dcrat | 1b80863be5527840c7421df1b931f12204b587a9a59600a1f4c44985f395ee81

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22-12-2024 08:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_1b80863be5527840c7421df1b931f12204b587a9a59600a1f4c44985f395ee81.exe
Size

1.3MB
MD5

ef2d84293582ab9fe44dd725612367ce
SHA1

6b928e8f8bfe708e19d60b27a12d7ff33b4d8c89
SHA256

1b80863be5527840c7421df1b931f12204b587a9a59600a1f4c44985f395ee81
SHA512

28141311608214f674e6a31eb10f0ccaafe4a0a29ed52563d342a4007726e5eba4ea75c2136f03d98df99432941c288922919cc873074a8634b84c9059fe16b0
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 45 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2320	2428	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2464	2428	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2916	2428	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1824	2428	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2628	2428	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2768	2428	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2864	2428	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2956	2428	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1492	2428	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1904	2428	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1268	2428	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	832	2428	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1616	2428	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1888	2428	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	956	2428	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2164	2428	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1052	2428	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1648	2428	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1060	2428	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2392	2428	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1868	2428	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2176	2428	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2992	2428	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2088	2428	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2108	2428	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3048	2428	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2748	2428	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2704	2428	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1084	2428	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1708	2428	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2472	2428	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	680	2428	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1748	2428	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1532	2428	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1388	2428	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	340	2428	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	380	2428	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	900	2428	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1764	2428	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2848	2428	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	840	2428	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2852	2428	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1712	2428	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2248	2428	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2128	2428	schtasks.exe	33

DCRat payload 5 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x00080000000174a6-12.dat	dcrat
behavioral1/memory/2980-13-0x0000000000C80000-0x0000000000D90000-memory.dmp	dcrat
behavioral1/memory/2536-54-0x0000000001030000-0x0000000001140000-memory.dmp	dcrat
behavioral1/memory/2992-313-0x0000000001320000-0x0000000001430000-memory.dmp	dcrat
behavioral1/memory/2908-727-0x0000000001340000-0x0000000001450000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 16 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2272	powershell.exe
2172	powershell.exe
2920	powershell.exe
2376	powershell.exe
2036	powershell.exe
1264	powershell.exe
2204	powershell.exe
2856	powershell.exe
2212	powershell.exe
1572	powershell.exe
1716	powershell.exe
2868	powershell.exe
2940	powershell.exe
3024	powershell.exe
2352	powershell.exe
1744	powershell.exe

Executes dropped EXE 12 IoCs

pid	Process
2980	DllCommonsvc.exe
2536	taskhost.exe
2268	taskhost.exe
2832	taskhost.exe
2992	taskhost.exe
1324	taskhost.exe
2108	taskhost.exe
2772	taskhost.exe
2996	taskhost.exe
1716	taskhost.exe
1816	taskhost.exe
2908	taskhost.exe

Loads dropped DLL 2 IoCs

pid	Process
2632	cmd.exe
2632	cmd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 11 IoCs

Web Service

T1102

flow	ioc
32	raw.githubusercontent.com
36	raw.githubusercontent.com
4	raw.githubusercontent.com
29	raw.githubusercontent.com
12	raw.githubusercontent.com
16	raw.githubusercontent.com
19	raw.githubusercontent.com
22	raw.githubusercontent.com
25	raw.githubusercontent.com
5	raw.githubusercontent.com
9	raw.githubusercontent.com

Drops file in Program Files directory 13 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\Lang\886983d96e3d3e	DllCommonsvc.exe
File created	C:\Program Files\Windows Portable Devices\explorer.exe	DllCommonsvc.exe
File created	C:\Program Files\Java\jre7\bin\dtplugin\conhost.exe	DllCommonsvc.exe
File created	C:\Program Files\Java\jre7\bin\dtplugin\088424020bedd6	DllCommonsvc.exe
File created	C:\Program Files\VideoLAN\VLC\lua\sd\ebf1f9fa8afd6d	DllCommonsvc.exe
File created	C:\Program Files\Mozilla Firefox\fonts\conhost.exe	DllCommonsvc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\fonts\conhost.exe	DllCommonsvc.exe
File created	C:\Program Files\Mozilla Firefox\fonts\088424020bedd6	DllCommonsvc.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\taskhost.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\b75386f1303e64	DllCommonsvc.exe
File created	C:\Program Files\7-Zip\Lang\csrss.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Portable Devices\7a0fd90576e088	DllCommonsvc.exe
File created	C:\Program Files\VideoLAN\VLC\lua\sd\cmd.exe	DllCommonsvc.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\es-ES\cmd.exe	DllCommonsvc.exe
File created	C:\Windows\es-ES\ebf1f9fa8afd6d	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_1b80863be5527840c7421df1b931f12204b587a9a59600a1f4c44985f395ee81.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 45 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2864	schtasks.exe
1492	schtasks.exe
2176	schtasks.exe
900	schtasks.exe
2628	schtasks.exe
2088	schtasks.exe
840	schtasks.exe
2768	schtasks.exe
1616	schtasks.exe
956	schtasks.exe
2704	schtasks.exe
1708	schtasks.exe
1532	schtasks.exe
1764	schtasks.exe
1268	schtasks.exe
2164	schtasks.exe
1868	schtasks.exe
2108	schtasks.exe
2848	schtasks.exe
2852	schtasks.exe
2464	schtasks.exe
832	schtasks.exe
1888	schtasks.exe
1648	schtasks.exe
2992	schtasks.exe
2472	schtasks.exe
680	schtasks.exe
2320	schtasks.exe
1052	schtasks.exe
2392	schtasks.exe
2248	schtasks.exe
2916	schtasks.exe
1824	schtasks.exe
3048	schtasks.exe
2748	schtasks.exe
1712	schtasks.exe
380	schtasks.exe
2956	schtasks.exe
1904	schtasks.exe
1060	schtasks.exe
1084	schtasks.exe
1748	schtasks.exe
1388	schtasks.exe
340	schtasks.exe
2128	schtasks.exe

Suspicious behavior: EnumeratesProcesses 38 IoCs

pid	Process
2980	DllCommonsvc.exe
2980	DllCommonsvc.exe
2980	DllCommonsvc.exe
2980	DllCommonsvc.exe
2980	DllCommonsvc.exe
2980	DllCommonsvc.exe
2980	DllCommonsvc.exe
2980	DllCommonsvc.exe
2980	DllCommonsvc.exe
2980	DllCommonsvc.exe
2980	DllCommonsvc.exe
2352	powershell.exe
2172	powershell.exe
2204	powershell.exe
1264	powershell.exe
1744	powershell.exe
1716	powershell.exe
2212	powershell.exe
3024	powershell.exe
2920	powershell.exe
2856	powershell.exe
2036	powershell.exe
2536	taskhost.exe
1572	powershell.exe
2376	powershell.exe
2868	powershell.exe
2272	powershell.exe
2940	powershell.exe
2268	taskhost.exe
2832	taskhost.exe
2992	taskhost.exe
1324	taskhost.exe
2108	taskhost.exe
2772	taskhost.exe
2996	taskhost.exe
1716	taskhost.exe
1816	taskhost.exe
2908	taskhost.exe

Suspicious use of AdjustPrivilegeToken 28 IoCs

description	pid	Process
Token: SeDebugPrivilege	2980	DllCommonsvc.exe
Token: SeDebugPrivilege	2352	powershell.exe
Token: SeDebugPrivilege	2172	powershell.exe
Token: SeDebugPrivilege	2536	taskhost.exe
Token: SeDebugPrivilege	2204	powershell.exe
Token: SeDebugPrivilege	1264	powershell.exe
Token: SeDebugPrivilege	1744	powershell.exe
Token: SeDebugPrivilege	1716	powershell.exe
Token: SeDebugPrivilege	2212	powershell.exe
Token: SeDebugPrivilege	3024	powershell.exe
Token: SeDebugPrivilege	2920	powershell.exe
Token: SeDebugPrivilege	2856	powershell.exe
Token: SeDebugPrivilege	2036	powershell.exe
Token: SeDebugPrivilege	1572	powershell.exe
Token: SeDebugPrivilege	2376	powershell.exe
Token: SeDebugPrivilege	2868	powershell.exe
Token: SeDebugPrivilege	2272	powershell.exe
Token: SeDebugPrivilege	2940	powershell.exe
Token: SeDebugPrivilege	2268	taskhost.exe
Token: SeDebugPrivilege	2832	taskhost.exe
Token: SeDebugPrivilege	2992	taskhost.exe
Token: SeDebugPrivilege	1324	taskhost.exe
Token: SeDebugPrivilege	2108	taskhost.exe
Token: SeDebugPrivilege	2772	taskhost.exe
Token: SeDebugPrivilege	2996	taskhost.exe
Token: SeDebugPrivilege	1716	taskhost.exe
Token: SeDebugPrivilege	1816	taskhost.exe
Token: SeDebugPrivilege	2908	taskhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1780 wrote to memory of 2668	1780	JaffaCakes118_1b80863be5527840c7421df1b931f12204b587a9a59600a1f4c44985f395ee81.exe	29
PID 1780 wrote to memory of 2668	1780	JaffaCakes118_1b80863be5527840c7421df1b931f12204b587a9a59600a1f4c44985f395ee81.exe	29
PID 1780 wrote to memory of 2668	1780	JaffaCakes118_1b80863be5527840c7421df1b931f12204b587a9a59600a1f4c44985f395ee81.exe	29
PID 1780 wrote to memory of 2668	1780	JaffaCakes118_1b80863be5527840c7421df1b931f12204b587a9a59600a1f4c44985f395ee81.exe	29
PID 2668 wrote to memory of 2632	2668	WScript.exe	30
PID 2668 wrote to memory of 2632	2668	WScript.exe	30
PID 2668 wrote to memory of 2632	2668	WScript.exe	30
PID 2668 wrote to memory of 2632	2668	WScript.exe	30
PID 2632 wrote to memory of 2980	2632	cmd.exe	32
PID 2632 wrote to memory of 2980	2632	cmd.exe	32
PID 2632 wrote to memory of 2980	2632	cmd.exe	32
PID 2632 wrote to memory of 2980	2632	cmd.exe	32
PID 2980 wrote to memory of 2212	2980	DllCommonsvc.exe	79
PID 2980 wrote to memory of 2212	2980	DllCommonsvc.exe	79
PID 2980 wrote to memory of 2212	2980	DllCommonsvc.exe	79
PID 2980 wrote to memory of 1264	2980	DllCommonsvc.exe	80
PID 2980 wrote to memory of 1264	2980	DllCommonsvc.exe	80
PID 2980 wrote to memory of 1264	2980	DllCommonsvc.exe	80
PID 2980 wrote to memory of 2272	2980	DllCommonsvc.exe	81
PID 2980 wrote to memory of 2272	2980	DllCommonsvc.exe	81
PID 2980 wrote to memory of 2272	2980	DllCommonsvc.exe	81
PID 2980 wrote to memory of 3024	2980	DllCommonsvc.exe	82
PID 2980 wrote to memory of 3024	2980	DllCommonsvc.exe	82
PID 2980 wrote to memory of 3024	2980	DllCommonsvc.exe	82
PID 2980 wrote to memory of 2172	2980	DllCommonsvc.exe	83
PID 2980 wrote to memory of 2172	2980	DllCommonsvc.exe	83
PID 2980 wrote to memory of 2172	2980	DllCommonsvc.exe	83
PID 2980 wrote to memory of 1744	2980	DllCommonsvc.exe	84
PID 2980 wrote to memory of 1744	2980	DllCommonsvc.exe	84
PID 2980 wrote to memory of 1744	2980	DllCommonsvc.exe	84
PID 2980 wrote to memory of 1572	2980	DllCommonsvc.exe	85
PID 2980 wrote to memory of 1572	2980	DllCommonsvc.exe	85
PID 2980 wrote to memory of 1572	2980	DllCommonsvc.exe	85
PID 2980 wrote to memory of 1716	2980	DllCommonsvc.exe	86
PID 2980 wrote to memory of 1716	2980	DllCommonsvc.exe	86
PID 2980 wrote to memory of 1716	2980	DllCommonsvc.exe	86
PID 2980 wrote to memory of 2920	2980	DllCommonsvc.exe	87
PID 2980 wrote to memory of 2920	2980	DllCommonsvc.exe	87
PID 2980 wrote to memory of 2920	2980	DllCommonsvc.exe	87
PID 2980 wrote to memory of 2868	2980	DllCommonsvc.exe	88
PID 2980 wrote to memory of 2868	2980	DllCommonsvc.exe	88
PID 2980 wrote to memory of 2868	2980	DllCommonsvc.exe	88
PID 2980 wrote to memory of 2940	2980	DllCommonsvc.exe	89
PID 2980 wrote to memory of 2940	2980	DllCommonsvc.exe	89
PID 2980 wrote to memory of 2940	2980	DllCommonsvc.exe	89
PID 2980 wrote to memory of 2204	2980	DllCommonsvc.exe	90
PID 2980 wrote to memory of 2204	2980	DllCommonsvc.exe	90
PID 2980 wrote to memory of 2204	2980	DllCommonsvc.exe	90
PID 2980 wrote to memory of 2856	2980	DllCommonsvc.exe	91
PID 2980 wrote to memory of 2856	2980	DllCommonsvc.exe	91
PID 2980 wrote to memory of 2856	2980	DllCommonsvc.exe	91
PID 2980 wrote to memory of 2376	2980	DllCommonsvc.exe	92
PID 2980 wrote to memory of 2376	2980	DllCommonsvc.exe	92
PID 2980 wrote to memory of 2376	2980	DllCommonsvc.exe	92
PID 2980 wrote to memory of 2036	2980	DllCommonsvc.exe	93
PID 2980 wrote to memory of 2036	2980	DllCommonsvc.exe	93
PID 2980 wrote to memory of 2036	2980	DllCommonsvc.exe	93
PID 2980 wrote to memory of 2352	2980	DllCommonsvc.exe	94
PID 2980 wrote to memory of 2352	2980	DllCommonsvc.exe	94
PID 2980 wrote to memory of 2352	2980	DllCommonsvc.exe	94
PID 2980 wrote to memory of 2536	2980	DllCommonsvc.exe	111
PID 2980 wrote to memory of 2536	2980	DllCommonsvc.exe	111
PID 2980 wrote to memory of 2536	2980	DllCommonsvc.exe	111
PID 2536 wrote to memory of 296	2536	taskhost.exe	112

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1b80863be5527840c7421df1b931f12204b587a9a59600a1f4c44985f395ee81.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1b80863be5527840c7421df1b931f12204b587a9a59600a1f4c44985f395ee81.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1780
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2668
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2632
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2980
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2212
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Mozilla Firefox\fonts\conhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1264
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\spoolsv.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2272
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\7-Zip\Lang\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3024
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\es-ES\cmd.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2172
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\explorer.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1744
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1572
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Portable Devices\explorer.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1716
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Java\jre7\bin\dtplugin\conhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2920
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\sppsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2868
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2940
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\VideoLAN\VLC\lua\sd\cmd.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2204
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\services.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2856
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\taskhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2376
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\audiodg.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2036
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Mozilla Maintenance Service\logs\taskhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2352
    - - C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\taskhost.exe
        
        "C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\taskhost.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2536
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\moqrXfpsIj.bat"
        6⤵
        
        PID:296
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:604
        
        C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\taskhost.exe
        
        "C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\taskhost.exe"
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2268
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\o09MCfWrWU.bat"
        8⤵
        
        PID:2576
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:1588
        
        C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\taskhost.exe
        
        "C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\taskhost.exe"
        9⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2832
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\avPRQTW9Zy.bat"
        10⤵
        
        PID:1944
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:2496
        
        C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\taskhost.exe
        
        "C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\taskhost.exe"
        11⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2992
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\6Po3x2tXZG.bat"
        12⤵
        
        PID:1720
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:3060
        
        C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\taskhost.exe
        
        "C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\taskhost.exe"
        13⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1324
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\yJyIm7wr5G.bat"
        14⤵
        
        PID:2784
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        15⤵
        
        PID:2532
        
        C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\taskhost.exe
        
        "C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\taskhost.exe"
        15⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2108
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\SQTB2Yz9K3.bat"
        16⤵
        
        PID:2928
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        17⤵
        
        PID:1680
        
        C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\taskhost.exe
        
        "C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\taskhost.exe"
        17⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2772
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Gy1gqmGK9f.bat"
        18⤵
        
        PID:692
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        19⤵
        
        PID:2768
        
        C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\taskhost.exe
        
        "C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\taskhost.exe"
        19⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2996
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\YpMZYQImRp.bat"
        20⤵
        
        PID:1264
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        21⤵
        
        PID:2800
        
        C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\taskhost.exe
        
        "C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\taskhost.exe"
        21⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1716
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\HfroAScfQF.bat"
        22⤵
        
        PID:2816
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        23⤵
        
        PID:2036
        
        C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\taskhost.exe
        
        "C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\taskhost.exe"
        23⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1816
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\LkcfmFI5TJ.bat"
        24⤵
        
        PID:2008
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        25⤵
        
        PID:2932
        
        C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\taskhost.exe
        
        "C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\taskhost.exe"
        25⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 5 /tr "'C:\Program Files\Mozilla Firefox\fonts\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\fonts\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 7 /tr "'C:\Program Files\Mozilla Firefox\fonts\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 9 /tr "'C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 11 /tr "'C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Program Files\7-Zip\Lang\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\7-Zip\Lang\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Program Files\7-Zip\Lang\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 12 /tr "'C:\Windows\es-ES\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Windows\es-ES\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 5 /tr "'C:\Windows\es-ES\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\MSOCache\All Users\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\providercommon\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2164

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\providercommon\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\providercommon\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Portable Devices\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Portable Devices\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 10 /tr "'C:\Program Files\Java\jre7\bin\dtplugin\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2176

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files\Java\jre7\bin\dtplugin\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 9 /tr "'C:\Program Files\Java\jre7\bin\dtplugin\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 10 /tr "'C:\providercommon\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\providercommon\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 13 /tr "'C:\providercommon\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 8 /tr "'C:\Program Files\VideoLAN\VLC\lua\sd\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\VLC\lua\sd\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 7 /tr "'C:\Program Files\VideoLAN\VLC\lua\sd\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 13 /tr "'C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 9 /tr "'C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 11 /tr "'C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 8 /tr "'C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
971673ab394c0339475d104cf808980f

SHA1
707059381a4223542373bb516ed2b9d1e922ef86

SHA256
3b60db3b0c8b9eed0a88f250a1ea8b7139647c9a4b64da81c7bdb40cb970c19c

SHA512
22dcc04f8e9d86b95bdb4abc752e12a3466cd8fdf341d51c294a765251669fbd38d09b1be1b1fdbca55ff760e1066d364b67108bacff9050a8cc2bdf6a143dce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d5a7d35a11f31ab1f7443d7d57d17208

SHA1
d2c6389caff4c8426e7c1d9355cc7cc7793d7aff

SHA256
24d3d409ba91379ec89e2cab532192c100679a84698e286e92b2687798ffb276

SHA512
bf4925f4566413918c089ec1aa241f76e03a51b15b75f288e6e3867486dd8731235c0809c8877c1a0b442b77651a65c832fe3f4bdcebaf0af0e51bfa7c6e71a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ee4292ba52eed29984ad96babdbd6364

SHA1
a6b6bd3fc274f8b906898781ea693518ea798aec

SHA256
2bb925b4ca8fb8022a00711bc87d3107c0cdcf9c4a855306248e6cef1f795ccc

SHA512
b04939d0a86ccb098216c1791a9c8228e63527f5c3ba8206068013fd01cf0be84c8be06f3ab7c400eded46a653b3e6d0ef60fafb7b56c0c41f49541541006099

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ca33ebf8b56ae3cbfe4a5b8a0b25b67c

SHA1
8818c3190f8cff7891be2e7cb7b53dce3f0fba68

SHA256
f8496fc8383754abd21f8a0ec0cdcc094bd16a8d97575581bbafc7dc97d252c2

SHA512
a67b837c415228ddefa44ad9a987dd8dc7509331cded9afef89a95be5136aff740dc45b76b7766d85b5e6945dca84518637215c83f7e30bacd5adccf95cbb8fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a1c19bdac1904015c495fda66e6d4836

SHA1
337535d6be3ee8ee63dd4b7c34f04a6870491756

SHA256
54825934c73c7cacb78d00672f7b13ea1f9e8935539a93168cddaf6586e1272d

SHA512
be5eba5cc78df51c893ede82e240de0b14616b327670acfd375e81fc36ef74a67e7f0906e5b304fbf0c31ce9d2a6b21e58d67f020f382ffc444408e001be0e15

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
267398aafc0d579221caf5b0eaf4e618

SHA1
eecd50104509c96062c12cb7fcd7c721aea72110

SHA256
f88625f7905db29cbc269ca893dcdc9bd2d5b431c181ad6e26bc61c2668f46aa

SHA512
d962a7d396ac72e5848e69f1e704768ea5b2fd10c9e7548806eed81b9871e9e791b140aedf0b00cf4a6fe9642efee21b083fd983f0d98d6f6e74bc9d3a7c0181

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3999aa54834c20a948c343148dfbaa18

SHA1
92517032c232ace4753e262caccdc1a09a224680

SHA256
2a38c1930874c22cbe574b48b218c71413852df139eafbc8698bc15b3c48ea81

SHA512
4f58f05944aa4d7a0cbb812278e60d9f8369a7e0f87c69bd07254f0f2a0edf09af69ef5515b24e310fa1ec2706d01d7216dfa9e9e93e1abcee4964b9ba2379f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f1610079e3329b4a4c6de61e7422e9f7

SHA1
9fed4bea5b45eada297b2e820f990203007e92fe

SHA256
998b0af112336ec5b0ad7fe9d897235f6e83df1786f758c525ae86bce298f180

SHA512
65e3dafd7b0e041901eff586afc76c94d53cd51872c36d26ab5caac2cbbe20ce6de266b98e934181bb4c47f00542cead3ca2777059739dc44b989d26d8bb4b0e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e42a5f23d3914f1614b80896553f097d

SHA1
4e270c4a420d18e2a34b34454da4e5a5dd662718

SHA256
b63178b1c724b6575861e646a2b38fcef10558e5935df1f23a5315e9c80dd17c

SHA512
89e030344c6e4639d7c5cddf99b1cd3f3793e4f8338d7c8585d820ccc2dd83f0360ea3c54da8cbbb43e8c0f0904f049b45ef590680b61276dbf86c5cc47eef61

Download Submit
C:\Users\Admin\AppData\Local\Temp\6Po3x2tXZG.bat

Filesize
240B

MD5
3642dd309d07315378b1981591132e4e

SHA1
e72ff02eb4ddd5b5ee61f9b32ffa6d817015ba82

SHA256
7e8d878e18579fd15790afb6030fcb3391d9d9f11ee9cbc457d6428dd0970f7b

SHA512
0920125ba3aa25cd032a62aa072df0a70527a380cc7dd6c0b6eab36fd8d70d20ade27d3a987a2cd19607b0ce0d36365dba11bfa8d2fb53c17629569726fb0576

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab34A9.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Gy1gqmGK9f.bat

Filesize
240B

MD5
425c14c71df1cf249bfbbf6e7abaaadb

SHA1
5e7f2c782a483e1ab2ee6095ef49d38a7586a831

SHA256
46760ed85ac4890110600b97926d6e6fa67ef0f521bbb37a4f49692de7b30adf

SHA512
2e20972f7a6bd72c0c069ff6f654b519444cc71d487a72b735978ab49dda3db49c9ee78199e61b4584789340ea1d2fc7eb33f96876b159ca7ee9f31c689746df

Download Submit
C:\Users\Admin\AppData\Local\Temp\HfroAScfQF.bat

Filesize
240B

MD5
2cbebec80dc667932feed7ed12daab7c

SHA1
dbe769f6934844f602a6ddd92edac43a05591b87

SHA256
c5cb8efe28b0326c5002f906ed861e58208e8e8ca0d3c35ff63620345dbc1006

SHA512
cbe87ba815f750edd19b026774e98790dd1c0b63112d7e86ae0caef982c48dd0b4f64446082e1411d18c1c87853a188450dee0ad2b2944817542b2f1233f710b

Download Submit
C:\Users\Admin\AppData\Local\Temp\LkcfmFI5TJ.bat

Filesize
240B

MD5
5501dd9f06d3a9ca10c0d81974bf4f72

SHA1
9c2213277e5363709c156b6fb6964c519d7f4fff

SHA256
2100fb76554519cfe7c2a58070c75db52fa6a7aa18a408acd4ce85bfaea3e0b3

SHA512
3362474ea1ef4a1d6d26a759a5f3da87e8b4c1090771cc485cbf0fc46f735d5a6e2085227a4dc28da7eedf5177130b556d14cc4f0083242bcb2373f8e9c285cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\SQTB2Yz9K3.bat

Filesize
240B

MD5
7c3b1e008f980695a3b77e40c3378d07

SHA1
892afebd49c274c38f9f00fd3e2e9e5420b3b4e1

SHA256
c84ef2b81fedf370fd95e27f9abf7a36fb972f42e0e739e5b16c4bcd1db4977f

SHA512
3d6c3f20b7494461987c7d3abe1fb6a324e6ce32479860cc6e6d46613965db817981e3a8fb052a654f28370d0a32cfc5930c854f5b288bbf284e281acc7ee1ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar34AC.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\YpMZYQImRp.bat

Filesize
240B

MD5
592dd66c211031afde776be6f1ab3938

SHA1
b42a4230114e3b61db9eaaf1f08f4eab5135860e

SHA256
d04041a2141dbd2fd0b520bb960e4146b44b6bf41fef9c1fa4d53e759af94e12

SHA512
a7de090d70eee6b0b1abca7019d683af2ae989bcd7cffd2f471f37b6cb831c1fd57f1b15e2344322c7723e040ed5923381433e33e6237321645884fe55c30527

Download Submit
C:\Users\Admin\AppData\Local\Temp\avPRQTW9Zy.bat

Filesize
240B

MD5
3ff2d51132210843ee11df4bc51793c1

SHA1
4601d5e47f25478b8ca332fda79fae2023e9dd61

SHA256
9a8a70bb503be540aed5fda2ea4d4bb78734137fa739ea91d35f3f425b3bd8f1

SHA512
2bd230b0faf737fb391e236c58f567a80cf75ae992c8491b6a15bdd9aaf05e7c472c7a44825645ce4e96b5efb4ef39aefe2573eeae6a489591c34b886fd68b58

Download Submit
C:\Users\Admin\AppData\Local\Temp\moqrXfpsIj.bat

Filesize
240B

MD5
f4713ed94ca6f5e000e4b33c03a06f3f

SHA1
5c99888ea4f1aa8d92290c8cf9a856fd854e61cf

SHA256
8c2eaecbcef5ed32cd8afe6f1564e8781750b7eeecc78f69aca2c1aada1f69db

SHA512
34c3a74fb9e70263170dfeb1285a28f6fadd3212eb7fcc1ab8bd6c23c0c709c47a806082c3a9f8e1613ba143579ce99d7c803c30fcf132d0a0f5316a1e30fc08

Download Submit
C:\Users\Admin\AppData\Local\Temp\o09MCfWrWU.bat

Filesize
240B

MD5
2e2445723f2722535d81adf1b803b94c

SHA1
8fbf92509aa8e9e0e76edc45d79a06a8072b9ac1

SHA256
c781c95c37f223563d65edda85f88bf3f85d34cf9bc7d7624260911e02d100ba

SHA512
2bdb85ea8ee3882127c1b5b04b7ad96e3427770c2c11d76b6557011315512beefdebca01cc2e4b798eaba07d97146b08dd6c844c4dc8d7064530915b9b3547d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\yJyIm7wr5G.bat

Filesize
240B

MD5
55cdb1050b92c1f3475b7609f4d00b81

SHA1
8e2a9d56d42d9c41cea4d72600768b86a6ad706c

SHA256
f1874f3afc6a31b91deefd0aaf13e4be347c24ac067ae868c864ad4829058ed7

SHA512
eab268dad158c86f2e1ec2c9c1218a61fc6390b5b3d0d1c6409125b47d6f011208d4f340005959128bcbef5185dbda527d1fae3f6b7861ddcb3d4ba53ef92835

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
e58677a9fb96dd2afcca9b6b83bb97d9

SHA1
c58d9b8dcf9418042797be832b3dd6374e4848b4

SHA256
fc94f713ef830c2572c75401e6d6e0417ed6fada5da58a98b3d389e2662ae58b

SHA512
a886d252815ef60d410eecee3fb6d625de3ac57261fef85e8d8965a87182aca102d1804976e74eb41835fe91c576aede654b5170c4f25346dc9d2b893cfdaadb

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/2212-100-0x000000001B760000-0x000000001BA42000-memory.dmp

Filesize
2.9MB

Download
memory/2352-70-0x0000000002890000-0x0000000002898000-memory.dmp

Filesize
32KB

Download
memory/2536-106-0x0000000000250000-0x0000000000262000-memory.dmp

Filesize
72KB

Download
memory/2536-54-0x0000000001030000-0x0000000001140000-memory.dmp

Filesize
1.1MB

Download
memory/2908-727-0x0000000001340000-0x0000000001450000-memory.dmp

Filesize
1.1MB

Download
memory/2980-13-0x0000000000C80000-0x0000000000D90000-memory.dmp

Filesize
1.1MB

Download
memory/2980-16-0x000000001AD70000-0x000000001AD7C000-memory.dmp

Filesize
48KB

Download
memory/2980-14-0x0000000000550000-0x0000000000562000-memory.dmp

Filesize
72KB

Download
memory/2980-15-0x00000000005F0000-0x00000000005FC000-memory.dmp

Filesize
48KB

Download
memory/2980-17-0x00000000005E0000-0x00000000005EC000-memory.dmp

Filesize
48KB

Download
memory/2992-313-0x0000000001320000-0x0000000001430000-memory.dmp

Filesize
1.1MB

Download