dcrat | 625ec0f7b28ab3b262f47c7f9a2b3827c65f95b6781c148db6b9cd8ac6b16d92

Analysis

max time kernel
150s
max time network
141s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
22/12/2024, 03:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_625ec0f7b28ab3b262f47c7f9a2b3827c65f95b6781c148db6b9cd8ac6b16d92.exe
Size

1.3MB
MD5

8b46eade3ae42b2d47f8a28c8c6a78d6
SHA1

4cd5dd0cc498b1a14a0a89c67457a4e258416e16
SHA256

625ec0f7b28ab3b262f47c7f9a2b3827c65f95b6781c148db6b9cd8ac6b16d92
SHA512

556ad4e38783e572e06cbc9e31b72509b59f92487596a05b28a632d74eb1793e706dec19a8b917895a26a646394008170464705bebda0eb62dbce6b3c4f45511
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 51 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2660	2936	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2812	2936	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2972	2936	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2692	2936	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2708	2936	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2816	2936	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2684	2936	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2724	2936	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1032	2936	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1804	2936	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1604	2936	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2840	2936	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	924	2936	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	788	2936	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2312	2936	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2032	2936	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2640	2936	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2000	2936	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2752	2936	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1956	2936	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2964	2936	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2856	2936	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2144	2936	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2420	2936	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2748	2936	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	916	2936	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3028	2936	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	436	2936	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2088	2936	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	616	2936	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1252	2936	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	964	2936	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1004	2936	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1756	2936	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2140	2936	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1688	2936	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1556	2936	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	268	2936	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2236	2936	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2400	2936	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1640	2936	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1620	2936	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	868	2936	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	672	2936	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	308	2936	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2264	2936	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2280	2936	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1876	2936	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2536	2936	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2380	2936	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1832	2936	schtasks.exe	34

DCRat payload 5 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0007000000016cab-12.dat	dcrat
behavioral1/memory/2092-13-0x0000000001310000-0x0000000001420000-memory.dmp	dcrat
behavioral1/memory/2652-73-0x0000000000D50000-0x0000000000E60000-memory.dmp	dcrat
behavioral1/memory/1264-383-0x0000000001210000-0x0000000001320000-memory.dmp	dcrat
behavioral1/memory/1584-680-0x0000000000040000-0x0000000000150000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 18 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2004	powershell.exe
2760	powershell.exe
1980	powershell.exe
2308	powershell.exe
2480	powershell.exe
2780	powershell.exe
2916	powershell.exe
2492	powershell.exe
2076	powershell.exe
2168	powershell.exe
1356	powershell.exe
2348	powershell.exe
2496	powershell.exe
2900	powershell.exe
2740	powershell.exe
2844	powershell.exe
2648	powershell.exe
3060	powershell.exe

Executes dropped EXE 11 IoCs

pid	Process
2092	DllCommonsvc.exe
2652	WmiPrvSE.exe
2228	WmiPrvSE.exe
2532	WmiPrvSE.exe
2748	WmiPrvSE.exe
1264	WmiPrvSE.exe
1192	WmiPrvSE.exe
2028	WmiPrvSE.exe
1972	WmiPrvSE.exe
2760	WmiPrvSE.exe
1584	WmiPrvSE.exe

Loads dropped DLL 2 IoCs

pid	Process
2528	cmd.exe
2528	cmd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 10 IoCs

Web Service

T1102

flow	ioc
12	raw.githubusercontent.com
16	raw.githubusercontent.com
19	raw.githubusercontent.com
26	raw.githubusercontent.com
30	raw.githubusercontent.com
33	raw.githubusercontent.com
4	raw.githubusercontent.com
5	raw.githubusercontent.com
9	raw.githubusercontent.com
23	raw.githubusercontent.com

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Portable Devices\spoolsv.exe	DllCommonsvc.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\en-US\csrss.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Sidebar\en-US\886983d96e3d3e	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\24dbde2999530e	DllCommonsvc.exe
File created	C:\Program Files\Windows Defender\fr-FR\lsass.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Defender\fr-FR\6203df4a6bafc7	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Portable Devices\f3b6ecef712a24	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Sidebar\en-US\csrss.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\WmiPrvSE.exe	DllCommonsvc.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\Panther\UnattendGC\WmiPrvSE.exe	DllCommonsvc.exe
File created	C:\Windows\Panther\UnattendGC\24dbde2999530e	DllCommonsvc.exe
File created	C:\Windows\BitLockerDiscoveryVolumeContents\WmiPrvSE.exe	DllCommonsvc.exe
File created	C:\Windows\BitLockerDiscoveryVolumeContents\24dbde2999530e	DllCommonsvc.exe
File created	C:\Windows\Resources\Ease of Access Themes\cmd.exe	DllCommonsvc.exe
File created	C:\Windows\Fonts\OSPPSVC.exe	DllCommonsvc.exe
File created	C:\Windows\Fonts\1610b97d3ab4a7	DllCommonsvc.exe
File created	C:\Windows\Fonts\886983d96e3d3e	DllCommonsvc.exe
File created	C:\Windows\Resources\Ease of Access Themes\ebf1f9fa8afd6d	DllCommonsvc.exe
File created	C:\Windows\Fonts\csrss.exe	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_625ec0f7b28ab3b262f47c7f9a2b3827c65f95b6781c148db6b9cd8ac6b16d92.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 51 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
788	schtasks.exe
916	schtasks.exe
2264	schtasks.exe
2536	schtasks.exe
2972	schtasks.exe
2640	schtasks.exe
1956	schtasks.exe
2748	schtasks.exe
1556	schtasks.exe
1640	schtasks.exe
672	schtasks.exe
2380	schtasks.exe
1876	schtasks.exe
2812	schtasks.exe
1804	schtasks.exe
924	schtasks.exe
2964	schtasks.exe
2420	schtasks.exe
2236	schtasks.exe
308	schtasks.exe
3028	schtasks.exe
2088	schtasks.exe
616	schtasks.exe
2140	schtasks.exe
2400	schtasks.exe
2708	schtasks.exe
1604	schtasks.exe
2000	schtasks.exe
2856	schtasks.exe
1756	schtasks.exe
1832	schtasks.exe
1004	schtasks.exe
2692	schtasks.exe
1032	schtasks.exe
2752	schtasks.exe
2144	schtasks.exe
436	schtasks.exe
1252	schtasks.exe
964	schtasks.exe
1620	schtasks.exe
868	schtasks.exe
2816	schtasks.exe
2684	schtasks.exe
2724	schtasks.exe
2312	schtasks.exe
2032	schtasks.exe
2660	schtasks.exe
2840	schtasks.exe
1688	schtasks.exe
268	schtasks.exe
2280	schtasks.exe

Suspicious behavior: EnumeratesProcesses 31 IoCs

pid	Process
2092	DllCommonsvc.exe
2092	DllCommonsvc.exe
2092	DllCommonsvc.exe
2168	powershell.exe
2780	powershell.exe
2760	powershell.exe
2308	powershell.exe
1356	powershell.exe
2900	powershell.exe
2480	powershell.exe
2348	powershell.exe
2916	powershell.exe
2844	powershell.exe
3060	powershell.exe
2076	powershell.exe
2004	powershell.exe
2648	powershell.exe
2740	powershell.exe
1980	powershell.exe
2496	powershell.exe
2492	powershell.exe
2652	WmiPrvSE.exe
2228	WmiPrvSE.exe
2532	WmiPrvSE.exe
2748	WmiPrvSE.exe
1264	WmiPrvSE.exe
1192	WmiPrvSE.exe
2028	WmiPrvSE.exe
1972	WmiPrvSE.exe
2760	WmiPrvSE.exe
1584	WmiPrvSE.exe

Suspicious use of AdjustPrivilegeToken 29 IoCs

description	pid	Process
Token: SeDebugPrivilege	2092	DllCommonsvc.exe
Token: SeDebugPrivilege	2652	WmiPrvSE.exe
Token: SeDebugPrivilege	2168	powershell.exe
Token: SeDebugPrivilege	2780	powershell.exe
Token: SeDebugPrivilege	2760	powershell.exe
Token: SeDebugPrivilege	2308	powershell.exe
Token: SeDebugPrivilege	1356	powershell.exe
Token: SeDebugPrivilege	2900	powershell.exe
Token: SeDebugPrivilege	2480	powershell.exe
Token: SeDebugPrivilege	2348	powershell.exe
Token: SeDebugPrivilege	2916	powershell.exe
Token: SeDebugPrivilege	2844	powershell.exe
Token: SeDebugPrivilege	3060	powershell.exe
Token: SeDebugPrivilege	2076	powershell.exe
Token: SeDebugPrivilege	2004	powershell.exe
Token: SeDebugPrivilege	2648	powershell.exe
Token: SeDebugPrivilege	2740	powershell.exe
Token: SeDebugPrivilege	1980	powershell.exe
Token: SeDebugPrivilege	2496	powershell.exe
Token: SeDebugPrivilege	2492	powershell.exe
Token: SeDebugPrivilege	2228	WmiPrvSE.exe
Token: SeDebugPrivilege	2532	WmiPrvSE.exe
Token: SeDebugPrivilege	2748	WmiPrvSE.exe
Token: SeDebugPrivilege	1264	WmiPrvSE.exe
Token: SeDebugPrivilege	1192	WmiPrvSE.exe
Token: SeDebugPrivilege	2028	WmiPrvSE.exe
Token: SeDebugPrivilege	1972	WmiPrvSE.exe
Token: SeDebugPrivilege	2760	WmiPrvSE.exe
Token: SeDebugPrivilege	1584	WmiPrvSE.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2356 wrote to memory of 2308	2356	JaffaCakes118_625ec0f7b28ab3b262f47c7f9a2b3827c65f95b6781c148db6b9cd8ac6b16d92.exe	30
PID 2356 wrote to memory of 2308	2356	JaffaCakes118_625ec0f7b28ab3b262f47c7f9a2b3827c65f95b6781c148db6b9cd8ac6b16d92.exe	30
PID 2356 wrote to memory of 2308	2356	JaffaCakes118_625ec0f7b28ab3b262f47c7f9a2b3827c65f95b6781c148db6b9cd8ac6b16d92.exe	30
PID 2356 wrote to memory of 2308	2356	JaffaCakes118_625ec0f7b28ab3b262f47c7f9a2b3827c65f95b6781c148db6b9cd8ac6b16d92.exe	30
PID 2308 wrote to memory of 2528	2308	WScript.exe	31
PID 2308 wrote to memory of 2528	2308	WScript.exe	31
PID 2308 wrote to memory of 2528	2308	WScript.exe	31
PID 2308 wrote to memory of 2528	2308	WScript.exe	31
PID 2528 wrote to memory of 2092	2528	cmd.exe	33
PID 2528 wrote to memory of 2092	2528	cmd.exe	33
PID 2528 wrote to memory of 2092	2528	cmd.exe	33
PID 2528 wrote to memory of 2092	2528	cmd.exe	33
PID 2092 wrote to memory of 2492	2092	DllCommonsvc.exe	87
PID 2092 wrote to memory of 2492	2092	DllCommonsvc.exe	87
PID 2092 wrote to memory of 2492	2092	DllCommonsvc.exe	87
PID 2092 wrote to memory of 2348	2092	DllCommonsvc.exe	88
PID 2092 wrote to memory of 2348	2092	DllCommonsvc.exe	88
PID 2092 wrote to memory of 2348	2092	DllCommonsvc.exe	88
PID 2092 wrote to memory of 1980	2092	DllCommonsvc.exe	89
PID 2092 wrote to memory of 1980	2092	DllCommonsvc.exe	89
PID 2092 wrote to memory of 1980	2092	DllCommonsvc.exe	89
PID 2092 wrote to memory of 2308	2092	DllCommonsvc.exe	90
PID 2092 wrote to memory of 2308	2092	DllCommonsvc.exe	90
PID 2092 wrote to memory of 2308	2092	DllCommonsvc.exe	90
PID 2092 wrote to memory of 3060	2092	DllCommonsvc.exe	91
PID 2092 wrote to memory of 3060	2092	DllCommonsvc.exe	91
PID 2092 wrote to memory of 3060	2092	DllCommonsvc.exe	91
PID 2092 wrote to memory of 2480	2092	DllCommonsvc.exe	92
PID 2092 wrote to memory of 2480	2092	DllCommonsvc.exe	92
PID 2092 wrote to memory of 2480	2092	DllCommonsvc.exe	92
PID 2092 wrote to memory of 2496	2092	DllCommonsvc.exe	93
PID 2092 wrote to memory of 2496	2092	DllCommonsvc.exe	93
PID 2092 wrote to memory of 2496	2092	DllCommonsvc.exe	93
PID 2092 wrote to memory of 2760	2092	DllCommonsvc.exe	94
PID 2092 wrote to memory of 2760	2092	DllCommonsvc.exe	94
PID 2092 wrote to memory of 2760	2092	DllCommonsvc.exe	94
PID 2092 wrote to memory of 2780	2092	DllCommonsvc.exe	95
PID 2092 wrote to memory of 2780	2092	DllCommonsvc.exe	95
PID 2092 wrote to memory of 2780	2092	DllCommonsvc.exe	95
PID 2092 wrote to memory of 2900	2092	DllCommonsvc.exe	96
PID 2092 wrote to memory of 2900	2092	DllCommonsvc.exe	96
PID 2092 wrote to memory of 2900	2092	DllCommonsvc.exe	96
PID 2092 wrote to memory of 2916	2092	DllCommonsvc.exe	97
PID 2092 wrote to memory of 2916	2092	DllCommonsvc.exe	97
PID 2092 wrote to memory of 2916	2092	DllCommonsvc.exe	97
PID 2092 wrote to memory of 2076	2092	DllCommonsvc.exe	98
PID 2092 wrote to memory of 2076	2092	DllCommonsvc.exe	98
PID 2092 wrote to memory of 2076	2092	DllCommonsvc.exe	98
PID 2092 wrote to memory of 1356	2092	DllCommonsvc.exe	99
PID 2092 wrote to memory of 1356	2092	DllCommonsvc.exe	99
PID 2092 wrote to memory of 1356	2092	DllCommonsvc.exe	99
PID 2092 wrote to memory of 2740	2092	DllCommonsvc.exe	100
PID 2092 wrote to memory of 2740	2092	DllCommonsvc.exe	100
PID 2092 wrote to memory of 2740	2092	DllCommonsvc.exe	100
PID 2092 wrote to memory of 2168	2092	DllCommonsvc.exe	101
PID 2092 wrote to memory of 2168	2092	DllCommonsvc.exe	101
PID 2092 wrote to memory of 2168	2092	DllCommonsvc.exe	101
PID 2092 wrote to memory of 2844	2092	DllCommonsvc.exe	102
PID 2092 wrote to memory of 2844	2092	DllCommonsvc.exe	102
PID 2092 wrote to memory of 2844	2092	DllCommonsvc.exe	102
PID 2092 wrote to memory of 2004	2092	DllCommonsvc.exe	103
PID 2092 wrote to memory of 2004	2092	DllCommonsvc.exe	103
PID 2092 wrote to memory of 2004	2092	DllCommonsvc.exe	103
PID 2092 wrote to memory of 2648	2092	DllCommonsvc.exe	104

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_625ec0f7b28ab3b262f47c7f9a2b3827c65f95b6781c148db6b9cd8ac6b16d92.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_625ec0f7b28ab3b262f47c7f9a2b3827c65f95b6781c148db6b9cd8ac6b16d92.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2308
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2528
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2092
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2492
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Sidebar\en-US\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2348
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\audiodg.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1980
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Panther\UnattendGC\WmiPrvSE.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2308
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\lsm.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3060
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\explorer.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2480
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\cmd.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2496
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\WmiPrvSE.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2760
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Recorded TV\Sample Media\System.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2780
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\BitLockerDiscoveryVolumeContents\WmiPrvSE.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2900
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Resources\Ease of Access Themes\cmd.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2916
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Searches\services.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2076
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Defender\fr-FR\lsass.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1356
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\wininit.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2740
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\OSPPSVC.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2168
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Portable Devices\spoolsv.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2844
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Fonts\OSPPSVC.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2004
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Fonts\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2648
    - - C:\Windows\BitLockerDiscoveryVolumeContents\WmiPrvSE.exe
        
        "C:\Windows\BitLockerDiscoveryVolumeContents\WmiPrvSE.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2652
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\voEVGuhWUp.bat"
        6⤵
        
        PID:2824
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:1964
        
        C:\Windows\BitLockerDiscoveryVolumeContents\WmiPrvSE.exe
        
        "C:\Windows\BitLockerDiscoveryVolumeContents\WmiPrvSE.exe"
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2228
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ELjGFNzRMY.bat"
        8⤵
        
        PID:2412
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:2040
        
        C:\Windows\BitLockerDiscoveryVolumeContents\WmiPrvSE.exe
        
        "C:\Windows\BitLockerDiscoveryVolumeContents\WmiPrvSE.exe"
        9⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2532
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\J97QZsi4Oz.bat"
        10⤵
        
        PID:2496
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:2624
        
        C:\Windows\BitLockerDiscoveryVolumeContents\WmiPrvSE.exe
        
        "C:\Windows\BitLockerDiscoveryVolumeContents\WmiPrvSE.exe"
        11⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2748
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\mrWoaKD2ur.bat"
        12⤵
        
        PID:796
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:1660
        
        C:\Windows\BitLockerDiscoveryVolumeContents\WmiPrvSE.exe
        
        "C:\Windows\BitLockerDiscoveryVolumeContents\WmiPrvSE.exe"
        13⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1264
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\1bQudXBuXp.bat"
        14⤵
        
        PID:2360
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        15⤵
        
        PID:1148
        
        C:\Windows\BitLockerDiscoveryVolumeContents\WmiPrvSE.exe
        
        "C:\Windows\BitLockerDiscoveryVolumeContents\WmiPrvSE.exe"
        15⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1192
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\M53DwaTFc6.bat"
        16⤵
        
        PID:544
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        17⤵
        
        PID:2900
        
        C:\Windows\BitLockerDiscoveryVolumeContents\WmiPrvSE.exe
        
        "C:\Windows\BitLockerDiscoveryVolumeContents\WmiPrvSE.exe"
        17⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2028
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\xc1v93Hoh1.bat"
        18⤵
        
        PID:2700
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        19⤵
        
        PID:2652
        
        C:\Windows\BitLockerDiscoveryVolumeContents\WmiPrvSE.exe
        
        "C:\Windows\BitLockerDiscoveryVolumeContents\WmiPrvSE.exe"
        19⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1972
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ATZuYpZxcK.bat"
        20⤵
        
        PID:236
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        21⤵
        
        PID:948
        
        C:\Windows\BitLockerDiscoveryVolumeContents\WmiPrvSE.exe
        
        "C:\Windows\BitLockerDiscoveryVolumeContents\WmiPrvSE.exe"
        21⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2760
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\PfMhC4n1i0.bat"
        22⤵
        
        PID:1700
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        23⤵
        
        PID:2508
        
        C:\Windows\BitLockerDiscoveryVolumeContents\WmiPrvSE.exe
        
        "C:\Windows\BitLockerDiscoveryVolumeContents\WmiPrvSE.exe"
        23⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Sidebar\en-US\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\en-US\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Sidebar\en-US\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 12 /tr "'C:\Windows\Panther\UnattendGC\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Windows\Panther\UnattendGC\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 6 /tr "'C:\Windows\Panther\UnattendGC\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 5 /tr "'C:\providercommon\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\providercommon\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 6 /tr "'C:\providercommon\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\Users\Default User\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Users\Default User\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:788

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\Users\Default User\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2312

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 5 /tr "'C:\Users\Default User\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Users\Default User\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 6 /tr "'C:\Users\Default User\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'C:\Users\Public\Recorded TV\Sample Media\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Users\Public\Recorded TV\Sample Media\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 12 /tr "'C:\Users\Public\Recorded TV\Sample Media\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2420

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 12 /tr "'C:\Windows\BitLockerDiscoveryVolumeContents\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Windows\BitLockerDiscoveryVolumeContents\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 9 /tr "'C:\Windows\BitLockerDiscoveryVolumeContents\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 12 /tr "'C:\Windows\Resources\Ease of Access Themes\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Windows\Resources\Ease of Access Themes\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 10 /tr "'C:\Windows\Resources\Ease of Access Themes\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\Searches\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1252

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Users\Admin\Searches\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\Searches\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Defender\fr-FR\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\fr-FR\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2140

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Defender\fr-FR\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 10 /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\OSPPSVC.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 14 /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Portable Devices\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Portable Devices\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 14 /tr "'C:\Windows\Fonts\OSPPSVC.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2264

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Windows\Fonts\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2280

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 8 /tr "'C:\Windows\Fonts\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Windows\Fonts\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\Fonts\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Windows\Fonts\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
25e8e4d9d8ccde590246b26041d8fefe

SHA1
43b3ec2b4bec83076f336c44b31689906c26f7c8

SHA256
e437c9a05f65de4e855c160b537313e5d80d726316e268e4a3b69ec3e346fa9b

SHA512
eca8855585f191a25d2f7d54fe79456f96fdc55a9c256793d1e1e37e3c3d791bd20f9060308925028f08e744ec3e45fd90f82452d13e82c16569a30950ebb3d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
652d74a20b55f33bfaa14b9d82639c85

SHA1
9e3f52b1c5c06132815bce9b4aed36261b026cb4

SHA256
7bf7ffef979541b1f01b8368a2d0d221fb59bfa5b386ddd7e72869e1c5713f96

SHA512
0f5c675950ed0a0bfb7364461991e2c90c160afb58e2b560546d30eb12da9cbd6a9518e869d905c7da8f06f9669df83472fd9e5448cace65a9bb31c24cb760d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9858831be86f0aa66f89fdd003ad481d

SHA1
22e207ce8ce2225901efe5d99ad6ea37859bb7ea

SHA256
f523fb8c4c6e6bdf2119cdb34b6ccfda35392ccb9afceabbfd980bd3d15ca328

SHA512
76bab080be3b50d62865b93ff660d031ce909530db3cf8eac637f2b87db63ef922181e2237de256da157a2bcacb04eb40fb837fcee3c5bb01a33542116f63030

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2deafe7b88522a31ec95c90e7ba08d95

SHA1
0dfb3d0274794ca54cddeff21b955259ec4c203a

SHA256
a851108769601ee61303c7b156e6c9cc46c15b5f6300eac93b1372af43621a55

SHA512
56e52340e60ce1a9d28f4812d107acafdceb474782f3847d886a2d91683d514ee524b8c220559ba75942295aa283523cb0c7cebfdef8c4fc2afc752f185589d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4ad2b0e738ff1e2f5d40a3c5eec124a3

SHA1
fb3f02944ee3bab0f8ff1cabd65b9900454a07ee

SHA256
6f554ecc59b212620d9064b7a468f969892e09c05b162fc28298296a024454a4

SHA512
7216bd16f6d7d4012ed2dc9f18d2a46b14f08457f5f9762eb3449f7f8ca2d479d5c3e4e01b1ec7e05be342372dab3962ae856ac21ec92891bb3c8357f819388c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
51af8150dafdd6b2deb92f57e7583a75

SHA1
f78d04f6a73cdab85bbef5128c61551e586386da

SHA256
fabe02889aae4a5973c4a303e41e647b37b34e6054fd7e3e3ecdf920201eef3b

SHA512
26135640abdf14ff1b9785a211238cbd43a1bc76bb03735a72d8b10ce79ee7038d693cf99586cfb97aa5b085df12e3601a8a68a1c5305a813581dba24a4f21ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5f0e41b537fae1d1602a39bcc772896e

SHA1
949f0e0e8acf2be32f3778c9216156c8788bd5ac

SHA256
a799d3017812f5e04128062ac568a00c9bc7641cd90aa3d5180abb1f7f867ab3

SHA512
cba30e691a8de73712512fd6b8a137ce520d5a7036a585a6731067c0a9a41b4f16bf4463fc5cfee26074e2f64724b12f0cfcc24ca7df3fb41f99b693aec1caa3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a3473f052990e7b86c4854ee68c45e1d

SHA1
a96204dd6d3cc9963f367755084d3a23bdc1dc32

SHA256
3862c2502fe0033c8b70d4ce31676d09b6776bcb73b2926ca15ea621928bd836

SHA512
b2bac63fcd3cfdebdefe73de11400c1f7071f3dd214403564048c2954916b0a2a82ff6454b910f391a7b38d56681f548dc89f4269f27ec6e53bc3bf51fd243af

Download Submit
C:\Users\Admin\AppData\Local\Temp\1bQudXBuXp.bat

Filesize
221B

MD5
6ac4a85109a66b203639207eaaa202e3

SHA1
47583933af6356565de1f910e4080a32cebcfb20

SHA256
c47ea60ca64e36c969f0d34d42a6f1f5e515164e899d99b952d14fa6bd521508

SHA512
33d42d0ccadc69d7464c55ee2d18dbff37e2231bf990d564ad7cc587905aa5cbf430a819016b04778c2ab99ec3f5a5800b568aaa339e22a2640384374ec6f335

Download Submit
C:\Users\Admin\AppData\Local\Temp\ATZuYpZxcK.bat

Filesize
221B

MD5
0bc2e27f4dc68025cf41e3cdf2b7fdee

SHA1
a9fb5f04abb3e22ddbcbe367bc933ba1176cb95b

SHA256
ddf60bcb8ae78190e8da89d0ef44b5b7631ae109963d9b2f0b58939bc6f06bcb

SHA512
91038c23665e66789b9126bd07fa87fc1dba35491125bb853b5a5417f7149b4985ac5b8dc6d944506d402695b447a014b88118b53a892421adb930090b35fbb6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab11ED.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\ELjGFNzRMY.bat

Filesize
221B

MD5
834cba62bfd807da6b5e6a59f1e12d7e

SHA1
be3ec0bf99351cbf757f45c001ab0d5467b349d5

SHA256
570bc012f279212185778e344ca588aa136997757f4826698005dd6479f5b8ff

SHA512
21db0e84262efcb4ccfe1d50b73755d5d74495a26b73c6bf85f2cd59c16b236cfd5438cdf3ae70555530fe350d24ce06eade96a3cbc748104c525cc0da6f4001

Download Submit
C:\Users\Admin\AppData\Local\Temp\J97QZsi4Oz.bat

Filesize
221B

MD5
53c3f9ede53a118ea7a5977c14f855bb

SHA1
f703f65e09ab56a31a5af650107ea4ec38859341

SHA256
99cc28c2a9d1e4a6ad952cc3cf3aa9260a21213a9f190bf0d46a5ec23d636bf1

SHA512
564956bbca28cb0634746c075e4ba81c3b3f02999051a1c4b941c334f4562f1e2b466e945532d647147d028f81edcf33e881730e0905663b4598e3e6afa2e5de

Download Submit
C:\Users\Admin\AppData\Local\Temp\M53DwaTFc6.bat

Filesize
221B

MD5
1911ecbf7e0883848980bcc68c516955

SHA1
e77df1a46b9ac3453515e9099f58227300437ebe

SHA256
6c994e9ee32858fbc38f65e8f8a4522cce35976b354baf95a9cb774267ad0dd3

SHA512
9dcc8728a8f51c0e519bdef7860ece56a1e913c0074132384b707bd2c04be0f9f9ab6c72b344824f0df49ae1fe87ebcd44bd468743426b1acce5b31fffc08311

Download Submit
C:\Users\Admin\AppData\Local\Temp\PfMhC4n1i0.bat

Filesize
221B

MD5
e53809f56da809c8a50dd5d1e1e9b769

SHA1
870853afd0fc6ddfac54872412ba0fece458f3fe

SHA256
6ab595d3eb2a4676f88c16695370f0db5ce33ec677b5ff9e628ab4c463e2f054

SHA512
6026d356af627e97bac87138b9c8c016f5ca5946b2168f553a8b120135f452af2c2f470ee62bfb9d1263b31553cac4547a05a4255f3d5ee741f7e65a1df40c26

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar12F9.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\mrWoaKD2ur.bat

Filesize
221B

MD5
db2dc22feaf3eb8ea8806187fadbfd5d

SHA1
ef7baa6ffc7f82f8e9a50d65ba5d7138dfa199e5

SHA256
350a45af2538d6f2d7839894d5fd2787d07e1661a853171a4b0bd47b362f6923

SHA512
13057dd247c9d40758167cf841e8055650c3f4e683f8468d52e8957ac243a5e04361c6237d3463d55567f133a2049e1a200d8ead2f8230442cbd41d3a880a127

Download Submit
C:\Users\Admin\AppData\Local\Temp\voEVGuhWUp.bat

Filesize
221B

MD5
3034456cb89686ecbdca5694630b3195

SHA1
c822e57d3a9435f969bee1856c6bb4df846320a7

SHA256
766ba432df12ca73d74caf0a5f819655425b382c4f69164a007c654e79103b3f

SHA512
0b2a8149431b859ad81fc52804a710631d268d16f665915c45278b7cdaedde1456b28c71fcbfd809d3098892cdd5271e9257ff1f786a8377b2f4c1b54f34b342

Download Submit
C:\Users\Admin\AppData\Local\Temp\xc1v93Hoh1.bat

Filesize
221B

MD5
7ec9f91610fd912d3fbd0cf63a8ed444

SHA1
bf8d7c217ff45da3030bbaf56250f78851766beb

SHA256
9bc54356645d8dc6b513025aaf3a29b36ce694890df5b6bacd457d438baf2d5f

SHA512
31481043d5b8bf79a9d0f90f755a548c77bba66e932ff8af8f73b2f2f0af8d1a5f31b62c5db7f11e8cbee1a55e436674134db285c54a4eeaa5f1073edc78a22e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
847dec29370a3f545c036a9e5aee17c2

SHA1
0745c74a0c2767c14851d36c2d0fa61685ae7542

SHA256
6aaf902bf2bd1fa3f3239891d0757cd2e344c9dadddd595845d6b0af861c8c8f

SHA512
4e78c4004423e4499272f014e2b0a1c1f469399f218a0ebec0963a61c7a496c1e767931599f2a4663a8229493ae78e79946606d3ea8f664ea53747499dc7942b

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/1264-383-0x0000000001210000-0x0000000001320000-memory.dmp

Filesize
1.1MB

Download
memory/1584-680-0x0000000000040000-0x0000000000150000-memory.dmp

Filesize
1.1MB

Download
memory/2092-17-0x00000000004F0000-0x00000000004FC000-memory.dmp

Filesize
48KB

Download
memory/2092-16-0x00000000004E0000-0x00000000004EC000-memory.dmp

Filesize
48KB

Download
memory/2092-15-0x00000000004D0000-0x00000000004DC000-memory.dmp

Filesize
48KB

Download
memory/2092-14-0x00000000003D0000-0x00000000003E2000-memory.dmp

Filesize
72KB

Download
memory/2092-13-0x0000000001310000-0x0000000001420000-memory.dmp

Filesize
1.1MB

Download
memory/2168-145-0x0000000002510000-0x0000000002518000-memory.dmp

Filesize
32KB

Download
memory/2652-147-0x00000000001D0000-0x00000000001E2000-memory.dmp

Filesize
72KB

Download
memory/2652-73-0x0000000000D50000-0x0000000000E60000-memory.dmp

Filesize
1.1MB

Download
memory/2760-620-0x0000000000360000-0x0000000000372000-memory.dmp

Filesize
72KB

Download
memory/2844-146-0x000000001B330000-0x000000001B612000-memory.dmp

Filesize
2.9MB

Download