dcrat | 306d53da0f89b26e84964fb77f7b8e031852f35ead170a5be92248cf2e2e4696

Analysis

max time kernel
149s
max time network
154s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
22-12-2024 07:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_306d53da0f89b26e84964fb77f7b8e031852f35ead170a5be92248cf2e2e4696.exe
Size

1.3MB
MD5

4103d7a9ac0eac5c2f15da47961246d5
SHA1

36ddc6e2bbd1c4eedcb5dab0264d55b02658ff8a
SHA256

306d53da0f89b26e84964fb77f7b8e031852f35ead170a5be92248cf2e2e4696
SHA512

d4c123fc4b8c469e6beb19aef402d7dc7971d99a5b0c4d244e25b34e14c3f8dd2b851ce5d2cf87d8364fc6d8e0a188553ae5f130fd4745e0a3f2780fa617577c
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 42 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2732	2776	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2788	2776	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2616	2776	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2196	2776	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2304	2776	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1676	2776	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2808	2776	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2396	2776	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1580	2776	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2500	2776	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2320	2776	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2888	2776	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2176	2776	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2764	2776	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2972	2776	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2036	2776	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1312	2776	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	584	2776	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	800	2776	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1804	2776	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2232	2776	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2228	2776	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2908	2776	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2452	2776	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2404	2776	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2684	2776	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	976	2776	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	848	2776	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2168	2776	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1408	2776	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2516	2776	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	340	2776	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1636	2776	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1000	2776	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2564	2776	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1488	2776	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1668	2776	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1672	2776	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2476	2776	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1988	2776	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	924	2776	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2384	2776	schtasks.exe	33

DCRat payload 8 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0009000000018b05-11.dat	dcrat
behavioral1/memory/2992-13-0x0000000000150000-0x0000000000260000-memory.dmp	dcrat
behavioral1/memory/1668-129-0x0000000000E50000-0x0000000000F60000-memory.dmp	dcrat
behavioral1/memory/2252-247-0x00000000011F0000-0x0000000001300000-memory.dmp	dcrat
behavioral1/memory/2428-366-0x00000000013C0000-0x00000000014D0000-memory.dmp	dcrat
behavioral1/memory/2264-426-0x0000000000320000-0x0000000000430000-memory.dmp	dcrat
behavioral1/memory/2096-486-0x0000000000830000-0x0000000000940000-memory.dmp	dcrat
behavioral1/memory/1996-546-0x00000000012F0000-0x0000000001400000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 15 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1512	powershell.exe
2324	powershell.exe
1748	powershell.exe
2292	powershell.exe
2280	powershell.exe
2256	powershell.exe
1940	powershell.exe
1540	powershell.exe
1620	powershell.exe
932	powershell.exe
2388	powershell.exe
3008	powershell.exe
1132	powershell.exe
1780	powershell.exe
884	powershell.exe

Executes dropped EXE 11 IoCs

pid	Process
2992	DllCommonsvc.exe
1668	DllCommonsvc.exe
3028	DllCommonsvc.exe
2252	DllCommonsvc.exe
3020	DllCommonsvc.exe
2428	DllCommonsvc.exe
2264	DllCommonsvc.exe
2096	DllCommonsvc.exe
1996	DllCommonsvc.exe
2328	DllCommonsvc.exe
1124	DllCommonsvc.exe

Loads dropped DLL 2 IoCs

pid	Process
2980	cmd.exe
2980	cmd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 10 IoCs

Web Service

T1102

flow	ioc
5	raw.githubusercontent.com
27	raw.githubusercontent.com
13	raw.githubusercontent.com
16	raw.githubusercontent.com
20	raw.githubusercontent.com
24	raw.githubusercontent.com
31	raw.githubusercontent.com
34	raw.githubusercontent.com
4	raw.githubusercontent.com
9	raw.githubusercontent.com

Drops file in Program Files directory 15 IoCs

description	ioc	Process
File created	C:\Program Files\Mozilla Firefox\browser\features\a76d7bf15d8370	DllCommonsvc.exe
File created	C:\Program Files\Windows NT\1610b97d3ab4a7	DllCommonsvc.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Help\en_US\7a0fd90576e088	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Portable Devices\lsass.exe	DllCommonsvc.exe
File created	C:\Program Files\Mozilla Firefox\browser\features\DllCommonsvc.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Mail\services.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Mail\de-DE\WmiPrvSE.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Help\en_US\explorer.exe	DllCommonsvc.exe
File opened for modification	C:\Program Files (x86)\Windows Portable Devices\lsass.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Photo Viewer\de-DE\6cb0b6c459d5d3	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Portable Devices\6203df4a6bafc7	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Mail\c5b4cb5e9653cc	DllCommonsvc.exe
File created	C:\Program Files\Windows NT\OSPPSVC.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Photo Viewer\de-DE\dwm.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Mail\de-DE\24dbde2999530e	DllCommonsvc.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\ja-JP\DllCommonsvc.exe	DllCommonsvc.exe
File created	C:\Windows\ja-JP\a76d7bf15d8370	DllCommonsvc.exe
File created	C:\Windows\CSC\v2.0.6\explorer.exe	DllCommonsvc.exe
File created	C:\Windows\Registration\CRMLog\smss.exe	DllCommonsvc.exe
File created	C:\Windows\Registration\CRMLog\69ddcba757bf72	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_306d53da0f89b26e84964fb77f7b8e031852f35ead170a5be92248cf2e2e4696.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 42 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2500	schtasks.exe
2888	schtasks.exe
1408	schtasks.exe
1000	schtasks.exe
2168	schtasks.exe
1668	schtasks.exe
2788	schtasks.exe
2616	schtasks.exe
2232	schtasks.exe
2908	schtasks.exe
2176	schtasks.exe
2036	schtasks.exe
2228	schtasks.exe
1636	schtasks.exe
2564	schtasks.exe
2732	schtasks.exe
1804	schtasks.exe
2404	schtasks.exe
340	schtasks.exe
2384	schtasks.exe
2196	schtasks.exe
1676	schtasks.exe
2808	schtasks.exe
1988	schtasks.exe
584	schtasks.exe
2452	schtasks.exe
2476	schtasks.exe
2304	schtasks.exe
2320	schtasks.exe
2764	schtasks.exe
2972	schtasks.exe
2516	schtasks.exe
1488	schtasks.exe
1672	schtasks.exe
2396	schtasks.exe
1312	schtasks.exe
976	schtasks.exe
848	schtasks.exe
1580	schtasks.exe
800	schtasks.exe
2684	schtasks.exe
924	schtasks.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
2992	DllCommonsvc.exe
1620	powershell.exe
884	powershell.exe
2388	powershell.exe
1748	powershell.exe
1540	powershell.exe
2292	powershell.exe
1512	powershell.exe
3008	powershell.exe
2280	powershell.exe
2256	powershell.exe
1780	powershell.exe
1132	powershell.exe
2324	powershell.exe
1940	powershell.exe
932	powershell.exe
1668	DllCommonsvc.exe
3028	DllCommonsvc.exe
2252	DllCommonsvc.exe
3020	DllCommonsvc.exe
2428	DllCommonsvc.exe
2264	DllCommonsvc.exe
2096	DllCommonsvc.exe
1996	DllCommonsvc.exe
2328	DllCommonsvc.exe
1124	DllCommonsvc.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: SeDebugPrivilege	2992	DllCommonsvc.exe
Token: SeDebugPrivilege	1620	powershell.exe
Token: SeDebugPrivilege	884	powershell.exe
Token: SeDebugPrivilege	2388	powershell.exe
Token: SeDebugPrivilege	1748	powershell.exe
Token: SeDebugPrivilege	1540	powershell.exe
Token: SeDebugPrivilege	2292	powershell.exe
Token: SeDebugPrivilege	1512	powershell.exe
Token: SeDebugPrivilege	3008	powershell.exe
Token: SeDebugPrivilege	2280	powershell.exe
Token: SeDebugPrivilege	2256	powershell.exe
Token: SeDebugPrivilege	1780	powershell.exe
Token: SeDebugPrivilege	1132	powershell.exe
Token: SeDebugPrivilege	2324	powershell.exe
Token: SeDebugPrivilege	1940	powershell.exe
Token: SeDebugPrivilege	932	powershell.exe
Token: SeDebugPrivilege	1668	DllCommonsvc.exe
Token: SeDebugPrivilege	3028	DllCommonsvc.exe
Token: SeDebugPrivilege	2252	DllCommonsvc.exe
Token: SeDebugPrivilege	3020	DllCommonsvc.exe
Token: SeDebugPrivilege	2428	DllCommonsvc.exe
Token: SeDebugPrivilege	2264	DllCommonsvc.exe
Token: SeDebugPrivilege	2096	DllCommonsvc.exe
Token: SeDebugPrivilege	1996	DllCommonsvc.exe
Token: SeDebugPrivilege	2328	DllCommonsvc.exe
Token: SeDebugPrivilege	1124	DllCommonsvc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 840 wrote to memory of 2804	840	JaffaCakes118_306d53da0f89b26e84964fb77f7b8e031852f35ead170a5be92248cf2e2e4696.exe	29
PID 840 wrote to memory of 2804	840	JaffaCakes118_306d53da0f89b26e84964fb77f7b8e031852f35ead170a5be92248cf2e2e4696.exe	29
PID 840 wrote to memory of 2804	840	JaffaCakes118_306d53da0f89b26e84964fb77f7b8e031852f35ead170a5be92248cf2e2e4696.exe	29
PID 840 wrote to memory of 2804	840	JaffaCakes118_306d53da0f89b26e84964fb77f7b8e031852f35ead170a5be92248cf2e2e4696.exe	29
PID 2804 wrote to memory of 2980	2804	WScript.exe	30
PID 2804 wrote to memory of 2980	2804	WScript.exe	30
PID 2804 wrote to memory of 2980	2804	WScript.exe	30
PID 2804 wrote to memory of 2980	2804	WScript.exe	30
PID 2980 wrote to memory of 2992	2980	cmd.exe	32
PID 2980 wrote to memory of 2992	2980	cmd.exe	32
PID 2980 wrote to memory of 2992	2980	cmd.exe	32
PID 2980 wrote to memory of 2992	2980	cmd.exe	32
PID 2992 wrote to memory of 1780	2992	DllCommonsvc.exe	76
PID 2992 wrote to memory of 1780	2992	DllCommonsvc.exe	76
PID 2992 wrote to memory of 1780	2992	DllCommonsvc.exe	76
PID 2992 wrote to memory of 2292	2992	DllCommonsvc.exe	77
PID 2992 wrote to memory of 2292	2992	DllCommonsvc.exe	77
PID 2992 wrote to memory of 2292	2992	DllCommonsvc.exe	77
PID 2992 wrote to memory of 2280	2992	DllCommonsvc.exe	78
PID 2992 wrote to memory of 2280	2992	DllCommonsvc.exe	78
PID 2992 wrote to memory of 2280	2992	DllCommonsvc.exe	78
PID 2992 wrote to memory of 2324	2992	DllCommonsvc.exe	79
PID 2992 wrote to memory of 2324	2992	DllCommonsvc.exe	79
PID 2992 wrote to memory of 2324	2992	DllCommonsvc.exe	79
PID 2992 wrote to memory of 1512	2992	DllCommonsvc.exe	81
PID 2992 wrote to memory of 1512	2992	DllCommonsvc.exe	81
PID 2992 wrote to memory of 1512	2992	DllCommonsvc.exe	81
PID 2992 wrote to memory of 1940	2992	DllCommonsvc.exe	82
PID 2992 wrote to memory of 1940	2992	DllCommonsvc.exe	82
PID 2992 wrote to memory of 1940	2992	DllCommonsvc.exe	82
PID 2992 wrote to memory of 2256	2992	DllCommonsvc.exe	84
PID 2992 wrote to memory of 2256	2992	DllCommonsvc.exe	84
PID 2992 wrote to memory of 2256	2992	DllCommonsvc.exe	84
PID 2992 wrote to memory of 1748	2992	DllCommonsvc.exe	86
PID 2992 wrote to memory of 1748	2992	DllCommonsvc.exe	86
PID 2992 wrote to memory of 1748	2992	DllCommonsvc.exe	86
PID 2992 wrote to memory of 884	2992	DllCommonsvc.exe	87
PID 2992 wrote to memory of 884	2992	DllCommonsvc.exe	87
PID 2992 wrote to memory of 884	2992	DllCommonsvc.exe	87
PID 2992 wrote to memory of 1540	2992	DllCommonsvc.exe	88
PID 2992 wrote to memory of 1540	2992	DllCommonsvc.exe	88
PID 2992 wrote to memory of 1540	2992	DllCommonsvc.exe	88
PID 2992 wrote to memory of 1132	2992	DllCommonsvc.exe	89
PID 2992 wrote to memory of 1132	2992	DllCommonsvc.exe	89
PID 2992 wrote to memory of 1132	2992	DllCommonsvc.exe	89
PID 2992 wrote to memory of 1620	2992	DllCommonsvc.exe	90
PID 2992 wrote to memory of 1620	2992	DllCommonsvc.exe	90
PID 2992 wrote to memory of 1620	2992	DllCommonsvc.exe	90
PID 2992 wrote to memory of 932	2992	DllCommonsvc.exe	91
PID 2992 wrote to memory of 932	2992	DllCommonsvc.exe	91
PID 2992 wrote to memory of 932	2992	DllCommonsvc.exe	91
PID 2992 wrote to memory of 2388	2992	DllCommonsvc.exe	92
PID 2992 wrote to memory of 2388	2992	DllCommonsvc.exe	92
PID 2992 wrote to memory of 2388	2992	DllCommonsvc.exe	92
PID 2992 wrote to memory of 3008	2992	DllCommonsvc.exe	93
PID 2992 wrote to memory of 3008	2992	DllCommonsvc.exe	93
PID 2992 wrote to memory of 3008	2992	DllCommonsvc.exe	93
PID 2992 wrote to memory of 2872	2992	DllCommonsvc.exe	106
PID 2992 wrote to memory of 2872	2992	DllCommonsvc.exe	106
PID 2992 wrote to memory of 2872	2992	DllCommonsvc.exe	106
PID 2872 wrote to memory of 2096	2872	cmd.exe	108
PID 2872 wrote to memory of 2096	2872	cmd.exe	108
PID 2872 wrote to memory of 2096	2872	cmd.exe	108
PID 2872 wrote to memory of 1668	2872	cmd.exe	109

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_306d53da0f89b26e84964fb77f7b8e031852f35ead170a5be92248cf2e2e4696.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_306d53da0f89b26e84964fb77f7b8e031852f35ead170a5be92248cf2e2e4696.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:840
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2804
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2980
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2992
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1780
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Portable Devices\lsass.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2292
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Mozilla Firefox\browser\features\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2280
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Registration\CRMLog\smss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2324
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Favorites\dwm.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1512
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\sppsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1940
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\cmd.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2256
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Mail\services.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1748
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows NT\OSPPSVC.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:884
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Photo Viewer\de-DE\dwm.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1540
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Mail\de-DE\WmiPrvSE.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1132
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\ja-JP\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1620
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\conhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:932
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\wininit.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2388
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Common Files\Adobe\Help\en_US\explorer.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3008
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\x1kGixCDpk.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2872
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:2096
      - C:\Windows\ja-JP\DllCommonsvc.exe
        
        "C:\Windows\ja-JP\DllCommonsvc.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1668
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\yQDva2PSBr.bat"
        7⤵
        
        PID:2612
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:1988
        
        C:\Windows\ja-JP\DllCommonsvc.exe
        
        "C:\Windows\ja-JP\DllCommonsvc.exe"
        8⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3028
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\m47JVZSxDi.bat"
        9⤵
        
        PID:1540
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:2792
        
        C:\Windows\ja-JP\DllCommonsvc.exe
        
        "C:\Windows\ja-JP\DllCommonsvc.exe"
        10⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2252
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\j5VZ5DKdOS.bat"
        11⤵
        
        PID:2828
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:924
        
        C:\Windows\ja-JP\DllCommonsvc.exe
        
        "C:\Windows\ja-JP\DllCommonsvc.exe"
        12⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3020
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\bhowVEGEG8.bat"
        13⤵
        
        PID:3000
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        14⤵
        
        PID:2812
        
        C:\Windows\ja-JP\DllCommonsvc.exe
        
        "C:\Windows\ja-JP\DllCommonsvc.exe"
        14⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2428
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\wUBsuxMZs4.bat"
        15⤵
        
        PID:2332
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        16⤵
        
        PID:1516
        
        C:\Windows\ja-JP\DllCommonsvc.exe
        
        "C:\Windows\ja-JP\DllCommonsvc.exe"
        16⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2264
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\J97QZsi4Oz.bat"
        17⤵
        
        PID:2748
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        18⤵
        
        PID:456
        
        C:\Windows\ja-JP\DllCommonsvc.exe
        
        "C:\Windows\ja-JP\DllCommonsvc.exe"
        18⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2096
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\xghrCifyI9.bat"
        19⤵
        
        PID:612
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        20⤵
        
        PID:2728
        
        C:\Windows\ja-JP\DllCommonsvc.exe
        
        "C:\Windows\ja-JP\DllCommonsvc.exe"
        20⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1996
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\gJVLZ7RDs3.bat"
        21⤵
        
        PID:2480
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        22⤵
        
        PID:288
        
        C:\Windows\ja-JP\DllCommonsvc.exe
        
        "C:\Windows\ja-JP\DllCommonsvc.exe"
        22⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2328
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\QY0o5k1hVk.bat"
        23⤵
        
        PID:2392
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        24⤵
        
        PID:2056
        
        C:\Windows\ja-JP\DllCommonsvc.exe
        
        "C:\Windows\ja-JP\DllCommonsvc.exe"
        24⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1124

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Portable Devices\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2788

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Portable Devices\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 5 /tr "'C:\Program Files\Mozilla Firefox\browser\features\DllCommonsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2196

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\browser\features\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 6 /tr "'C:\Program Files\Mozilla Firefox\browser\features\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\Windows\Registration\CRMLog\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\Registration\CRMLog\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\Windows\Registration\CRMLog\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 6 /tr "'C:\Users\Public\Favorites\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2500

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Users\Public\Favorites\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 5 /tr "'C:\Users\Public\Favorites\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 11 /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2176

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1312

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Mail\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Mail\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2232

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows NT\OSPPSVC.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Program Files\Windows NT\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows NT\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2452

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Photo Viewer\de-DE\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\de-DE\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Photo Viewer\de-DE\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Mail\de-DE\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\de-DE\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2168

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Mail\de-DE\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 7 /tr "'C:\Windows\ja-JP\DllCommonsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\Windows\ja-JP\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 7 /tr "'C:\Windows\ja-JP\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 13 /tr "'C:\providercommon\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\providercommon\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 8 /tr "'C:\providercommon\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 8 /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 12 /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Common Files\Adobe\Help\en_US\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\Adobe\Help\en_US\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Common Files\Adobe\Help\en_US\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
51d4f65c1982ecbc7b15b8c0daa708b1

SHA1
4170cf371bf4756610ec50850f53951d74509e69

SHA256
75bcedb4caef093fae42b82574c84df076a04b66f30729ecf71b50badebcbb2f

SHA512
35374c01b79fcbfa2b2d3149c124a1b3d42503440ff4aa4a0e4631f9e84f1177d496cc4e487fee2cab6d072fa9f89f19500f28036c0c7c5602134fec593267f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
183640685baa6959c1dbf91d949abc7e

SHA1
8e72ade68722e4463e97aca93086e0b032edcf57

SHA256
21634746d39f5ecf6f99e6adbef7e7a3e3d2a94ca1290c4ccc8c28c9df3359b4

SHA512
d7cdf2c44c6b7f5d930a0290d89e4c1c6a6a8f3751d0ee399c2c50aac537bcdefe7ca2a0bcb1d40e0ee66175b94a08f290d83c0672d84ed071a8764dd7101371

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c695869a18a35c92cc2b8d2c4587cbc7

SHA1
38b9370a4df60147af7fedfaf571b6574a44eb9b

SHA256
f4362ce177643ab87ea97b356c81a3f1f7a6989977df7533c9d84efecaec44f7

SHA512
9f5add48a2b60739f3e0612b2fe44272784977dd5caa8a9bcca7bb4240700b6ccedc6d82ab4d57c40eb587293c091d1bb37dd7f70d48932b72184ee11f026c6b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a36d0ffe7b3e65e47090009406d8595d

SHA1
28ef67d8053e668711828da6e61be30a88ab7c83

SHA256
6ba367d884401198f89e2ca24fa9527179d3bc8022587859373beb4ab509c625

SHA512
b6c77642327d7152d735409ad38fa0b1130964ca54330905ab2874abdbc156ccd5c3b01e08bbb8ae7a73432ad92b16d8152f80b5845fec85b24672c83b13a306

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e4c4b060d51098964d56caa86f6f6bfa

SHA1
a5c6185e9e3db4e9d9610aa2d899e720a040c7f8

SHA256
f16baf9b1eae0f19130b4ede44476861c8e1b84a004ec2d6c60f6b730f1f8896

SHA512
2b084d08183217b6485755718257119b0b3cff43eea6e5aeac87afd33741052cd1e0c97c0a6e8d1bf661f2838c8fcdb573bf06ffb5a80992e3dbceea754788b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e00aba27e6a248496d264cc6ac2adbef

SHA1
fc417b013288c30f12bafdb585933b8e3685a308

SHA256
cb1ab025bf0bf5917a65e7d79272bdbbd1ebcd8a86aebe5ec9e9dd080d491159

SHA512
e98ede452b06fbb6280a50dc48a201c4fb76eefc4a178125d86ce9461d71f48d192dff1a5104e23357e32258f53b22264c5ac44b1068ef4db8125bd8415b5264

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
15709efdc91a33abc4d1ca0ad27872d4

SHA1
272b63519b6b3ce9f57fc657ec16a06352eafac6

SHA256
6fd5ae6bf6d382ccdb96dbee5dc7ec2bddd1b2547f36bfbf6a75f5ab9413ccb0

SHA512
d3754e436dba38cf8330aad222840719216aa1c2ef3376d62e0896c19181755127d107715d07b5f44d99c8a16d4de8d3791039490821561ba5d19c6a3ad9a2d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f7c597543a9eefbefbefb9dbf1b3ebb6

SHA1
61038e99011212984485c7af579b077e7c0f9e4c

SHA256
69ea3ee0cf7d5b50e34a51f9a6c78cc1af197ca8a13dded05c856133d48d6493

SHA512
e6bb929fa2e53f75e65b96d5bc04e2805ebeda04312ca4db92d7965179250040bf9e9ee6e44240eaaf717062addaf306e7aaf2b6702c52605681025ca6a935a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8642.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\J97QZsi4Oz.bat

Filesize
198B

MD5
bb6344847ee14ae84b7cf1777dec4c71

SHA1
871529cbd25abf88446cb86a0761997c235f15ae

SHA256
1c44ccfe30ff4dc48b3b78e7e2aa84b5c810bcb08c9f9b2c33a92a32c074b110

SHA512
f982cab153d4de96c2b7134c95705fcb37844af7d3541db485d3a13c94f83ff9544175c0d9c50b6461969031a1b6efe7d753dd301a1416a457c15f7b31685a0d

Download Submit
C:\Users\Admin\AppData\Local\Temp\QY0o5k1hVk.bat

Filesize
198B

MD5
3b84480832709f9530c6b8758a0449d6

SHA1
9ed53bcbc87c0c9e9f12dc01f89e4c545a5d9ecb

SHA256
3ff395591e62a5848cedee065d58ce5749bb167c70efc854698ec4550f1cd8c5

SHA512
107b052e58990649d91a7cbfa884e6b2c79d49801dfe6f42b19cdc18f4791c849cc0266558d6fa781ff31f7e6a912b654006ad4e824f21365a2bc4cbe34225ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8693.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\bhowVEGEG8.bat

Filesize
198B

MD5
ad3ee9cb0ed07176231cc71db2489f98

SHA1
b092a6f787e0aa223197090d4aa03e7b935bfa0b

SHA256
e682251c0de7e14bd8265796979b1b12cfb603e0cc35cd204170a65b67aa6787

SHA512
1dab0f437ecf4bd168e7419834931538907222d3b0da1a9c01abb8b38163e7d94fc086c6da8ff0131c23b14a9ff17bc700a2c1d9d2feb39f1b3c18991ebe7caf

Download Submit
C:\Users\Admin\AppData\Local\Temp\gJVLZ7RDs3.bat

Filesize
198B

MD5
ddc6786814039c1fe716610e0638f692

SHA1
eb8754c243cf0321c02b314f37975b5c14cdb90d

SHA256
313b175e8913861179a14e69fee44d002478eedd8c39b415a55e9bad30b904b4

SHA512
f5857b91f6788632d87b71442cf44cf69752fe3b457cd577f0ef38e6f9b1955222544e62b434dfc95c83f77b2484ee533272df1bf6163bb0fe8497e746478159

Download Submit
C:\Users\Admin\AppData\Local\Temp\j5VZ5DKdOS.bat

Filesize
198B

MD5
0be6f68be6043c22d6894fc65fbd3496

SHA1
756dc2aa1fbfebb44aae80713025e8628af06a81

SHA256
60f8a5f2774847d93d096f2b7766fc69612199a3fc4e466c15300c7398eb3012

SHA512
aef577219c49662ac805295baa07c73f8fc04260b01b0b3664aed7082058d09177771ba9642ffb4279d5b7fad620f89b1c5e08f5c3a7b800bb6bcbf14436c890

Download Submit
C:\Users\Admin\AppData\Local\Temp\m47JVZSxDi.bat

Filesize
198B

MD5
ba70ac6143e4e21f24e13a98b326d08c

SHA1
0013ff4eccb8157351ec0b949191cdfd7e9c9f3f

SHA256
2c39cd6cb5d36a369e768405f499c5bbac0dcbf2c42257141d5f95d8bcb54a0d

SHA512
ec3a42e56502365bd2189cf9c727754fa968844afa4021d82950956bc6af58ce20bf271bedc674b5f4b9e68ee35cfd73eda41cc245d48c03e5aeea53df25f936

Download Submit
C:\Users\Admin\AppData\Local\Temp\wUBsuxMZs4.bat

Filesize
198B

MD5
ef032f992c82c57ee82cb8b8e56bd085

SHA1
8528979085b084938dd5a6c52463bdccad6514c2

SHA256
6d68afd009a6e14cdba67c3274810f082b2f4914c0559de465e99bdb40ae05d8

SHA512
bf990e20f7e02706a00efb5a6cf1bdff6b98be985edd1de52282972617b603c2b8d8fa6c06636ce6c68d3887f70073750a8c0087fc63ca99cc8cc4bf1156c5a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\x1kGixCDpk.bat

Filesize
198B

MD5
516f3714a34fef9cd127a85885f0d126

SHA1
2298a342118fcf07331ca2d80cce4e26182045f0

SHA256
7fb1f5025504e397afab47560596f8d1334009d9a12a1324644c45a0e1d2581e

SHA512
d680ad54fb5f3f115690c7edcfdf2b3d925c157a01f89d8942ca77ef374fe37c54752c3a880ed27b7f00cfac2fb3fb30684a0565082c93c291e2a48b7c2fe466

Download Submit
C:\Users\Admin\AppData\Local\Temp\xghrCifyI9.bat

Filesize
198B

MD5
dca554160265901ec318f77576472ef4

SHA1
3710fc373a5c2980aef90b555520a775203a78e5

SHA256
27d4ddc27a9bdc0343afb6377382dc9bf9f7f5251ee0110ddcdd8ac1c52512a6

SHA512
6e6a539c81e46996cd2d8a1713154b196c39b149e42e65c632ddfef0d989b2f816984be42138f747af218584231bd7bc3b5aa92f52a88e7f7f85f01aa665c132

Download Submit
C:\Users\Admin\AppData\Local\Temp\yQDva2PSBr.bat

Filesize
198B

MD5
24eb68bc54db3adcda8e7e422752033d

SHA1
b84ac6743514a3f72121d7bd56bc30a3a496fba1

SHA256
7237ff0bf5c0fd341c9125edc9255237d937be63f2ac63cbc9601a7b7d5bf5d6

SHA512
27eb2b280b0903b699e3b8c84ed311133b4a109d19ac292512bad29e8854998084584355c08e5458a42ce2be284263fe2272db64bd1e6ff37934973bd4e3e249

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
020d80f3cbd32f6f81b257040171178f

SHA1
d4d3fb7817a8df114a547f7673a532afe4da8cd0

SHA256
3804384a9bdb89f2212a3df025bbc7219aedc895e3a31a5b02b93e07505920dc

SHA512
93bc1c49ce90e888bc1b4d66a34f2bb3b41a5408644c8eb569f7c9c098ba41da509bd9f792a2caaffc30db0244b7b66053cfc3048c6b6e89992504f934062294

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
memory/1124-666-0x0000000000140000-0x0000000000152000-memory.dmp

Filesize
72KB

Download
memory/1620-79-0x0000000002550000-0x0000000002558000-memory.dmp

Filesize
32KB

Download
memory/1668-129-0x0000000000E50000-0x0000000000F60000-memory.dmp

Filesize
1.1MB

Download
memory/1996-546-0x00000000012F0000-0x0000000001400000-memory.dmp

Filesize
1.1MB

Download
memory/2096-486-0x0000000000830000-0x0000000000940000-memory.dmp

Filesize
1.1MB

Download
memory/2252-247-0x00000000011F0000-0x0000000001300000-memory.dmp

Filesize
1.1MB

Download
memory/2264-426-0x0000000000320000-0x0000000000430000-memory.dmp

Filesize
1.1MB

Download
memory/2328-606-0x0000000000250000-0x0000000000262000-memory.dmp

Filesize
72KB

Download
memory/2388-60-0x000000001B2F0000-0x000000001B5D2000-memory.dmp

Filesize
2.9MB

Download
memory/2428-366-0x00000000013C0000-0x00000000014D0000-memory.dmp

Filesize
1.1MB

Download
memory/2992-17-0x0000000000670000-0x000000000067C000-memory.dmp

Filesize
48KB

Download
memory/2992-16-0x00000000005E0000-0x00000000005EC000-memory.dmp

Filesize
48KB

Download
memory/2992-15-0x0000000000550000-0x000000000055C000-memory.dmp

Filesize
48KB

Download
memory/2992-14-0x0000000000340000-0x0000000000352000-memory.dmp

Filesize
72KB

Download
memory/2992-13-0x0000000000150000-0x0000000000260000-memory.dmp

Filesize
1.1MB

Download