.githubusercontent.com
22	raw.githubusercontent.com
25	raw.githubusercontent.com
28	raw.githubusercontent.com
32	raw.githubusercontent.com
4	raw.githubusercontent.com
5	raw.githubusercontent.com
9	raw.githubusercontent.com
15	raw.githubusercontent.com
19	raw.githubusercontent.com

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File created	C:\Program Files\Uninstall Information\explorer.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Journal\en-US\c5b4cb5e9653cc	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\69ddcba757bf72	DllCommonsvc.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\smss.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft.NET\RedistList\886983d96e3d3e	DllCommonsvc.exe
File created	C:\Program Files (x86)\Google\Temp\WmiPrvSE.exe	DllCommonsvc.exe
File created	C:\Program Files\Uninstall Information\7a0fd90576e088	DllCommonsvc.exe
File created	C:\Program Files\Windows Journal\en-US\services.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\smss.exe	DllCommonsvc.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\69ddcba757bf72	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft.NET\RedistList\csrss.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Google\Temp\24dbde2999530e	DllCommonsvc.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\CSC\v2.0.6\dllhost.exe	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_9884a8279a5dfe48b4d1873d822e1dc76253bba3367880c281d7bdd5ef90c57d.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 51 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1428	schtasks.exe
568	schtasks.exe
2652	schtasks.exe
1508	schtasks.exe
496	schtasks.exe
2236	schtasks.exe
2184	schtasks.exe
548	schtasks.exe
2992	schtasks.exe
2428	schtasks.exe
964	schtasks.exe
1656	schtasks.exe
2580	schtasks.exe
2888	schtasks.exe
1312	schtasks.exe
1076	schtasks.exe
2480	schtasks.exe
1668	schtasks.exe
300	schtasks.exe
760	schtasks.exe
2320	schtasks.exe
2940	schtasks.exe
2036	schtasks.exe
2528	schtasks.exe
3064	schtasks.exe
2496	schtasks.exe
3056	schtasks.exe
684	schtasks.exe
2128	schtasks.exe
2560	schtasks.exe
600	schtasks.exe
992	schtasks.exe
1588	schtasks.exe
2692	schtasks.exe
2796	schtasks.exe
2892	schtasks.exe
2980	schtasks.exe
1196	schtasks.exe
1956	schtasks.exe
2056	schtasks.exe
2192	schtasks.exe
2132	schtasks.exe
1352	schtasks.exe
1484	schtasks.exe
1564	schtasks.exe
2612	schtasks.exe
2604	schtasks.exe
1528	schtasks.exe
1388	schtasks.exe
884	schtasks.exe
1320	schtasks.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
2148	DllCommonsvc.exe
2148	DllCommonsvc.exe
2148	DllCommonsvc.exe
2148	DllCommonsvc.exe
2148	DllCommonsvc.exe
2724	powershell.exe
2684	powershell.exe
2160	powershell.exe
2008	powershell.exe
2076	powershell.exe
688	powershell.exe
316	powershell.exe
2640	powershell.exe
1660	powershell.exe
2456	powershell.exe
1860	powershell.exe
2784	powershell.exe
2688	powershell.exe
348	powershell.exe
2316	powershell.exe
2844	powershell.exe
1796	powershell.exe
2180	powershell.exe
1660	DllCommonsvc.exe
2336	DllCommonsvc.exe
1856	DllCommonsvc.exe
840	DllCommonsvc.exe
352	DllCommonsvc.exe
2956	DllCommonsvc.exe
1792	DllCommonsvc.exe
1636	DllCommonsvc.exe
892	DllCommonsvc.exe

Suspicious use of AdjustPrivilegeToken 28 IoCs

description	pid	Process
Token: SeDebugPrivilege	2148	DllCommonsvc.exe
Token: SeDebugPrivilege	2724	powershell.exe
Token: SeDebugPrivilege	2684	powershell.exe
Token: SeDebugPrivilege	2160	powershell.exe
Token: SeDebugPrivilege	2008	powershell.exe
Token: SeDebugPrivilege	2076	powershell.exe
Token: SeDebugPrivilege	688	powershell.exe
Token: SeDebugPrivilege	316	powershell.exe
Token: SeDebugPrivilege	2640	powershell.exe
Token: SeDebugPrivilege	1660	powershell.exe
Token: SeDebugPrivilege	2456	powershell.exe
Token: SeDebugPrivilege	1860	powershell.exe
Token: SeDebugPrivilege	2784	powershell.exe
Token: SeDebugPrivilege	2688	powershell.exe
Token: SeDebugPrivilege	348	powershell.exe
Token: SeDebugPrivilege	2316	powershell.exe
Token: SeDebugPrivilege	2844	powershell.exe
Token: SeDebugPrivilege	1796	powershell.exe
Token: SeDebugPrivilege	2180	powershell.exe
Token: SeDebugPrivilege	1660	DllCommonsvc.exe
Token: SeDebugPrivilege	2336	DllCommonsvc.exe
Token: SeDebugPrivilege	1856	DllCommonsvc.exe
Token: SeDebugPrivilege	840	DllCommonsvc.exe
Token: SeDebugPrivilege	352	DllCommonsvc.exe
Token: SeDebugPrivilege	2956	DllCommonsvc.exe
Token: SeDebugPrivilege	1792	DllCommonsvc.exe
Token: SeDebugPrivilege	1636	DllCommonsvc.exe
Token: SeDebugPrivilege	892	DllCommonsvc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 2284	2348	JaffaCakes118_9884a8279a5dfe48b4d1873d822e1dc76253bba3367880c281d7bdd5ef90c57d.exe	30
PID 2348 wrote to memory of 2284	2348	JaffaCakes118_9884a8279a5dfe48b4d1873d822e1dc76253bba3367880c281d7bdd5ef90c57d.exe	30
PID 2348 wrote to memory of 2284	2348	JaffaCakes118_9884a8279a5dfe48b4d1873d822e1dc76253bba3367880c281d7bdd5ef90c57d.exe	30
PID 2348 wrote to memory of 2284	2348	JaffaCakes118_9884a8279a5dfe48b4d1873d822e1dc76253bba3367880c281d7bdd5ef90c57d.exe	30
PID 2284 wrote to memory of 484	2284	WScript.exe	32
PID 2284 wrote to memory of 484	2284	WScript.exe	32
PID 2284 wrote to memory of 484	2284	WScript.exe	32
PID 2284 wrote to memory of 484	2284	WScript.exe	32
PID 484 wrote to memory of 2148	484	cmd.exe	34
PID 484 wrote to memory of 2148	484	cmd.exe	34
PID 484 wrote to memory of 2148	484	cmd.exe	34
PID 484 wrote to memory of 2148	484	cmd.exe	34
PID 2148 wrote to memory of 2076	2148	DllCommonsvc.exe	87
PID 2148 wrote to memory of 2076	2148	DllCommonsvc.exe	87
PID 2148 wrote to memory of 2076	2148	DllCommonsvc.exe	87
PID 2148 wrote to memory of 688	2148	DllCommonsvc.exe	88
PID 2148 wrote to memory of 688	2148	DllCommonsvc.exe	88
PID 2148 wrote to memory of 688	2148	DllCommonsvc.exe	88
PID 2148 wrote to memory of 2456	2148	DllCommonsvc.exe	89
PID 2148 wrote to memory of 2456	2148	DllCommonsvc.exe	89
PID 2148 wrote to memory of 2456	2148	DllCommonsvc.exe	89
PID 2148 wrote to memory of 348	2148	DllCommonsvc.exe	90
PID 2148 wrote to memory of 348	2148	DllCommonsvc.exe	90
PID 2148 wrote to memory of 348	2148	DllCommonsvc.exe	90
PID 2148 wrote to memory of 2008	2148	DllCommonsvc.exe	91
PID 2148 wrote to memory of 2008	2148	DllCommonsvc.exe	91
PID 2148 wrote to memory of 2008	2148	DllCommonsvc.exe	91
PID 2148 wrote to memory of 2160	2148	DllCommonsvc.exe	92
PID 2148 wrote to memory of 2160	2148	DllCommonsvc.exe	92
PID 2148 wrote to memory of 2160	2148	DllCommonsvc.exe	92
PID 2148 wrote to memory of 316	2148	DllCommonsvc.exe	93
PID 2148 wrote to memory of 316	2148	DllCommonsvc.exe	93
PID 2148 wrote to memory of 316	2148	DllCommonsvc.exe	93
PID 2148 wrote to memory of 1660	2148	DllCommonsvc.exe	94
PID 2148 wrote to memory of 1660	2148	DllCommonsvc.exe	94
PID 2148 wrote to memory of 1660	2148	DllCommonsvc.exe	94
PID 2148 wrote to memory of 2684	2148	DllCommonsvc.exe	95
PID 2148 wrote to memory of 2684	2148	DllCommonsvc.exe	95
PID 2148 wrote to memory of 2684	2148	DllCommonsvc.exe	95
PID 2148 wrote to memory of 2724	2148	DllCommonsvc.exe	96
PID 2148 wrote to memory of 2724	2148	DllCommonsvc.exe	96
PID 2148 wrote to memory of 2724	2148	DllCommonsvc.exe	96
PID 2148 wrote to memory of 2784	2148	DllCommonsvc.exe	99
PID 2148 wrote to memory of 2784	2148	DllCommonsvc.exe	99
PID 2148 wrote to memory of 2784	2148	DllCommonsvc.exe	99
PID 2148 wrote to memory of 2844	2148	DllCommonsvc.exe	101
PID 2148 wrote to memory of 2844	2148	DllCommonsvc.exe	101
PID 2148 wrote to memory of 2844	2148	DllCommonsvc.exe	101
PID 2148 wrote to memory of 2688	2148	DllCommonsvc.exe	104
PID 2148 wrote to memory of 2688	2148	DllCommonsvc.exe	104
PID 2148 wrote to memory of 2688	2148	DllCommonsvc.exe	104
PID 2148 wrote to memory of 1796	2148	DllCommonsvc.exe	105
PID 2148 wrote to memory of 1796	2148	DllCommonsvc.exe	105
PID 2148 wrote to memory of 1796	2148	DllCommonsvc.exe	105
PID 2148 wrote to memory of 2640	2148	DllCommonsvc.exe	107
PID 2148 wrote to memory of 2640	2148	DllCommonsvc.exe	107
PID 2148 wrote to memory of 2640	2148	DllCommonsvc.exe	107
PID 2148 wrote to memory of 1860	2148	DllCommonsvc.exe	108
PID 2148 wrote to memory of 1860	2148	DllCommonsvc.exe	108
PID 2148 wrote to memory of 1860	2148	DllCommonsvc.exe	108
PID 2148 wrote to memory of 2180	2148	DllCommonsvc.exe	109
PID 2148 wrote to memory of 2180	2148	DllCommonsvc.exe	109
PID 2148 wrote to memory of 2180	2148	DllCommonsvc.exe	109
PID 2148 wrote to memory of 2316	2148	DllCommonsvc.exe	110

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9884a8279a5dfe48b4d1873d822e1dc76253bba3367880c281d7bdd5ef90c57d.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9884a8279a5dfe48b4d1873d822e1dc76253bba3367880c281d7bdd5ef90c57d.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2284
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:484
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2148
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2076
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\OSPPSVC.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:688
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Uninstall Information\explorer.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2456
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Journal\en-US\services.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:348
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\WMIADAP.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2008
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2160
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\smss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:316
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\smss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1660
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Microsoft Help\audiodg.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2684
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\WMIADAP.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2724
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft.NET\RedistList\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2784
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\System.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2844
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\winlogon.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2688
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Google\Temp\WmiPrvSE.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1796
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\Idle.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2640
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\Idle.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1860
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Local Settings\dllhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2180
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2316
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\6bQ8GSjYW4.bat"
        5⤵
        
        PID:2624
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:2388
      - C:\Users\Default User\DllCommonsvc.exe
        
        "C:\Users\Default User\DllCommonsvc.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1660
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\EYKlAcFNfO.bat"
        7⤵
        
        PID:992
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:2680
        
        C:\Users\Default User\DllCommonsvc.exe
        
        "C:\Users\Default User\DllCommonsvc.exe"
        8⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2336
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\3Lxx1rvPQX.bat"
        9⤵
        
        PID:2448
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:2296
        
        C:\Users\Default User\DllCommonsvc.exe
        
        "C:\Users\Default User\DllCommonsvc.exe"
        10⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1856
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\i0MStmnXAe.bat"
        11⤵
        
        PID:2112
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:2236
        
        C:\Users\Default User\DllCommonsvc.exe
        
        "C:\Users\Default User\DllCommonsvc.exe"
        12⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:840
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\mNrvcGFykN.bat"
        13⤵
        
        PID:1668
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        14⤵
        
        PID:1692
        
        C:\Users\Default User\DllCommonsvc.exe
        
        "C:\Users\Default User\DllCommonsvc.exe"
        14⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:352
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Ph8sa6VtQm.bat"
        15⤵
        
        PID:484
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        16⤵
        
        PID:2776
        
        C:\Users\Default User\DllCommonsvc.exe
        
        "C:\Users\Default User\DllCommonsvc.exe"
        16⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2956
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\U4eMIZxK0W.bat"
        17⤵
        
        PID:1428
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        18⤵
        
        PID:2260
        
        C:\Users\Default User\DllCommonsvc.exe
        
        "C:\Users\Default User\DllCommonsvc.exe"
        18⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1792
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\NYP5fOsMgV.bat"
        19⤵
        
        PID:2472
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        20⤵
        
        PID:924
        
        C:\Users\Default User\DllCommonsvc.exe
        
        "C:\Users\Default User\DllCommonsvc.exe"
        20⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1636
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\kUVpzpaF2i.bat"
        21⤵
        
        PID:2320
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        22⤵
        
        PID:688
        
        C:\Users\Default User\DllCommonsvc.exe
        
        "C:\Users\Default User\DllCommonsvc.exe"
        22⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:892
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\yQDva2PSBr.bat"
        23⤵
        
        PID:2316
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        24⤵
        
        PID:2148

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 5 /tr "'C:\providercommon\OSPPSVC.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\providercommon\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 5 /tr "'C:\providercommon\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 6 /tr "'C:\Program Files\Uninstall Information\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\Program Files\Uninstall Information\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Journal\en-US\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files\Windows Journal\en-US\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Journal\en-US\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2128

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 11 /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\WMIADAP.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAP" /sc ONLOGON /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 13 /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 5 /tr "'C:\Users\Default User\DllCommonsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\Users\Default User\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 7 /tr "'C:\Users\Default User\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1312

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 7 /tr "'C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2192

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\Microsoft Help\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Users\All Users\Microsoft Help\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2132

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\Microsoft Help\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\WMIADAP.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAP" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1196

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 12 /tr "'C:\providercommon\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\providercommon\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 8 /tr "'C:\providercommon\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'C:\Users\Public\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Users\Public\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 9 /tr "'C:\Users\Public\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Google\Temp\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\Temp\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Google\Temp\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 8 /tr "'C:\providercommon\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\providercommon\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\providercommon\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 10 /tr "'C:\providercommon\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\providercommon\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 9 /tr "'C:\providercommon\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\Local Settings\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Admin\Local Settings\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\Local Settings\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d5bf112f920d4ac5761caf85f0e2e29a

SHA1
bde0153cfcccbf25f8acd890bea90fb5b6f22cb7

SHA256
9f398f4af2704e88a2780143a5bc6d5f68655dd00d5425161779ce04128047f5

SHA512
3414c6bae970305aa23273c4ba801e853d6fe8e5b6a6fe8d0d6c10dd4610ea9dcecf771d3b30f8099ebebcf359582b153b29c8ff70806e1c257697d46e14ff0b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
14cca8a6c2716d71c3079655380594a8

SHA1
9c29bb4e6a997e90fb62bec58f7da74f6ea4739b

SHA256
69e9424fe54b1a6c0350bcade1ec004714a900956a4c2acefe2075e392bca033

SHA512
4d0942dc01d4ded2bd0013f5a34c76501c2a80cfc910bbebf549047424a80f3778821c9d21baa7431f40261033812259a6498cd94a1b71c5a02e00157281ce79

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
99d1db9f7dc75e649ca669058922a65b

SHA1
eacbb8e99d71c34eda49a695df58cd37b1b822c7

SHA256
fb538973a243ff924fa95c7651ba678908cd4234d7346216ffef803d479cdd17

SHA512
53e9a1e0388cb08992560dcb184c7f71a72f335cb76cd3c9eccbe41c0ae62de1dfcf24553964ea996a565e6dbbfea4f981f0f7db1e3a71883cc34581cd50c16f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8c53ebaa875fd1c4a1cf6299e0e8fb1d

SHA1
9e37b1b002905bbec7a81c1a71b51b6239269300

SHA256
7dd496c18656eeeec538696d5437ad12f5b48f270c808adfbd9ea6c302af8dff

SHA512
1a1e3f4f2563e628c92e50fbded5bd13975d86ab59c5c14caa2e45d4c5fb0d7e8c7aa678bfaec18ccc3c62a77054a1082b86440a9edc2e09a643b2d50650c07a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7c7f5a3e562f54af865da73dc4494723

SHA1
186ad682e70fdf2075d5b1cd8f677b7b472b98cf

SHA256
5d5dce933a3ccbb5b0570bd4726ca3af32ea2f37f5a8c554142dcdda4d304e54

SHA512
e39e3a6a6611d3bbc44d14ab0f6f73d16237343778d635005d51908207ec230274a4a1ad793eaa0df9a6b1de1d0df97c267e7801631be86db542a000173f2cde

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
592465c7bf7bb7b93e6c14b484115247

SHA1
22b57cd6ab958329f361766bd87470cb12162828

SHA256
45a49cb50271a1441ef538bf25ed6cedc209763280f81428463a6905b7d5e759

SHA512
10d2b85f4d7a89306c357398ce8211b7e0e2ecd892a43cb29aef34b74253f7bd401c4f3524ba43000d695310c1ccf831ddda79ced913b571dc6656c320f7f05d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ca768beeb8620bbffe6ad1c4a13e02da

SHA1
d7dd1947561f16249c189ba104fc3f4ad4c55d45

SHA256
1be129947bb0762f5bbdd45e8d5ea5bc598cee5bcd223b8e5844f772452c4a6c

SHA512
297629134884c23ea0ca2a97e51eddb51fad23d056068c3d7d3c30c9e49f90af223f3e1e925920d0146ddc0e90c63c8e037f73b19093c6f1c68dd50052081f9b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
53cbd7a0f84ccdf44dd40af6642e9877

SHA1
aebd9789e4e7a89c4dc3235b618feebffc7fa9be

SHA256
f50b2bb9d1acb7cb66595ae540fb2362d42ae820fdd66e5394cb46ddb8178c0b

SHA512
932866dab8e35aef5bc139d9cf5964e23ea9b1b8c8d241edb75b04052e1a3d0497609fee3dfd5390268329ef6c04c5c848c8b84a5144b1327160528fd72a8bd6

Download Submit
C:\Users\Admin\AppData\Local\Temp\3Lxx1rvPQX.bat

Filesize
203B

MD5
08d537df8db24c3e19cec5f2d8b58cf2

SHA1
bffeab0a056f33c77e2ef9caa296fc70c2d564f4

SHA256
31ef87d0cc360ef91663aebfb5199ab7e5d5b3e0feffeb538d8574b695a6b87b

SHA512
c0a76b4acc0278135679dcb2db02b7b2ca9d1f0e8cf14b51ceee3e65cc4cb1f89eaaa65552e60b7c7020ebd350f8fb912e11ad139257d4a361927d7b12dd2cde

Download Submit
C:\Users\Admin\AppData\Local\Temp\6bQ8GSjYW4.bat

Filesize
203B

MD5
84dd48b2b9a2a093f19ae8987c9e4993

SHA1
765abb403600ad775a589409c1dc753ed1b69d10

SHA256
97d6d18dd88a3bb5a2b1a4d7baf7a29752f1ceb6887d86abd362aec9f5239f3a

SHA512
ffc2c92c0fbdcedeabdc5783fd7e05014a9c47e2164d5cf61d410aaa26e7785b5f058bc449e93b1ef6483f685105c5114014efdff78ead1f24019dd78bda2c4f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab126A.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\EYKlAcFNfO.bat

Filesize
203B

MD5
1a9dded6fb243a46b9b44ac16fce7c4d

SHA1
babfc9e22b834b33f1dd03388550ab0947513e3d

SHA256
5ab0018ff71ce5ce6541c1a40db416faa8f4a47fcc659b22e2abf79bdb97a55c

SHA512
ae2ffcca637728f71b7371fb9db2eb9f18204db34540f4bc7d2c2b8d8d938e63ccbc1ad11eceeab2a7890bb459a2d3cdc30dff4b440984ceb16ba50e1d81a59d

Download Submit
C:\Users\Admin\AppData\Local\Temp\NYP5fOsMgV.bat

Filesize
203B

MD5
213b34c035a7923aa54a2bbaea203b2c

SHA1
6ff392a16a04e8c5afdb3e9e246d8454e2493b5e

SHA256
f77a0e7a2476a967ba2ee59e171b29745267e1ddf1986e197f3444c91a26d4c6

SHA512
ce15193b7f6247985186da25d99632810fc4e075f2ef68eefb4a8c819a3630235a4ebb18a229e0b6353c94261f5fddd1e73f01c359b3475ae218d565fb429e69

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ph8sa6VtQm.bat

Filesize
203B

MD5
9fb6d9a17931d5999826bcb5c81bb065

SHA1
a7e9db9522b4de2bb758567d3820f45bb8d555d7

SHA256
ba0aed908c8f3b72b8b38550f666e250b38268bba2b0002e35f4c9503b097235

SHA512
2160c651599f9b885e68d85da6d55aa030f5677240f8743d5125f826f5a9840253f0576bb1d0bea070e0b4ad823e5d99f17f6a849a234f1859bcf7e600e84dc7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar127D.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\U4eMIZxK0W.bat

Filesize
203B

MD5
0fb75bb297b305f3b121650fe0601057

SHA1
4a7be3dffe015a9e23e76a734240059254b8773b

SHA256
41c447ba77e3ec64ace4e0b77d398723ee2a7e30bb79be3095d561b3522a1625

SHA512
553bdcfd6b0297d99a77f18f7e716a92f8295e7c9a3d1ed80f02d133b523eae23393f38982467ee3d419eac046e7eb0b1da67c5da8c13b6700f6e80ee6eb3ab2

Download Submit
C:\Users\Admin\AppData\Local\Temp\i0MStmnXAe.bat

Filesize
203B

MD5
d5ef23db9f7108b767e3f85cd935cff6

SHA1
5935c5e1602a82076b879cc7f17b093146016b0d

SHA256
453ebd2ab806074003dd7f5fc7f9c1a9c7eccc935bc75ab7632c337192e3e655

SHA512
7b669165507e5155f810258402dbc82796c0a23f98ec82244286edd0f7b47f4429a2efc2baf9253cca2828a10fafabc497a34da02e38a25e3ea1694bb6df7eed

Download Submit
C:\Users\Admin\AppData\Local\Temp\kUVpzpaF2i.bat

Filesize
203B

MD5
34958394207d23c592eb534ad2cf2840

SHA1
a8bb07299df341691b0baf7b17cc9f337deca218

SHA256
7c1d0435d78e8b11f0e87a27576ccf9f222ac70b2d9b90be6e8f7d099e3f6555

SHA512
0f0fa0e994498ea6568918c6a9abe7a8252ad691cb6612102fd8be835f9ada6cf40f2ee325650048c93988bd17d13aef3d0addf42899dea7baf7f3095e453528

Download Submit
C:\Users\Admin\AppData\Local\Temp\mNrvcGFykN.bat

Filesize
203B

MD5
9ff4b2c593ea71bbce533d1a08592014

SHA1
fa8dd86c9d239453346c02e5c5d3837c3b8bfa75

SHA256
aff017759d267ae8352e98a8b030d2b5adcb60a04485487f4b3c9f1e0447865d

SHA512
32925abfac0bb66b0cf2b97febbe97b81b6d1579dce1e8293e0f8bb85fa913e4cceba66078bf0876fe481ef134b1e1362aaa206783a719fc8e7781ee532b3f37

Download Submit
C:\Users\Admin\AppData\Local\Temp\yQDva2PSBr.bat

Filesize
203B

MD5
4e9879978280a484cf8b45f2c43bc13d

SHA1
9bf0f33bb0b006524b2fc0d75a5557ef7bf3c3ed

SHA256
f800abd360c15b0dd0d2a876746ab5c994860226203530d5cda888b685858b84

SHA512
349c7db1dd75906ce564801c3e1c508b031b8464f5099c0a53b616d49984d41a715bdf7439cac4058a97144f1e38e3ba11907caa2ec496e9f34e27fb8ef93e96

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
0ac4529aef07aef8537ba5b5f9b57bea

SHA1
b22faf07bb7758866848e4737eea4e1d0c78149c

SHA256
4bce55b2def5ae650e3e41a47926a5ed81baf132591b31a8a29b5f80998d7411

SHA512
2b3a9cde7c9a00f6626966afcb6f3cd4769135a0c57428f34f33f203765380def10cb37632034ce88cf80d6db7b40a714989638a59f0257ec97d5961f2bd0e96

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
memory/352-385-0x00000000000D0000-0x00000000001E0000-memory.dmp

Filesize
1.1MB

Download
memory/688-95-0x000000001B6E0000-0x000000001B9C2000-memory.dmp

Filesize
2.9MB

Download
memory/892-624-0x0000000000350000-0x0000000000460000-memory.dmp

Filesize
1.1MB

Download
memory/892-625-0x0000000000340000-0x0000000000352000-memory.dmp

Filesize
72KB

Download
memory/1660-148-0x0000000000C90000-0x0000000000DA0000-memory.dmp

Filesize
1.1MB

Download
memory/1792-505-0x00000000011A0000-0x00000000012B0000-memory.dmp

Filesize
1.1MB

Download
memory/2008-101-0x0000000001E70000-0x0000000001E78000-memory.dmp

Filesize
32KB

Download
memory/2148-17-0x0000000000480000-0x000000000048C000-memory.dmp

Filesize
48KB

Download
memory/2148-16-0x0000000000460000-0x000000000046C000-memory.dmp

Filesize
48KB

Download
memory/2148-15-0x0000000000470000-0x000000000047C000-memory.dmp

Filesize
48KB

Download
memory/2148-14-0x0000000000450000-0x0000000000462000-memory.dmp

Filesize
72KB

Download
memory/2148-13-0x0000000000E20000-0x0000000000F30000-memory.dmp

Filesize
1.1MB

Download
memory/2336-207-0x0000000001390000-0x00000000014A0000-memory.dmp

Filesize
1.1MB

Download
memory/2956-445-0x0000000000970000-0x0000000000A80000-memory.dmp

Filesize
1.1MB

Download