dcrat | 47aee639dab46878c5317caa4ed33137b955ad842adf765c73e4f2ad153cc39d

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
22-12-2024 06:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_47aee639dab46878c5317caa4ed33137b955ad842adf765c73e4f2ad153cc39d.exe
Size

1.3MB
MD5

b95986a4273ab031fe63f4338019befc
SHA1

52b7107faad6290f6cd291ac5cf4e33d65867939
SHA256

47aee639dab46878c5317caa4ed33137b955ad842adf765c73e4f2ad153cc39d
SHA512

1532219024a0ef7c8014c8b4a5c27c6d7fca194e073074ed6b37c0b8e6389d388628b3418c2cc6fb0fea5fc4ba276c3a27657faf428d3e0c29e918fcb82e45de
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 48 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2960	2680	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1656	2680	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2920	2680	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2720	2680	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2796	2680	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2348	2680	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1632	2680	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1784	2680	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2508	2680	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3028	2680	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1040	2680	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2712	2680	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3044	2680	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1348	2680	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2364	2680	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1576	2680	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2540	2680	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2160	2680	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	396	2680	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	320	2680	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1688	2680	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2076	2680	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2276	2680	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2152	2680	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2172	2680	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2492	2680	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2296	2680	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1336	2680	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2280	2680	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1844	2680	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1852	2680	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1776	2680	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2500	2680	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2064	2680	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2600	2680	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1432	2680	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1004	2680	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1924	2680	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1800	2680	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	700	2680	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2416	2680	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	532	2680	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2464	2680	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2564	2680	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2188	2680	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	896	2680	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2184	2680	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1536	2680	schtasks.exe	34

DCRat payload 7 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0007000000019820-9.dat	dcrat
behavioral1/memory/2832-13-0x0000000000BD0000-0x0000000000CE0000-memory.dmp	dcrat
behavioral1/memory/2428-80-0x0000000000820000-0x0000000000930000-memory.dmp	dcrat
behavioral1/memory/796-194-0x0000000000DD0000-0x0000000000EE0000-memory.dmp	dcrat
behavioral1/memory/1916-314-0x0000000001270000-0x0000000001380000-memory.dmp	dcrat
behavioral1/memory/3036-610-0x0000000001340000-0x0000000001450000-memory.dmp	dcrat
behavioral1/memory/3028-670-0x0000000001360000-0x0000000001470000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 17 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1652	powershell.exe
2816	powershell.exe
1212	powershell.exe
2552	powershell.exe
2912	powershell.exe
2380	powershell.exe
2200	powershell.exe
3036	powershell.exe
928	powershell.exe
756	powershell.exe
3008	powershell.exe
2228	powershell.exe
2104	powershell.exe
816	powershell.exe
1524	powershell.exe
2204	powershell.exe
1480	powershell.exe

Executes dropped EXE 11 IoCs

pid	Process
2832	DllCommonsvc.exe
2428	dllhost.exe
796	dllhost.exe
2592	dllhost.exe
1916	dllhost.exe
1664	dllhost.exe
2748	dllhost.exe
1520	dllhost.exe
2720	dllhost.exe
3036	dllhost.exe
3028	dllhost.exe

Loads dropped DLL 2 IoCs

pid	Process
1124	cmd.exe
1124	cmd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 11 IoCs

Web Service

T1102

flow	ioc
12	raw.githubusercontent.com
15	raw.githubusercontent.com
37	raw.githubusercontent.com
4	raw.githubusercontent.com
5	raw.githubusercontent.com
9	raw.githubusercontent.com
19	raw.githubusercontent.com
23	raw.githubusercontent.com
26	raw.githubusercontent.com
30	raw.githubusercontent.com
33	raw.githubusercontent.com

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Sidebar\it-IT\c5b4cb5e9653cc	DllCommonsvc.exe
File created	C:\Program Files\Uninstall Information\spoolsv.exe	DllCommonsvc.exe
File created	C:\Program Files\Uninstall Information\f3b6ecef712a24	DllCommonsvc.exe
File created	C:\Program Files\7-Zip\Lang\OSPPSVC.exe	DllCommonsvc.exe
File created	C:\Program Files\7-Zip\Lang\1610b97d3ab4a7	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Sidebar\it-IT\services.exe	DllCommonsvc.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Speech\Engines\Lexicon\088424020bedd6	DllCommonsvc.exe
File created	C:\Windows\de-DE\services.exe	DllCommonsvc.exe
File created	C:\Windows\de-DE\c5b4cb5e9653cc	DllCommonsvc.exe
File created	C:\Windows\Speech\Engines\Lexicon\conhost.exe	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_47aee639dab46878c5317caa4ed33137b955ad842adf765c73e4f2ad153cc39d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 48 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2712	schtasks.exe
2600	schtasks.exe
700	schtasks.exe
2720	schtasks.exe
2348	schtasks.exe
1040	schtasks.exe
2172	schtasks.exe
2492	schtasks.exe
1432	schtasks.exe
1004	schtasks.exe
2540	schtasks.exe
1688	schtasks.exe
2276	schtasks.exe
1852	schtasks.exe
2564	schtasks.exe
2184	schtasks.exe
2160	schtasks.exe
2296	schtasks.exe
1844	schtasks.exe
3044	schtasks.exe
2364	schtasks.exe
2500	schtasks.exe
2960	schtasks.exe
2920	schtasks.exe
1784	schtasks.exe
2464	schtasks.exe
896	schtasks.exe
1632	schtasks.exe
2076	schtasks.exe
1924	schtasks.exe
3028	schtasks.exe
2280	schtasks.exe
1776	schtasks.exe
1576	schtasks.exe
320	schtasks.exe
2416	schtasks.exe
532	schtasks.exe
2188	schtasks.exe
2796	schtasks.exe
2508	schtasks.exe
1348	schtasks.exe
1536	schtasks.exe
1336	schtasks.exe
2064	schtasks.exe
1800	schtasks.exe
1656	schtasks.exe
396	schtasks.exe
2152	schtasks.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
2832	DllCommonsvc.exe
928	powershell.exe
1524	powershell.exe
1212	powershell.exe
1652	powershell.exe
2428	dllhost.exe
2912	powershell.exe
2204	powershell.exe
3008	powershell.exe
2104	powershell.exe
3036	powershell.exe
2380	powershell.exe
2200	powershell.exe
2816	powershell.exe
756	powershell.exe
1480	powershell.exe
816	powershell.exe
2228	powershell.exe
2552	powershell.exe
796	dllhost.exe
2592	dllhost.exe
1916	dllhost.exe
1664	dllhost.exe
2748	dllhost.exe
1520	dllhost.exe
2720	dllhost.exe
3036	dllhost.exe
3028	dllhost.exe

Suspicious use of AdjustPrivilegeToken 28 IoCs

description	pid	Process
Token: SeDebugPrivilege	2832	DllCommonsvc.exe
Token: SeDebugPrivilege	928	powershell.exe
Token: SeDebugPrivilege	1524	powershell.exe
Token: SeDebugPrivilege	1212	powershell.exe
Token: SeDebugPrivilege	1652	powershell.exe
Token: SeDebugPrivilege	2428	dllhost.exe
Token: SeDebugPrivilege	2912	powershell.exe
Token: SeDebugPrivilege	2204	powershell.exe
Token: SeDebugPrivilege	3008	powershell.exe
Token: SeDebugPrivilege	2104	powershell.exe
Token: SeDebugPrivilege	3036	powershell.exe
Token: SeDebugPrivilege	2380	powershell.exe
Token: SeDebugPrivilege	2200	powershell.exe
Token: SeDebugPrivilege	2816	powershell.exe
Token: SeDebugPrivilege	756	powershell.exe
Token: SeDebugPrivilege	1480	powershell.exe
Token: SeDebugPrivilege	816	powershell.exe
Token: SeDebugPrivilege	2228	powershell.exe
Token: SeDebugPrivilege	2552	powershell.exe
Token: SeDebugPrivilege	796	dllhost.exe
Token: SeDebugPrivilege	2592	dllhost.exe
Token: SeDebugPrivilege	1916	dllhost.exe
Token: SeDebugPrivilege	1664	dllhost.exe
Token: SeDebugPrivilege	2748	dllhost.exe
Token: SeDebugPrivilege	1520	dllhost.exe
Token: SeDebugPrivilege	2720	dllhost.exe
Token: SeDebugPrivilege	3036	dllhost.exe
Token: SeDebugPrivilege	3028	dllhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 1640	2104	JaffaCakes118_47aee639dab46878c5317caa4ed33137b955ad842adf765c73e4f2ad153cc39d.exe	30
PID 2104 wrote to memory of 1640	2104	JaffaCakes118_47aee639dab46878c5317caa4ed33137b955ad842adf765c73e4f2ad153cc39d.exe	30
PID 2104 wrote to memory of 1640	2104	JaffaCakes118_47aee639dab46878c5317caa4ed33137b955ad842adf765c73e4f2ad153cc39d.exe	30
PID 2104 wrote to memory of 1640	2104	JaffaCakes118_47aee639dab46878c5317caa4ed33137b955ad842adf765c73e4f2ad153cc39d.exe	30
PID 1640 wrote to memory of 1124	1640	WScript.exe	31
PID 1640 wrote to memory of 1124	1640	WScript.exe	31
PID 1640 wrote to memory of 1124	1640	WScript.exe	31
PID 1640 wrote to memory of 1124	1640	WScript.exe	31
PID 1124 wrote to memory of 2832	1124	cmd.exe	33
PID 1124 wrote to memory of 2832	1124	cmd.exe	33
PID 1124 wrote to memory of 2832	1124	cmd.exe	33
PID 1124 wrote to memory of 2832	1124	cmd.exe	33
PID 2832 wrote to memory of 1524	2832	DllCommonsvc.exe	83
PID 2832 wrote to memory of 1524	2832	DllCommonsvc.exe	83
PID 2832 wrote to memory of 1524	2832	DllCommonsvc.exe	83
PID 2832 wrote to memory of 1480	2832	DllCommonsvc.exe	84
PID 2832 wrote to memory of 1480	2832	DllCommonsvc.exe	84
PID 2832 wrote to memory of 1480	2832	DllCommonsvc.exe	84
PID 2832 wrote to memory of 2204	2832	DllCommonsvc.exe	85
PID 2832 wrote to memory of 2204	2832	DllCommonsvc.exe	85
PID 2832 wrote to memory of 2204	2832	DllCommonsvc.exe	85
PID 2832 wrote to memory of 2200	2832	DllCommonsvc.exe	88
PID 2832 wrote to memory of 2200	2832	DllCommonsvc.exe	88
PID 2832 wrote to memory of 2200	2832	DllCommonsvc.exe	88
PID 2832 wrote to memory of 1652	2832	DllCommonsvc.exe	89
PID 2832 wrote to memory of 1652	2832	DllCommonsvc.exe	89
PID 2832 wrote to memory of 1652	2832	DllCommonsvc.exe	89
PID 2832 wrote to memory of 2104	2832	DllCommonsvc.exe	90
PID 2832 wrote to memory of 2104	2832	DllCommonsvc.exe	90
PID 2832 wrote to memory of 2104	2832	DllCommonsvc.exe	90
PID 2832 wrote to memory of 2380	2832	DllCommonsvc.exe	91
PID 2832 wrote to memory of 2380	2832	DllCommonsvc.exe	91
PID 2832 wrote to memory of 2380	2832	DllCommonsvc.exe	91
PID 2832 wrote to memory of 2912	2832	DllCommonsvc.exe	92
PID 2832 wrote to memory of 2912	2832	DllCommonsvc.exe	92
PID 2832 wrote to memory of 2912	2832	DllCommonsvc.exe	92
PID 2832 wrote to memory of 2228	2832	DllCommonsvc.exe	93
PID 2832 wrote to memory of 2228	2832	DllCommonsvc.exe	93
PID 2832 wrote to memory of 2228	2832	DllCommonsvc.exe	93
PID 2832 wrote to memory of 928	2832	DllCommonsvc.exe	94
PID 2832 wrote to memory of 928	2832	DllCommonsvc.exe	94
PID 2832 wrote to memory of 928	2832	DllCommonsvc.exe	94
PID 2832 wrote to memory of 2552	2832	DllCommonsvc.exe	95
PID 2832 wrote to memory of 2552	2832	DllCommonsvc.exe	95
PID 2832 wrote to memory of 2552	2832	DllCommonsvc.exe	95
PID 2832 wrote to memory of 1212	2832	DllCommonsvc.exe	96
PID 2832 wrote to memory of 1212	2832	DllCommonsvc.exe	96
PID 2832 wrote to memory of 1212	2832	DllCommonsvc.exe	96
PID 2832 wrote to memory of 2816	2832	DllCommonsvc.exe	97
PID 2832 wrote to memory of 2816	2832	DllCommonsvc.exe	97
PID 2832 wrote to memory of 2816	2832	DllCommonsvc.exe	97
PID 2832 wrote to memory of 3008	2832	DllCommonsvc.exe	98
PID 2832 wrote to memory of 3008	2832	DllCommonsvc.exe	98
PID 2832 wrote to memory of 3008	2832	DllCommonsvc.exe	98
PID 2832 wrote to memory of 756	2832	DllCommonsvc.exe	99
PID 2832 wrote to memory of 756	2832	DllCommonsvc.exe	99
PID 2832 wrote to memory of 756	2832	DllCommonsvc.exe	99
PID 2832 wrote to memory of 816	2832	DllCommonsvc.exe	113
PID 2832 wrote to memory of 816	2832	DllCommonsvc.exe	113
PID 2832 wrote to memory of 816	2832	DllCommonsvc.exe	113
PID 2832 wrote to memory of 3036	2832	DllCommonsvc.exe	114
PID 2832 wrote to memory of 3036	2832	DllCommonsvc.exe	114
PID 2832 wrote to memory of 3036	2832	DllCommonsvc.exe	114
PID 2832 wrote to memory of 2428	2832	DllCommonsvc.exe	117

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_47aee639dab46878c5317caa4ed33137b955ad842adf765c73e4f2ad153cc39d.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_47aee639dab46878c5317caa4ed33137b955ad842adf765c73e4f2ad153cc39d.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1640
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1124
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2832
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1524
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\WmiPrvSE.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1480
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\winlogon.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2204
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2200
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Sidebar\it-IT\services.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1652
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\conhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2104
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\de-DE\services.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2380
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Uninstall Information\spoolsv.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2912
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Speech\Engines\Lexicon\conhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2228
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\dllhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:928
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\spoolsv.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2552
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1212
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\dllhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2816
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\spoolsv.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3008
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Libraries\conhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:756
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\7-Zip\Lang\OSPPSVC.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:816
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\services.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3036
    - - C:\providercommon\dllhost.exe
        
        "C:\providercommon\dllhost.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2428
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\lZfwAG7KGX.bat"
        6⤵
        
        PID:2628
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:2996
        
        C:\providercommon\dllhost.exe
        
        "C:\providercommon\dllhost.exe"
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:796
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\qpvm5o68kg.bat"
        8⤵
        
        PID:2064
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:2076
        
        C:\providercommon\dllhost.exe
        
        "C:\providercommon\dllhost.exe"
        9⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2592
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\7hfvN6zFDa.bat"
        10⤵
        
        PID:1944
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:2524
        
        C:\providercommon\dllhost.exe
        
        "C:\providercommon\dllhost.exe"
        11⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1916
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\GsZYO5BIqk.bat"
        12⤵
        
        PID:2428
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:2216
        
        C:\providercommon\dllhost.exe
        
        "C:\providercommon\dllhost.exe"
        13⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1664
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\HAQQp9H1T4.bat"
        14⤵
        
        PID:2624
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        15⤵
        
        PID:1924
        
        C:\providercommon\dllhost.exe
        
        "C:\providercommon\dllhost.exe"
        15⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2748
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\IycQG8Pfyu.bat"
        16⤵
        
        PID:1800
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        17⤵
        
        PID:2932
        
        C:\providercommon\dllhost.exe
        
        "C:\providercommon\dllhost.exe"
        17⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1520
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\fBgHK1Vy37.bat"
        18⤵
        
        PID:1256
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        19⤵
        
        PID:432
        
        C:\providercommon\dllhost.exe
        
        "C:\providercommon\dllhost.exe"
        19⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2720
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\5bc4V3lt5Q.bat"
        20⤵
        
        PID:2136
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        21⤵
        
        PID:1116
        
        C:\providercommon\dllhost.exe
        
        "C:\providercommon\dllhost.exe"
        21⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3036
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Y23Kn3rQqK.bat"
        22⤵
        
        PID:2908
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        23⤵
        
        PID:1628
        
        C:\providercommon\dllhost.exe
        
        "C:\providercommon\dllhost.exe"
        23⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3028
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\x5nMQhEI33.bat"
        24⤵
        
        PID:1720
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        25⤵
        
        PID:2892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 10 /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 11 /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\providercommon\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\providercommon\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 11 /tr "'C:\providercommon\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\providercommon\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\providercommon\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\providercommon\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Sidebar\it-IT\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\it-IT\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Sidebar\it-IT\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 12 /tr "'C:\Users\Default User\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Users\Default User\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 9 /tr "'C:\Users\Default User\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2364

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 9 /tr "'C:\Windows\de-DE\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Windows\de-DE\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 7 /tr "'C:\Windows\de-DE\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2160

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 11 /tr "'C:\Program Files\Uninstall Information\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 7 /tr "'C:\Program Files\Uninstall Information\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\Windows\Speech\Engines\Lexicon\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Windows\Speech\Engines\Lexicon\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2276

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 11 /tr "'C:\Windows\Speech\Engines\Lexicon\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2152

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\providercommon\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2172

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\providercommon\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\providercommon\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2296

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 9 /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1336

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2280

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 6 /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\DllCommonsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 5 /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2500

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 11 /tr "'C:\Users\Public\Libraries\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Users\Public\Libraries\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 8 /tr "'C:\Users\Public\Libraries\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 12 /tr "'C:\Program Files\7-Zip\Lang\OSPPSVC.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Program Files\7-Zip\Lang\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 13 /tr "'C:\Program Files\7-Zip\Lang\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2188

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 11 /tr "'C:\providercommon\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:896

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\providercommon\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 8 /tr "'C:\providercommon\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
484cafd700235c85e1b9ed8858fca9dc

SHA1
3ae90e070ca0383b8206636cf506913cc7779fd7

SHA256
2d339dbf3e3777188b7c50cdbdefe02251bec27c0a14aeda57e555ebad2acd80

SHA512
32fb975a556df62cc341b209fe2fddaa994660347ae60c28f7449b78552dde1a50512230947bde494e6517a2b816eb4569b563df8f37dec01faca0ad94f2dcd3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
05a1b9d426808f0d308eee3183be7f77

SHA1
c612a643260f02381bbbbbb82f224adf9ef6b00e

SHA256
c9426214c2fa5903313a27ec27a07cf89aa5a1dc35ea329ce80e88fdd03bc2b9

SHA512
de82fc86acb7ff915a9d93a4da2162f0ad8ef88a49ebcad31a2c2659c712c2d05209387fb081bb717af630def66d13bb952ce31745149596db85cd36d3d050f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
000dc39ad4771d9f2d38892e8a1eaf34

SHA1
5b90613aac63a8f08cdfeccdf2dd242ac9faf6ce

SHA256
95f52896aea19563eba0cab796a1fe1a3d033d9a1defab4bd53875b3ba9932a7

SHA512
5e04eaa487035d29cb98397abc792d5b0ca0ca74cfa0bc1c92919c428fcba5b9fafecbf9ff27eed19ab5fab75bca5308226392f0dd1aef0e61601447ce06d8a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
35f287f796d885e034036a06d7fdaf56

SHA1
12f49e0d40c3a365e875a72c98cf07ad11f88d2a

SHA256
f48c86267414142221b469123304de90949a51bb11bc18d7240dc8702a79b208

SHA512
ff51166b3214481bb7ed19d20d9bbadbe0f1ba5218970041aef4e1aeda6e9754f079cfdb83a762cbe4ef7c1ba2cc302317c96b52675970db40b3ad98e9ddaf48

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3d73708af5113413ecdc426e7545b040

SHA1
dc008743f5a93635b1972fd491d0efc84e68356c

SHA256
b46863f938f142bc44f28337cdd2a668ee1c81115a77fea6041337bf07215358

SHA512
9cdf6274d935fa0042ecae991600821c100ec12c6809d21852a27683744c9a947dfe62b7ebbb993c7f6b939b371d1fc10c55f7f73ac9f418d5a766756869e7f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e2310d65c008216416770565ac6f6d29

SHA1
8fcbc7e9dee4e7694b318b31b8bc214a306befdb

SHA256
aa2ea3b6a61defafd19da0b64c500b2cb9e03c94597c4771b56bcd4b4530f196

SHA512
e8cb3ac217970c76a9ea450656440be97e09b7168a2413d12a675494629089b68acc053d0bb0162cd195ceb45982b9c3bd2904196e2cfb7d570430927e20da35

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7241533f7141c00e248acb8e6232c456

SHA1
30ecbd5e08c0d02907159707c341ac3e95f9ad1c

SHA256
217e4021fe75f07a34c8f6d0a7cc2ece3ed11adc914e9f65df7b40b8aa5c03d2

SHA512
d0ac653bb589335f4f7244ce36fb182edff1fabc97ab86a9567421f2f5243f66db88d80af33900271f5497385ac811e83f478377af5463859904aaefb308dd85

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bbb0b51c367ade3f1b55e564554d2933

SHA1
b3ff67f5badb6fe54a5d62d5822f66516c20ac6e

SHA256
59150c3096de110fdb628fce9d222844af0eaee1ec63a4396462212d54e5332e

SHA512
5845d2385864ce5824a8fb0063f2ca3c147ed9df158d04e9cb22c17313d14c238c04a35471f4d2a0cf1da5a105c4219d4028f763e459d276e81db8c94c228a60

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
21be22249505052dbec89b63e6c04ea4

SHA1
4bb20a69f5742c300b645d638af1ffbb6033c7a9

SHA256
2b3bfd69a7906046b9fce5709c51e231bf0266ab96b3d85feae3ad91b452b39c

SHA512
912d14d97c8d5e406e9fad901ba28a5fee05a96991216a0c8b865531cec6d3610e5e67d028757ceb3fd2efdf9d0abecffd196dae42e7cb2ca459e8617367c2e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\5bc4V3lt5Q.bat

Filesize
194B

MD5
dbe37c5be6b46ba48057347f18fba028

SHA1
9b1b9435a115aeda9d653ddae90a7a666358d57f

SHA256
cbaceceb543066c00f856e2f18f2052d8235366f3eccb7761a7b308999bd86ad

SHA512
c98ad30be1d958e28c3527a63366e4b836c09218959a2e8eb3980ca1fdd160f9c63a2b8796f5763f9ac835d6d4c7864505ded52e94ec793740edf4f57a32f327

Download Submit
C:\Users\Admin\AppData\Local\Temp\7hfvN6zFDa.bat

Filesize
194B

MD5
0480e3966268cb1d0396b80f36dadba3

SHA1
833dd20f7c8d01f5480b421f67abb01194920e46

SHA256
fc6aab6876e5c3ce90d191807edeac2cd8533e1a996655781f7e1ed24d2f48ec

SHA512
8814ea0d544690c1f2088edb2fe3df1c07b7d9d59466a6c1116f917ed43bf82c7300bbb591abf8174b65059e1570db5f406d899526d9eacdb03fbfc04c749ab6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab24C2.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\GsZYO5BIqk.bat

Filesize
194B

MD5
ad4da5e7f6f6f1120410b7ec1e678f8b

SHA1
11e15eb4ad007b63d982d6230bd3493d9bb59345

SHA256
7d152dd0f0fc67c9193420cbb0001c7f4faf8ce9d00dcd000a115bfc17cb037c

SHA512
8ac3ff9b9470b683e4979f643fd4d8613882a474b2bb3d1c26bc90a046e848cf5fda34ed81b5c321a05affb54beb2d08918540c906b907d4ef6570a837c386a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\HAQQp9H1T4.bat

Filesize
194B

MD5
2a2c6aab432587ccfd3451f4a20ef83b

SHA1
74a778004c2cbb2dc8cc746428177bf8815f21ba

SHA256
b8b54e1506315ef347a76f4f002412cc9b9cca7ddbc9fdb617e854813c63a979

SHA512
f332d31c7ddbb0a366bf0c206ce7978dcac46bd30a5ae30832cd868fb2fb6dd39ea3f9c5b229fb6c8419c6d4275f8dd558686b05045298880e13e9176bb8b1b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IycQG8Pfyu.bat

Filesize
194B

MD5
2f418c09abe9bf9ba53bdde3227d51d3

SHA1
fa213ba3c542024f813f75badbd4d66ad466d1ba

SHA256
74eca37e79e6056dcaabd1a272367bc413b136d30f52623af8b8f0dcbf4d2770

SHA512
948148e1c9ad6afef402835ae538080e44f3d51fb068193a20e1611b2f8ca1c87ca8750ec387452625f51b366a9db6cb2c9c5f46443a5aa1bbb941aedd9a4f05

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar25CE.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Y23Kn3rQqK.bat

Filesize
194B

MD5
a36d95748b2cbf51e26c7eb618dcb300

SHA1
2172ae2278818632413de4e2bd5722032aa1b22a

SHA256
d8b5b617b4f00834944285b788ffb510978cd3e5a6f4fae0039bc3fb3fe73523

SHA512
af24fc2258a03009d93cddc50aec27a89f88cf9e8c7da7d8376c4cfb8025ea76f659479dc7c532709bb481694be94161159cf3299bae0bbb558b6fb4bbb621f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\fBgHK1Vy37.bat

Filesize
194B

MD5
789374b4993023aa3b7db9d43b5ed677

SHA1
57a880c564c395154a23f9552b588fd3e9d66a58

SHA256
8b8d504d8417b11d2910059e4cfdc35c6c99a19288b8d8ce759fe9bc1546a33f

SHA512
add650997fd77c210bc896225f715ab720cab800b025cf54974e4f8190c9b13f13ac76fd4be2936c6f577181211981a71836d26fb8f7fa838638ef5e9f83fd1b

Download Submit
C:\Users\Admin\AppData\Local\Temp\lZfwAG7KGX.bat

Filesize
194B

MD5
d9f0a1b54668674aefabbe0d8fd27f50

SHA1
5f3d9fb078055e09c00e9ce25b113219ff0005ad

SHA256
1d242235b192631c53fbf92e6aed50a9112cb5b83d8f288783890ac2c253b73d

SHA512
e5420bba99db0121a580cda8c4d3b07dd636379beed20c037dfeab65e1a282b9849d83f785a21247d3b4eab9725632e767c2ef16847f418a5eaa68dc27bf688d

Download Submit
C:\Users\Admin\AppData\Local\Temp\qpvm5o68kg.bat

Filesize
194B

MD5
f2b028788b1dbdd99b21e4ca1dea82bb

SHA1
07677434733c14b261dd2e95b627882616f62d34

SHA256
9521a0e2e8e72c37286cfa8e8956270f88f454ccc124eb31d108d25de3f3c965

SHA512
d60458a0603037c97490580ca76f64f6ced15ea37a3c98bfdf30708e8b7173fbf9761dae8a385e3553c49b5fdd34b9769799f3f6b7b8000948f6e64ba2cd147a

Download Submit
C:\Users\Admin\AppData\Local\Temp\x5nMQhEI33.bat

Filesize
194B

MD5
c4e0b7704d6ca5f7bd82658018935c72

SHA1
a082b3c714526e7d369d74b154156ec04773847f

SHA256
8d3df8813461e012c0ff07ed14f465c48cee0e6caa56ac76b2fd0fc8fab1a4a6

SHA512
dfea86f8a7f7f968f8f936206dbdf8cd61c0cf0920453c64c162059f5a0892b2dc50aeab961a753a96fa438999b786c5903bd8acd81b1520127b832d90dc2e5e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
8a6af5fa8aa6c86396d0d7e90fb3d1c5

SHA1
173fbe1804647ade934b73565e7d57ea9bd7c9c6

SHA256
bac7380ba42f4c4c95fffffae27b63200addc2bcc145b42dec9d89496f0fd3cf

SHA512
eab25bdc16b571180a7dfdfe8408e5b42c437812d84e6bd581dc455aaf71a35b29a118eaab8cc73610cf36589af33a9ee0193f0c15eae95ee4912af84691b5f5

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
memory/796-195-0x00000000002C0000-0x00000000002D2000-memory.dmp

Filesize
72KB

Download
memory/796-194-0x0000000000DD0000-0x0000000000EE0000-memory.dmp

Filesize
1.1MB

Download
memory/928-79-0x0000000001E80000-0x0000000001E88000-memory.dmp

Filesize
32KB

Download
memory/928-73-0x000000001B240000-0x000000001B522000-memory.dmp

Filesize
2.9MB

Download
memory/1916-314-0x0000000001270000-0x0000000001380000-memory.dmp

Filesize
1.1MB

Download
memory/2428-80-0x0000000000820000-0x0000000000930000-memory.dmp

Filesize
1.1MB

Download
memory/2428-81-0x0000000000430000-0x0000000000442000-memory.dmp

Filesize
72KB

Download
memory/2832-17-0x0000000000470000-0x000000000047C000-memory.dmp

Filesize
48KB

Download
memory/2832-13-0x0000000000BD0000-0x0000000000CE0000-memory.dmp

Filesize
1.1MB

Download
memory/2832-14-0x00000000001C0000-0x00000000001D2000-memory.dmp

Filesize
72KB

Download
memory/2832-15-0x0000000000350000-0x000000000035C000-memory.dmp

Filesize
48KB

Download
memory/2832-16-0x0000000000340000-0x000000000034C000-memory.dmp

Filesize
48KB

Download
memory/3028-670-0x0000000001360000-0x0000000001470000-memory.dmp

Filesize
1.1MB

Download
memory/3028-671-0x0000000000340000-0x0000000000352000-memory.dmp

Filesize
72KB

Download
memory/3036-610-0x0000000001340000-0x0000000001450000-memory.dmp

Filesize
1.1MB

Download