dcrat | fefe964d083cc9aaf22ae6b31e6ac62c6a9928c3b3901895fcfc749055f8f9c3

Analysis

max time kernel
143s
max time network
138s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
22-12-2024 03:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_fefe964d083cc9aaf22ae6b31e6ac62c6a9928c3b3901895fcfc749055f8f9c3.exe
Size

1.3MB
MD5

76e296446f83da9d2f3f531a5f77a344
SHA1

cca0c587bfbafd87e2263e4ebdd23f18a7a38c05
SHA256

fefe964d083cc9aaf22ae6b31e6ac62c6a9928c3b3901895fcfc749055f8f9c3
SHA512

ecbb6de0ec10355d0d197404de42b1c6e8904893dd59cf6410d0080f9326aab7d519fbf9903cb39505b47972bcdb5843c67ba64e213f235396fcc7738d7614bd
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 45 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3000	2580	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2224	2580	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1684	2580	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	408	2580	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1140	2580	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2444	2580	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	112	2580	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2512	2580	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2708	2580	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1332	2580	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2092	2580	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2428	2580	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2852	2580	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1760	2580	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	760	2580	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1660	2580	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1104	2580	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2888	2580	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1076	2580	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2040	2580	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1428	2580	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2572	2580	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	568	2580	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2308	2580	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1688	2580	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2148	2580	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2388	2580	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1868	2580	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1756	2580	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1800	2580	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1596	2580	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2236	2580	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2764	2580	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3044	2580	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2804	2580	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2760	2580	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2848	2580	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2528	2580	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1736	2580	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2288	2580	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1484	2580	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1088	2580	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2080	2580	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3000	2580	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	608	2580	schtasks.exe	34

DCRat payload 6 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x000800000001653a-12.dat	dcrat
behavioral1/memory/2200-13-0x0000000000D30000-0x0000000000E40000-memory.dmp	dcrat
behavioral1/memory/1712-141-0x0000000000EE0000-0x0000000000FF0000-memory.dmp	dcrat
behavioral1/memory/2356-318-0x0000000001350000-0x0000000001460000-memory.dmp	dcrat
behavioral1/memory/2704-673-0x0000000000120000-0x0000000000230000-memory.dmp	dcrat
behavioral1/memory/3048-733-0x0000000000260000-0x0000000000370000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 17 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
536	powershell.exe
2028	powershell.exe
1388	powershell.exe
2112	powershell.exe
992	powershell.exe
3040	powershell.exe
444	powershell.exe
2352	powershell.exe
292	powershell.exe
1200	powershell.exe
2924	powershell.exe
2756	powershell.exe
2512	powershell.exe
2900	powershell.exe
860	powershell.exe
2644	powershell.exe
2696	powershell.exe

Executes dropped EXE 13 IoCs

pid	Process
2200	DllCommonsvc.exe
2372	DllCommonsvc.exe
1712	taskhost.exe
2236	taskhost.exe
1336	taskhost.exe
2356	taskhost.exe
2244	taskhost.exe
1252	taskhost.exe
2036	taskhost.exe
1660	taskhost.exe
2288	taskhost.exe
2704	taskhost.exe
3048	taskhost.exe

Loads dropped DLL 2 IoCs

pid	Process
2648	cmd.exe
2648	cmd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 11 IoCs

Web Service

T1102

flow	ioc
4	raw.githubusercontent.com
16	raw.githubusercontent.com
19	raw.githubusercontent.com
33	raw.githubusercontent.com
37	raw.githubusercontent.com
5	raw.githubusercontent.com
9	raw.githubusercontent.com
12	raw.githubusercontent.com
23	raw.githubusercontent.com
26	raw.githubusercontent.com
30	raw.githubusercontent.com

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\Lang\System.exe	DllCommonsvc.exe
File opened for modification	C:\Program Files\7-Zip\Lang\System.exe	DllCommonsvc.exe
File created	C:\Program Files\7-Zip\Lang\27d1bcfc3c54e0	DllCommonsvc.exe
File created	C:\Program Files\VideoLAN\VLC\hrtfs\taskhost.exe	DllCommonsvc.exe
File created	C:\Program Files\VideoLAN\VLC\hrtfs\b75386f1303e64	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows NT\Accessories\ja-JP\services.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows NT\Accessories\ja-JP\c5b4cb5e9653cc	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_fefe964d083cc9aaf22ae6b31e6ac62c6a9928c3b3901895fcfc749055f8f9c3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 45 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2528	schtasks.exe
2224	schtasks.exe
1076	schtasks.exe
1756	schtasks.exe
3000	schtasks.exe
2040	schtasks.exe
1428	schtasks.exe
2236	schtasks.exe
1484	schtasks.exe
2708	schtasks.exe
2428	schtasks.exe
1760	schtasks.exe
2764	schtasks.exe
1088	schtasks.exe
408	schtasks.exe
2572	schtasks.exe
568	schtasks.exe
2388	schtasks.exe
2804	schtasks.exe
2760	schtasks.exe
1736	schtasks.exe
2080	schtasks.exe
2512	schtasks.exe
760	schtasks.exe
2148	schtasks.exe
608	schtasks.exe
1868	schtasks.exe
1596	schtasks.exe
2848	schtasks.exe
1104	schtasks.exe
2888	schtasks.exe
2308	schtasks.exe
1688	schtasks.exe
1800	schtasks.exe
3044	schtasks.exe
2288	schtasks.exe
3000	schtasks.exe
1684	schtasks.exe
1140	schtasks.exe
1660	schtasks.exe
2092	schtasks.exe
2852	schtasks.exe
2444	schtasks.exe
112	schtasks.exe
1332	schtasks.exe

Suspicious behavior: EnumeratesProcesses 38 IoCs

pid	Process
2200	DllCommonsvc.exe
2112	powershell.exe
860	powershell.exe
536	powershell.exe
292	powershell.exe
992	powershell.exe
2372	DllCommonsvc.exe
2372	DllCommonsvc.exe
2372	DllCommonsvc.exe
2372	DllCommonsvc.exe
2372	DllCommonsvc.exe
2372	DllCommonsvc.exe
2372	DllCommonsvc.exe
2372	DllCommonsvc.exe
2372	DllCommonsvc.exe
2512	powershell.exe
1388	powershell.exe
2028	powershell.exe
1200	powershell.exe
2352	powershell.exe
3040	powershell.exe
2924	powershell.exe
2644	powershell.exe
2900	powershell.exe
444	powershell.exe
2696	powershell.exe
2756	powershell.exe
1712	taskhost.exe
2236	taskhost.exe
1336	taskhost.exe
2356	taskhost.exe
2244	taskhost.exe
1252	taskhost.exe
2036	taskhost.exe
1660	taskhost.exe
2288	taskhost.exe
2704	taskhost.exe
3048	taskhost.exe

Suspicious use of AdjustPrivilegeToken 30 IoCs

description	pid	Process
Token: SeDebugPrivilege	2200	DllCommonsvc.exe
Token: SeDebugPrivilege	2112	powershell.exe
Token: SeDebugPrivilege	860	powershell.exe
Token: SeDebugPrivilege	536	powershell.exe
Token: SeDebugPrivilege	292	powershell.exe
Token: SeDebugPrivilege	992	powershell.exe
Token: SeDebugPrivilege	2372	DllCommonsvc.exe
Token: SeDebugPrivilege	2512	powershell.exe
Token: SeDebugPrivilege	1388	powershell.exe
Token: SeDebugPrivilege	2028	powershell.exe
Token: SeDebugPrivilege	1200	powershell.exe
Token: SeDebugPrivilege	2352	powershell.exe
Token: SeDebugPrivilege	3040	powershell.exe
Token: SeDebugPrivilege	2924	powershell.exe
Token: SeDebugPrivilege	2644	powershell.exe
Token: SeDebugPrivilege	2900	powershell.exe
Token: SeDebugPrivilege	444	powershell.exe
Token: SeDebugPrivilege	2696	powershell.exe
Token: SeDebugPrivilege	2756	powershell.exe
Token: SeDebugPrivilege	1712	taskhost.exe
Token: SeDebugPrivilege	2236	taskhost.exe
Token: SeDebugPrivilege	1336	taskhost.exe
Token: SeDebugPrivilege	2356	taskhost.exe
Token: SeDebugPrivilege	2244	taskhost.exe
Token: SeDebugPrivilege	1252	taskhost.exe
Token: SeDebugPrivilege	2036	taskhost.exe
Token: SeDebugPrivilege	1660	taskhost.exe
Token: SeDebugPrivilege	2288	taskhost.exe
Token: SeDebugPrivilege	2704	taskhost.exe
Token: SeDebugPrivilege	3048	taskhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2624 wrote to memory of 2780	2624	JaffaCakes118_fefe964d083cc9aaf22ae6b31e6ac62c6a9928c3b3901895fcfc749055f8f9c3.exe	30
PID 2624 wrote to memory of 2780	2624	JaffaCakes118_fefe964d083cc9aaf22ae6b31e6ac62c6a9928c3b3901895fcfc749055f8f9c3.exe	30
PID 2624 wrote to memory of 2780	2624	JaffaCakes118_fefe964d083cc9aaf22ae6b31e6ac62c6a9928c3b3901895fcfc749055f8f9c3.exe	30
PID 2624 wrote to memory of 2780	2624	JaffaCakes118_fefe964d083cc9aaf22ae6b31e6ac62c6a9928c3b3901895fcfc749055f8f9c3.exe	30
PID 2780 wrote to memory of 2648	2780	WScript.exe	31
PID 2780 wrote to memory of 2648	2780	WScript.exe	31
PID 2780 wrote to memory of 2648	2780	WScript.exe	31
PID 2780 wrote to memory of 2648	2780	WScript.exe	31
PID 2648 wrote to memory of 2200	2648	cmd.exe	33
PID 2648 wrote to memory of 2200	2648	cmd.exe	33
PID 2648 wrote to memory of 2200	2648	cmd.exe	33
PID 2648 wrote to memory of 2200	2648	cmd.exe	33
PID 2200 wrote to memory of 860	2200	DllCommonsvc.exe	47
PID 2200 wrote to memory of 860	2200	DllCommonsvc.exe	47
PID 2200 wrote to memory of 860	2200	DllCommonsvc.exe	47
PID 2200 wrote to memory of 292	2200	DllCommonsvc.exe	48
PID 2200 wrote to memory of 292	2200	DllCommonsvc.exe	48
PID 2200 wrote to memory of 292	2200	DllCommonsvc.exe	48
PID 2200 wrote to memory of 992	2200	DllCommonsvc.exe	50
PID 2200 wrote to memory of 992	2200	DllCommonsvc.exe	50
PID 2200 wrote to memory of 992	2200	DllCommonsvc.exe	50
PID 2200 wrote to memory of 536	2200	DllCommonsvc.exe	52
PID 2200 wrote to memory of 536	2200	DllCommonsvc.exe	52
PID 2200 wrote to memory of 536	2200	DllCommonsvc.exe	52
PID 2200 wrote to memory of 2112	2200	DllCommonsvc.exe	53
PID 2200 wrote to memory of 2112	2200	DllCommonsvc.exe	53
PID 2200 wrote to memory of 2112	2200	DllCommonsvc.exe	53
PID 2200 wrote to memory of 2372	2200	DllCommonsvc.exe	57
PID 2200 wrote to memory of 2372	2200	DllCommonsvc.exe	57
PID 2200 wrote to memory of 2372	2200	DllCommonsvc.exe	57
PID 2372 wrote to memory of 1200	2372	DllCommonsvc.exe	91
PID 2372 wrote to memory of 1200	2372	DllCommonsvc.exe	91
PID 2372 wrote to memory of 1200	2372	DllCommonsvc.exe	91
PID 2372 wrote to memory of 1388	2372	DllCommonsvc.exe	92
PID 2372 wrote to memory of 1388	2372	DllCommonsvc.exe	92
PID 2372 wrote to memory of 1388	2372	DllCommonsvc.exe	92
PID 2372 wrote to memory of 2900	2372	DllCommonsvc.exe	93
PID 2372 wrote to memory of 2900	2372	DllCommonsvc.exe	93
PID 2372 wrote to memory of 2900	2372	DllCommonsvc.exe	93
PID 2372 wrote to memory of 2512	2372	DllCommonsvc.exe	94
PID 2372 wrote to memory of 2512	2372	DllCommonsvc.exe	94
PID 2372 wrote to memory of 2512	2372	DllCommonsvc.exe	94
PID 2372 wrote to memory of 2756	2372	DllCommonsvc.exe	97
PID 2372 wrote to memory of 2756	2372	DllCommonsvc.exe	97
PID 2372 wrote to memory of 2756	2372	DllCommonsvc.exe	97
PID 2372 wrote to memory of 2696	2372	DllCommonsvc.exe	98
PID 2372 wrote to memory of 2696	2372	DllCommonsvc.exe	98
PID 2372 wrote to memory of 2696	2372	DllCommonsvc.exe	98
PID 2372 wrote to memory of 2644	2372	DllCommonsvc.exe	99
PID 2372 wrote to memory of 2644	2372	DllCommonsvc.exe	99
PID 2372 wrote to memory of 2644	2372	DllCommonsvc.exe	99
PID 2372 wrote to memory of 2028	2372	DllCommonsvc.exe	100
PID 2372 wrote to memory of 2028	2372	DllCommonsvc.exe	100
PID 2372 wrote to memory of 2028	2372	DllCommonsvc.exe	100
PID 2372 wrote to memory of 2352	2372	DllCommonsvc.exe	101
PID 2372 wrote to memory of 2352	2372	DllCommonsvc.exe	101
PID 2372 wrote to memory of 2352	2372	DllCommonsvc.exe	101
PID 2372 wrote to memory of 444	2372	DllCommonsvc.exe	102
PID 2372 wrote to memory of 444	2372	DllCommonsvc.exe	102
PID 2372 wrote to memory of 444	2372	DllCommonsvc.exe	102
PID 2372 wrote to memory of 3040	2372	DllCommonsvc.exe	103
PID 2372 wrote to memory of 3040	2372	DllCommonsvc.exe	103
PID 2372 wrote to memory of 3040	2372	DllCommonsvc.exe	103
PID 2372 wrote to memory of 2924	2372	DllCommonsvc.exe	105

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_fefe964d083cc9aaf22ae6b31e6ac62c6a9928c3b3901895fcfc749055f8f9c3.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_fefe964d083cc9aaf22ae6b31e6ac62c6a9928c3b3901895fcfc749055f8f9c3.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2624
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2780
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2648
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2200
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:860
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\System.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:292
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Favorites\System.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:992
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\cmd.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:536
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\explorer.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2112
    - - C:\providercommon\DllCommonsvc.exe
        
        "C:\providercommon\DllCommonsvc.exe"
        5⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2372
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1200
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\7-Zip\Lang\System.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1388
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\lsass.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2900
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\lsass.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2512
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\spoolsv.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2756
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\OSPPSVC.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2696
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Pictures\DllCommonsvc.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2644
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\VideoLAN\VLC\hrtfs\taskhost.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2028
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\spoolsv.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2352
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\System.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:444
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows NT\Accessories\ja-JP\services.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3040
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\dwm.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2924
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\XY5uHg6WI2.bat"
        6⤵
        
        PID:2092
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:2612
        
        C:\Program Files\VideoLAN\VLC\hrtfs\taskhost.exe
        
        "C:\Program Files\VideoLAN\VLC\hrtfs\taskhost.exe"
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1712
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ZmgdUlucqh.bat"
        8⤵
        
        PID:2224
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:2764
        
        C:\Program Files\VideoLAN\VLC\hrtfs\taskhost.exe
        
        "C:\Program Files\VideoLAN\VLC\hrtfs\taskhost.exe"
        9⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2236
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\BikqvEHWfW.bat"
        10⤵
        
        PID:2028
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:2740
        
        C:\Program Files\VideoLAN\VLC\hrtfs\taskhost.exe
        
        "C:\Program Files\VideoLAN\VLC\hrtfs\taskhost.exe"
        11⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1336
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\04VLARgLyy.bat"
        12⤵
        
        PID:1728
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:2372
        
        C:\Program Files\VideoLAN\VLC\hrtfs\taskhost.exe
        
        "C:\Program Files\VideoLAN\VLC\hrtfs\taskhost.exe"
        13⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2356
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\LdHmevWlG3.bat"
        14⤵
        
        PID:2176
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        15⤵
        
        PID:2648
        
        C:\Program Files\VideoLAN\VLC\hrtfs\taskhost.exe
        
        "C:\Program Files\VideoLAN\VLC\hrtfs\taskhost.exe"
        15⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2244
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\lHuJ4aKJis.bat"
        16⤵
        
        PID:1552
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        17⤵
        
        PID:1308
        
        C:\Program Files\VideoLAN\VLC\hrtfs\taskhost.exe
        
        "C:\Program Files\VideoLAN\VLC\hrtfs\taskhost.exe"
        17⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1252
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\xZLz5Ote6t.bat"
        18⤵
        
        PID:2480
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        19⤵
        
        PID:2568
        
        C:\Program Files\VideoLAN\VLC\hrtfs\taskhost.exe
        
        "C:\Program Files\VideoLAN\VLC\hrtfs\taskhost.exe"
        19⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2036
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\jaxwQXfGLd.bat"
        20⤵
        
        PID:3028
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        21⤵
        
        PID:1580
        
        C:\Program Files\VideoLAN\VLC\hrtfs\taskhost.exe
        
        "C:\Program Files\VideoLAN\VLC\hrtfs\taskhost.exe"
        21⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1660
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\V9nTU0UPEK.bat"
        22⤵
        
        PID:620
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        23⤵
        
        PID:1672
        
        C:\Program Files\VideoLAN\VLC\hrtfs\taskhost.exe
        
        "C:\Program Files\VideoLAN\VLC\hrtfs\taskhost.exe"
        23⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2288
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\grdey4A1QM.bat"
        24⤵
        
        PID:1808
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        25⤵
        
        PID:408
        
        C:\Program Files\VideoLAN\VLC\hrtfs\taskhost.exe
        
        "C:\Program Files\VideoLAN\VLC\hrtfs\taskhost.exe"
        25⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2704
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\oqEnL4f5pl.bat"
        26⤵
        
        PID:1676
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        27⤵
        
        PID:1592
        
        C:\Program Files\VideoLAN\VLC\hrtfs\taskhost.exe
        
        "C:\Program Files\VideoLAN\VLC\hrtfs\taskhost.exe"
        27⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 8 /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 8 /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\Favorites\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Users\All Users\Favorites\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1140

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\Favorites\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 7 /tr "'C:\providercommon\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\providercommon\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 13 /tr "'C:\providercommon\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 6 /tr "'C:\providercommon\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1332

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\providercommon\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 6 /tr "'C:\providercommon\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 11 /tr "'C:\Program Files\7-Zip\Lang\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files\7-Zip\Lang\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 5 /tr "'C:\Program Files\7-Zip\Lang\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\providercommon\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\providercommon\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 10 /tr "'C:\providercommon\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\providercommon\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\providercommon\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\providercommon\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 8 /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 10 /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 10 /tr "'C:\providercommon\OSPPSVC.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\providercommon\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2148

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 6 /tr "'C:\providercommon\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\Pictures\DllCommonsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\Users\Admin\Pictures\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\Pictures\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 13 /tr "'C:\Program Files\VideoLAN\VLC\hrtfs\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\VLC\hrtfs\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 6 /tr "'C:\Program Files\VideoLAN\VLC\hrtfs\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 10 /tr "'C:\Users\Default User\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Users\Default User\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 13 /tr "'C:\Users\Default User\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows NT\Accessories\ja-JP\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2288

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\Accessories\ja-JP\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows NT\Accessories\ja-JP\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Users\All Users\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e3618123c15ba0dd26839e070f2e3d82

SHA1
a900d6428ccf247823799e7daf7f657b1acbdd32

SHA256
1c83c7b5c9d1dfc7a2fc62e20b916dec7de510d47b1e39578750cdd8c34d73e7

SHA512
a420db8b3836c86278d7c9db8f200e4969c393220469c08868012a0f6c88139ed385743dc8351be1059571e9d9de7e83c9377a9707a2976ea2c8b6072edeb3af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f7298bee69b3e2c78fcc00e48a07fe60

SHA1
da72f895dc5e731633406ff6fe5b60e2f4e515a2

SHA256
3f03a9a00af81e61391014c65855087f0ad7198dd3787831f3c4593b059f9e01

SHA512
1e12c8192f4c8ace1f38bbd49bde2891ebc4201852fd894d756f2d76e85055efd2f2199d264860fea4f437fd87a14b1a90917367fea7262e495b142a2ff23b0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f1abdac75ce058c210c6b75901b5d32a

SHA1
96d06acc01cd5ee0091baa554add66b2d52b02ff

SHA256
974f91fd0e4950f7db1038d809133717c27fb959cfbb92d5648ac123547289c9

SHA512
e24b8853bdfac293e0db218e9973042088a121a5672bb6d8c3ceaa6ad87ad4a397d1cee1199acf8ea64b08e19caa39b68d9f366314c632b59bb712ec48d22b16

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2012ce5301c74eaba031ec57b6f4eea9

SHA1
9fa1757842f31c4bc606725e27b1a3b5dfc3383f

SHA256
8656b2f3350d6bd53dfbef110b50ddd6b96a8e6e14dde84dcc08fbb5035c7eaa

SHA512
42d527c1fd1df36d607e2dc237e1c8d852bdeef5b978fca19b23fe6e43a642ea32ea990a7c10615f754de1696706e3fd86ac9282643a763f2259304ef4d84c2d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
72a35205f207d8554a4eabe5153ed50a

SHA1
c616f56dc0d8870f4569a5b2ee19ae0b9b8f91fc

SHA256
e86b833e57702ef82ccba60befc8be2bacbfa307945186a037c1d5b5e5f2b74d

SHA512
b6a342f6707ca6053718e6b07b05b97ebd5b4194180cf1ca773e4332b09dc970c4e6bdf4ee391442f32b3cf1dc3ce7b22e62c1e36737a9725a305cb31856de5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e6b330757dbea59b8b46f6783cbef8fe

SHA1
73742b071155a7c1ef47f3118c824be083cef1e0

SHA256
769e0de8b500581e1ba4257ae0fe0f670976e0ac0d12f00d268e47318ff09f71

SHA512
f0a2485138d80ced3d9f45b7f89fc9b7cbdd411d902803182af028562793af70e69c71110d70476597336762557ae758e4c8cc7a021c2c6d01541137ecd4b2ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
65bbd0e4faf8906f9adfc7cea27f3832

SHA1
6caa7ac3ac79f2da9cb9d83084b642bd983fa854

SHA256
1e5b66af9941fe7b4f80bf4de16799a8583270366b9716ed725559b8c1f0bcd6

SHA512
8e4dab5c5d1960259f1b2568ae73c10b8326ff54dee2a0ed4edd9fbb17519d46c9ef2ef0a4231524cee96a2f92bbbb5232277124c1a06c2994125795d1efc2f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
54e9cac38a5f163b92e5242ab81089ac

SHA1
86fba24cb47d9c5a1548448de8de11c7cfdc2219

SHA256
755d792008c7d60721a61465df3891d51e39cf37224554f5cee9ca1f7d65dbe3

SHA512
e4bd7628295570b0c97bb88a53547678b3ba8d7028786dd967347524e0ca254ac705ddec1c156e103e5a088bd83968cae2ab5e71729a5fc08beb2ad941833b69

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bf381489d60b5beb18f6258ae66f8164

SHA1
1ea8f0a318b548422b158f6be3f8ef7b999a302d

SHA256
ab0e637b72a2faf023dc6b4ff036913a0323f2a8e13128973b8484427d44072a

SHA512
7dc64430ef29bec959c5de9b21ff906e1e9733bc907a8b27d13d2dfad4da5d4d5185babea431b6bc8d4f2aef5c0355c0c295c76626a538125116ea8aa2ae847f

Download Submit
C:\Users\Admin\AppData\Local\Temp\04VLARgLyy.bat

Filesize
213B

MD5
e5b493d657489d3b2fc9a349a89bdd42

SHA1
98e080f7bd20f12f7b397eba11c28564eabdf4c8

SHA256
f9043f4c635c045002303edb952d1b3211bab5859d5ec6fdf1f487d8f549197c

SHA512
f1a07979d45c9b6cd14ad93e665757e306a4098d7830de7d078d0c9500693ebacb21f3d85cfc35b5723fa532b6680fe72b1c48a384953bddb2d10842f6741546

Download Submit
C:\Users\Admin\AppData\Local\Temp\BikqvEHWfW.bat

Filesize
213B

MD5
6b314e7ad2c9214e436de179ac39235a

SHA1
729c582c1777caa83fe075550afb7f2862b31d05

SHA256
44e7d508fd923ce87fea16c7feddd97b1adf1c3b5de0b481741a6618775fa1a9

SHA512
41a882beb3b07556195af3b47ab731886161e098ce3d01b0fedb4c5c72e83803a16946dbc6ac4b0a58dab0dc32f872c7f83835ac635c09b1edd4495b176a103a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab83A3.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\LdHmevWlG3.bat

Filesize
213B

MD5
7a2029512e559475c6d0615d28e918e5

SHA1
9bde901efa986b3b0bf83cb591d3416b0544a4fb

SHA256
e9868e8d63fca12207640c2ce2ade421b646d3d2e88eb2aea8581259296107ea

SHA512
4976fb297d3afa484e377a51a5e0a7075b2312eb3e9dd4de3f27522865585bb6179b9e3a60658f914c6707df744fe11ef043ea6dff0883ac66b870cfef73ae55

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar83B6.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\V9nTU0UPEK.bat

Filesize
213B

MD5
9cce35e21fc48a4a983bb86d520d23ab

SHA1
570ded0d3060b03cff61d174f9ef3dfdddf79b05

SHA256
f5a8663ee03ced5c61cb44e435f982b11801134b40ce2f746805009ae6948867

SHA512
d0dcd737e03b558134e5ab0287be9b1a3c1111df30cb8a9960ad4012b4ec975e4de4398ada23161a6a7e60d1d42d96b1ba0d9135439375e34c7203c49573bd4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\XY5uHg6WI2.bat

Filesize
213B

MD5
ad484b7ed0530ed0351687a85a691bf2

SHA1
9aa511714131ca04e1abbd34443d35292a12901c

SHA256
96b762ca4aca4cf64107b9c9f30906d258ae82fc3b1c82ddd3bc967c21bb81c3

SHA512
b7fc5a2e466f894b7e72f313190086aee24535bf6ba170b5310a1eba67fe3c717b38f92be270524e3c9880c17bc87591254cac0a252d82cb7e28e21768a85090

Download Submit
C:\Users\Admin\AppData\Local\Temp\ZmgdUlucqh.bat

Filesize
213B

MD5
af36fae7294ede396b2b6544f5259588

SHA1
5a7aa29f8f0d9b7cb6ea60568884eff29de03ac6

SHA256
abfa89bfa9960f7f4e730ae1e39df9418f1ca12e31d7acace64d54f1ddfedf2f

SHA512
8c0d69eefdc7608c90a35b13d1655a9d89d5dc538596bd3ae241b59e3fc1976a4cbf3801bcb9e9e055d39543a3a18503cfdad6ec87da7e610289060c6c48906c

Download Submit
C:\Users\Admin\AppData\Local\Temp\grdey4A1QM.bat

Filesize
213B

MD5
8f2bfc8bfb8a62385442b390c669f54e

SHA1
6271dc9e96f331ec68d8e825241674db52ff1814

SHA256
e5e6917ed7e7675777f1aa963b17e475b2e5f4e555b5c4cc5b09397ef58553ef

SHA512
d832b87afbdf4c5658fab96b0b42e28c38131872e531118a6f7ac624a37d20f92e64f7584eb309d9ae09b2c6bb291ff0d3a28c9debd165219690d19e9fde00e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\jaxwQXfGLd.bat

Filesize
213B

MD5
c0447e74723332b8cdb5a81705bce100

SHA1
cc43607d6a90c7affc0ded748edbef5bb3384091

SHA256
7b21481216cb74879b564381373cfa1389e4cf67b3f1c58b8f15064c20c746bc

SHA512
5167d4a6c38d3730cf37179646c98f24e21b9aa10cc97a7c332db02630110f755229405d5f5ee16f59b05590b12da026981c78aff4e6848f345c77a19651fe45

Download Submit
C:\Users\Admin\AppData\Local\Temp\lHuJ4aKJis.bat

Filesize
213B

MD5
75715ebaa600c63d04968a612fa73a74

SHA1
9b861548e1f65ec96269a3e08ca5296c795494e5

SHA256
c95a831560ef7aa2ec049e6a4d56c257080d40dfe298cc0ef71b5861f0f2d445

SHA512
3559b325118eb8967abf1672a9a5716d9e4d70198b37c88f3566e56d1cb6ee9838a283a8d1a4b1d6bc987ab1dd92ec5b977be839cfe5e5a64f0f36a9d3c8b899

Download Submit
C:\Users\Admin\AppData\Local\Temp\oqEnL4f5pl.bat

Filesize
213B

MD5
dbd71268263cf78eb2cef3837b4bf575

SHA1
1c302df2cd6063810be08dd5452b828dccbc7b9d

SHA256
e59d98386a80262dc674c107da3fc9e64bebf9b94454f181e8cdc92d4401b696

SHA512
c7b4450b1315422db0e0ceee0ecb97e48d30e5da8a96f32a268191fa744f6ba3c8a3993f6cd0e28f4ccdaa47c051836c5edc3afa51923d228791331c8a126721

Download Submit
C:\Users\Admin\AppData\Local\Temp\xZLz5Ote6t.bat

Filesize
213B

MD5
4983812767763f6d37a31fc59199025d

SHA1
8c26c8997a9f5356984d565c8ef9471eb3b4dafb

SHA256
f70e4b468cec568b365e9ecd53c39cb08e44af2bafff598b48a6f45260db2bd4

SHA512
3ca944ce5b08e8bfe06aeabfd914b6751e4f831dcf84235b27570465fdf6a4fb13992d6da24f0470781dac8d4c89802de0e165a48c8df34450a9e760add33c72

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
9d69628c8492b8acfa024796f966857a

SHA1
c700f786dd5805a755dba5bf5f11d1740dc0af9b

SHA256
34494970f031491b23d394bb2162ece944dfc94baeb342cb8f6e450f0240022a

SHA512
6e7527c19dd7e9566faafc49d43ddd6646cb848554a6be0ba7a2726cbbd1c45a734b907b9baaa1b66ae473d616c67fd6324b46ef04911ad34bce83b2da2ee49d

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/1712-141-0x0000000000EE0000-0x0000000000FF0000-memory.dmp

Filesize
1.1MB

Download
memory/2112-38-0x00000000026D0000-0x00000000026D8000-memory.dmp

Filesize
32KB

Download
memory/2112-37-0x000000001B750000-0x000000001BA32000-memory.dmp

Filesize
2.9MB

Download
memory/2200-15-0x00000000003D0000-0x00000000003DC000-memory.dmp

Filesize
48KB

Download
memory/2200-13-0x0000000000D30000-0x0000000000E40000-memory.dmp

Filesize
1.1MB

Download
memory/2200-14-0x00000000003C0000-0x00000000003D2000-memory.dmp

Filesize
72KB

Download
memory/2200-16-0x00000000003E0000-0x00000000003EC000-memory.dmp

Filesize
48KB

Download
memory/2200-17-0x00000000003F0000-0x00000000003FC000-memory.dmp

Filesize
48KB

Download
memory/2356-318-0x0000000001350000-0x0000000001460000-memory.dmp

Filesize
1.1MB

Download
memory/2512-91-0x000000001B5D0000-0x000000001B8B2000-memory.dmp

Filesize
2.9MB

Download
memory/2512-92-0x0000000001EF0000-0x0000000001EF8000-memory.dmp

Filesize
32KB

Download
memory/2704-673-0x0000000000120000-0x0000000000230000-memory.dmp

Filesize
1.1MB

Download
memory/3048-733-0x0000000000260000-0x0000000000370000-memory.dmp

Filesize
1.1MB

Download