dcrat | 8f454a072c53600324b5aba6730a123cea7883ad3ad7246deba60253d858e58c

Analysis

max time kernel
149s
max time network
153s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
22/12/2024, 08:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_8f454a072c53600324b5aba6730a123cea7883ad3ad7246deba60253d858e58c.exe
Size

1.3MB
MD5

95655ccd25fbec3f975fa42bb78a9aa3
SHA1

a559392860ef2372f633d88fce8da619fbcf0392
SHA256

8f454a072c53600324b5aba6730a123cea7883ad3ad7246deba60253d858e58c
SHA512

b7df2e447e49cec22d5246be7f5bc5c71e8cfac3a963cbcf41da61af6318e65a1b58b7948946009bcc414899f128717ca0cad2ef35735cec9ea294c5e7018e0f
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 51 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2224	2848	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2832	2848	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2904	2848	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2688	2848	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2708	2848	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2228	2848	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	988	2848	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1696	2848	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	984	2848	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2960	2848	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2980	2848	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1036	2848	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	316	2848	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1732	2848	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1724	2848	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1644	2848	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1156	2848	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1776	2848	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2808	2848	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1116	2848	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1452	2848	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2728	2848	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1780	2848	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1808	2848	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2368	2848	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2108	2848	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2580	2848	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2084	2848	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3044	2848	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1736	2848	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	668	2848	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2196	2848	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2068	2848	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	624	2848	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	940	2848	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1548	2848	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1892	2848	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2288	2848	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1124	2848	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1612	2848	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2292	2848	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2016	2848	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3064	2848	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2532	2848	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1148	2848	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	876	2848	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2280	2848	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3016	2848	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	932	2848	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1040	2848	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2540	2848	schtasks.exe	33

DCRat payload 8 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x00070000000186c3-12.dat	dcrat
behavioral1/memory/2860-13-0x0000000000B60000-0x0000000000C70000-memory.dmp	dcrat
behavioral1/memory/1460-58-0x00000000000C0000-0x00000000001D0000-memory.dmp	dcrat
behavioral1/memory/2936-211-0x0000000001180000-0x0000000001290000-memory.dmp	dcrat
behavioral1/memory/2512-271-0x0000000000040000-0x0000000000150000-memory.dmp	dcrat
behavioral1/memory/1688-331-0x0000000001020000-0x0000000001130000-memory.dmp	dcrat
behavioral1/memory/2776-391-0x0000000001340000-0x0000000001450000-memory.dmp	dcrat
behavioral1/memory/3060-630-0x0000000000070000-0x0000000000180000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 18 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2508	powershell.exe
2920	powershell.exe
2704	powershell.exe
2760	powershell.exe
2828	powershell.exe
2748	powershell.exe
2712	powershell.exe
2784	powershell.exe
2796	powershell.exe
2636	powershell.exe
1676	powershell.exe
2128	powershell.exe
2464	powershell.exe
2876	powershell.exe
2888	powershell.exe
2460	powershell.exe
2744	powershell.exe
2648	powershell.exe

Executes dropped EXE 10 IoCs

pid	Process
2860	DllCommonsvc.exe
1460	WmiPrvSE.exe
2936	WmiPrvSE.exe
2512	WmiPrvSE.exe
1688	WmiPrvSE.exe
2776	WmiPrvSE.exe
2692	WmiPrvSE.exe
2268	WmiPrvSE.exe
2064	WmiPrvSE.exe
3060	WmiPrvSE.exe

Loads dropped DLL 2 IoCs

pid	Process
2356	cmd.exe
2356	cmd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 9 IoCs

Web Service

T1102

flow	ioc
4	raw.githubusercontent.com
27	raw.githubusercontent.com
5	raw.githubusercontent.com
9	raw.githubusercontent.com
12	raw.githubusercontent.com
16	raw.githubusercontent.com
19	raw.githubusercontent.com
23	raw.githubusercontent.com
30	raw.githubusercontent.com

Drops file in Program Files directory 16 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Portable Devices\101b941d020240	DllCommonsvc.exe
File created	C:\Program Files\Uninstall Information\886983d96e3d3e	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft Synchronization Services\24dbde2999530e	DllCommonsvc.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\27d1bcfc3c54e0	DllCommonsvc.exe
File created	C:\Program Files\Java\jre7\lib\088424020bedd6	DllCommonsvc.exe
File created	C:\Program Files\7-Zip\Lang\6ccacd8608530f	DllCommonsvc.exe
File created	C:\Program Files\Windows Portable Devices\lsm.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft Synchronization Services\WmiPrvSE.exe	DllCommonsvc.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\System.exe	DllCommonsvc.exe
File created	C:\Program Files\Java\jre7\lib\conhost.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\sppsvc.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\0a1fd5f707cd16	DllCommonsvc.exe
File created	C:\Program Files\7-Zip\Lang\Idle.exe	DllCommonsvc.exe
File created	C:\Program Files\Internet Explorer\images\b75386f1303e64	DllCommonsvc.exe
File created	C:\Program Files\Internet Explorer\images\taskhost.exe	DllCommonsvc.exe
File created	C:\Program Files\Uninstall Information\csrss.exe	DllCommonsvc.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\addins\cmd.exe	DllCommonsvc.exe
File created	C:\Windows\addins\ebf1f9fa8afd6d	DllCommonsvc.exe
File created	C:\Windows\SoftwareDistribution\DataStore\audiodg.exe	DllCommonsvc.exe
File created	C:\Windows\SoftwareDistribution\DataStore\42af1c969fbb7b	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_8f454a072c53600324b5aba6730a123cea7883ad3ad7246deba60253d858e58c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 51 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2108	schtasks.exe
1892	schtasks.exe
2228	schtasks.exe
1036	schtasks.exe
2808	schtasks.exe
1808	schtasks.exe
2580	schtasks.exe
2540	schtasks.exe
2224	schtasks.exe
2980	schtasks.exe
1124	schtasks.exe
1040	schtasks.exe
2832	schtasks.exe
984	schtasks.exe
1776	schtasks.exe
2280	schtasks.exe
3016	schtasks.exe
2688	schtasks.exe
1156	schtasks.exe
1452	schtasks.exe
2368	schtasks.exe
2084	schtasks.exe
1736	schtasks.exe
668	schtasks.exe
2288	schtasks.exe
2532	schtasks.exe
1148	schtasks.exe
876	schtasks.exe
2708	schtasks.exe
988	schtasks.exe
316	schtasks.exe
1732	schtasks.exe
1724	schtasks.exe
1116	schtasks.exe
2728	schtasks.exe
2196	schtasks.exe
624	schtasks.exe
1548	schtasks.exe
2960	schtasks.exe
3044	schtasks.exe
940	schtasks.exe
1612	schtasks.exe
2904	schtasks.exe
1696	schtasks.exe
1644	schtasks.exe
1780	schtasks.exe
2068	schtasks.exe
2292	schtasks.exe
2016	schtasks.exe
3064	schtasks.exe
932	schtasks.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
2860	DllCommonsvc.exe
2712	powershell.exe
2464	powershell.exe
2508	powershell.exe
1460	WmiPrvSE.exe
1676	powershell.exe
2760	powershell.exe
2460	powershell.exe
2876	powershell.exe
2648	powershell.exe
2748	powershell.exe
2744	powershell.exe
2128	powershell.exe
2888	powershell.exe
2784	powershell.exe
2828	powershell.exe
2636	powershell.exe
2920	powershell.exe
2796	powershell.exe
2704	powershell.exe
2936	WmiPrvSE.exe
2512	WmiPrvSE.exe
1688	WmiPrvSE.exe
2776	WmiPrvSE.exe
2692	WmiPrvSE.exe
2268	WmiPrvSE.exe
2064	WmiPrvSE.exe
3060	WmiPrvSE.exe

Suspicious use of AdjustPrivilegeToken 28 IoCs

description	pid	Process
Token: SeDebugPrivilege	2860	DllCommonsvc.exe
Token: SeDebugPrivilege	2712	powershell.exe
Token: SeDebugPrivilege	2464	powershell.exe
Token: SeDebugPrivilege	2508	powershell.exe
Token: SeDebugPrivilege	1460	WmiPrvSE.exe
Token: SeDebugPrivilege	1676	powershell.exe
Token: SeDebugPrivilege	2760	powershell.exe
Token: SeDebugPrivilege	2460	powershell.exe
Token: SeDebugPrivilege	2876	powershell.exe
Token: SeDebugPrivilege	2648	powershell.exe
Token: SeDebugPrivilege	2748	powershell.exe
Token: SeDebugPrivilege	2744	powershell.exe
Token: SeDebugPrivilege	2128	powershell.exe
Token: SeDebugPrivilege	2888	powershell.exe
Token: SeDebugPrivilege	2784	powershell.exe
Token: SeDebugPrivilege	2828	powershell.exe
Token: SeDebugPrivilege	2636	powershell.exe
Token: SeDebugPrivilege	2920	powershell.exe
Token: SeDebugPrivilege	2796	powershell.exe
Token: SeDebugPrivilege	2704	powershell.exe
Token: SeDebugPrivilege	2936	WmiPrvSE.exe
Token: SeDebugPrivilege	2512	WmiPrvSE.exe
Token: SeDebugPrivilege	1688	WmiPrvSE.exe
Token: SeDebugPrivilege	2776	WmiPrvSE.exe
Token: SeDebugPrivilege	2692	WmiPrvSE.exe
Token: SeDebugPrivilege	2268	WmiPrvSE.exe
Token: SeDebugPrivilege	2064	WmiPrvSE.exe
Token: SeDebugPrivilege	3060	WmiPrvSE.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2540 wrote to memory of 2716	2540	JaffaCakes118_8f454a072c53600324b5aba6730a123cea7883ad3ad7246deba60253d858e58c.exe	29
PID 2540 wrote to memory of 2716	2540	JaffaCakes118_8f454a072c53600324b5aba6730a123cea7883ad3ad7246deba60253d858e58c.exe	29
PID 2540 wrote to memory of 2716	2540	JaffaCakes118_8f454a072c53600324b5aba6730a123cea7883ad3ad7246deba60253d858e58c.exe	29
PID 2540 wrote to memory of 2716	2540	JaffaCakes118_8f454a072c53600324b5aba6730a123cea7883ad3ad7246deba60253d858e58c.exe	29
PID 2716 wrote to memory of 2356	2716	WScript.exe	30
PID 2716 wrote to memory of 2356	2716	WScript.exe	30
PID 2716 wrote to memory of 2356	2716	WScript.exe	30
PID 2716 wrote to memory of 2356	2716	WScript.exe	30
PID 2356 wrote to memory of 2860	2356	cmd.exe	32
PID 2356 wrote to memory of 2860	2356	cmd.exe	32
PID 2356 wrote to memory of 2860	2356	cmd.exe	32
PID 2356 wrote to memory of 2860	2356	cmd.exe	32
PID 2860 wrote to memory of 2508	2860	DllCommonsvc.exe	85
PID 2860 wrote to memory of 2508	2860	DllCommonsvc.exe	85
PID 2860 wrote to memory of 2508	2860	DllCommonsvc.exe	85
PID 2860 wrote to memory of 2760	2860	DllCommonsvc.exe	86
PID 2860 wrote to memory of 2760	2860	DllCommonsvc.exe	86
PID 2860 wrote to memory of 2760	2860	DllCommonsvc.exe	86
PID 2860 wrote to memory of 2712	2860	DllCommonsvc.exe	87
PID 2860 wrote to memory of 2712	2860	DllCommonsvc.exe	87
PID 2860 wrote to memory of 2712	2860	DllCommonsvc.exe	87
PID 2860 wrote to memory of 2464	2860	DllCommonsvc.exe	88
PID 2860 wrote to memory of 2464	2860	DllCommonsvc.exe	88
PID 2860 wrote to memory of 2464	2860	DllCommonsvc.exe	88
PID 2860 wrote to memory of 2876	2860	DllCommonsvc.exe	90
PID 2860 wrote to memory of 2876	2860	DllCommonsvc.exe	90
PID 2860 wrote to memory of 2876	2860	DllCommonsvc.exe	90
PID 2860 wrote to memory of 2888	2860	DllCommonsvc.exe	91
PID 2860 wrote to memory of 2888	2860	DllCommonsvc.exe	91
PID 2860 wrote to memory of 2888	2860	DllCommonsvc.exe	91
PID 2860 wrote to memory of 2784	2860	DllCommonsvc.exe	92
PID 2860 wrote to memory of 2784	2860	DllCommonsvc.exe	92
PID 2860 wrote to memory of 2784	2860	DllCommonsvc.exe	92
PID 2860 wrote to memory of 2920	2860	DllCommonsvc.exe	93
PID 2860 wrote to memory of 2920	2860	DllCommonsvc.exe	93
PID 2860 wrote to memory of 2920	2860	DllCommonsvc.exe	93
PID 2860 wrote to memory of 2460	2860	DllCommonsvc.exe	94
PID 2860 wrote to memory of 2460	2860	DllCommonsvc.exe	94
PID 2860 wrote to memory of 2460	2860	DllCommonsvc.exe	94
PID 2860 wrote to memory of 2828	2860	DllCommonsvc.exe	95
PID 2860 wrote to memory of 2828	2860	DllCommonsvc.exe	95
PID 2860 wrote to memory of 2828	2860	DllCommonsvc.exe	95
PID 2860 wrote to memory of 2748	2860	DllCommonsvc.exe	96
PID 2860 wrote to memory of 2748	2860	DllCommonsvc.exe	96
PID 2860 wrote to memory of 2748	2860	DllCommonsvc.exe	96
PID 2860 wrote to memory of 2796	2860	DllCommonsvc.exe	97
PID 2860 wrote to memory of 2796	2860	DllCommonsvc.exe	97
PID 2860 wrote to memory of 2796	2860	DllCommonsvc.exe	97
PID 2860 wrote to memory of 2744	2860	DllCommonsvc.exe	98
PID 2860 wrote to memory of 2744	2860	DllCommonsvc.exe	98
PID 2860 wrote to memory of 2744	2860	DllCommonsvc.exe	98
PID 2860 wrote to memory of 2636	2860	DllCommonsvc.exe	99
PID 2860 wrote to memory of 2636	2860	DllCommonsvc.exe	99
PID 2860 wrote to memory of 2636	2860	DllCommonsvc.exe	99
PID 2860 wrote to memory of 2648	2860	DllCommonsvc.exe	100
PID 2860 wrote to memory of 2648	2860	DllCommonsvc.exe	100
PID 2860 wrote to memory of 2648	2860	DllCommonsvc.exe	100
PID 2860 wrote to memory of 2704	2860	DllCommonsvc.exe	101
PID 2860 wrote to memory of 2704	2860	DllCommonsvc.exe	101
PID 2860 wrote to memory of 2704	2860	DllCommonsvc.exe	101
PID 2860 wrote to memory of 1676	2860	DllCommonsvc.exe	102
PID 2860 wrote to memory of 1676	2860	DllCommonsvc.exe	102
PID 2860 wrote to memory of 1676	2860	DllCommonsvc.exe	102
PID 2860 wrote to memory of 2128	2860	DllCommonsvc.exe	103

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8f454a072c53600324b5aba6730a123cea7883ad3ad7246deba60253d858e58c.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8f454a072c53600324b5aba6730a123cea7883ad3ad7246deba60253d858e58c.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2540
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2716
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2356
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2860
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2508
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\lsass.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2760
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\sppsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2712
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\7-Zip\Lang\Idle.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2464
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\addins\cmd.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2876
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Internet Explorer\images\taskhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2888
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\smss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2784
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Searches\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2920
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2460
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\spoolsv.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2828
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\explorer.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2748
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\spoolsv.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2796
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Portable Devices\lsm.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2744
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Uninstall Information\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2636
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft Synchronization Services\WmiPrvSE.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2648
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\SoftwareDistribution\DataStore\audiodg.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2704
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Reference Assemblies\Microsoft\Framework\System.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1676
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Java\jre7\lib\conhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2128
    - - C:\Program Files (x86)\Microsoft Synchronization Services\WmiPrvSE.exe
        
        "C:\Program Files (x86)\Microsoft Synchronization Services\WmiPrvSE.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1460
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\SU2rmp5bpW.bat"
        6⤵
        
        PID:2876
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:1992
        
        C:\Program Files (x86)\Microsoft Synchronization Services\WmiPrvSE.exe
        
        "C:\Program Files (x86)\Microsoft Synchronization Services\WmiPrvSE.exe"
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2936
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\12JaEZR6zX.bat"
        8⤵
        
        PID:2736
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:1564
        
        C:\Program Files (x86)\Microsoft Synchronization Services\WmiPrvSE.exe
        
        "C:\Program Files (x86)\Microsoft Synchronization Services\WmiPrvSE.exe"
        9⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2512
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\34gW2xHJWZ.bat"
        10⤵
        
        PID:2288
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:1768
        
        C:\Program Files (x86)\Microsoft Synchronization Services\WmiPrvSE.exe
        
        "C:\Program Files (x86)\Microsoft Synchronization Services\WmiPrvSE.exe"
        11⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1688
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\0MFyH7TMVd.bat"
        12⤵
        
        PID:1856
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:1800
        
        C:\Program Files (x86)\Microsoft Synchronization Services\WmiPrvSE.exe
        
        "C:\Program Files (x86)\Microsoft Synchronization Services\WmiPrvSE.exe"
        13⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2776
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\kYBl3UyOdq.bat"
        14⤵
        
        PID:2516
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        15⤵
        
        PID:2308
        
        C:\Program Files (x86)\Microsoft Synchronization Services\WmiPrvSE.exe
        
        "C:\Program Files (x86)\Microsoft Synchronization Services\WmiPrvSE.exe"
        15⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2692
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\cqXkQwtlzQ.bat"
        16⤵
        
        PID:604
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        17⤵
        
        PID:948
        
        C:\Program Files (x86)\Microsoft Synchronization Services\WmiPrvSE.exe
        
        "C:\Program Files (x86)\Microsoft Synchronization Services\WmiPrvSE.exe"
        17⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2268
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\b6uRiEqY03.bat"
        18⤵
        
        PID:2680
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        19⤵
        
        PID:1008
        
        C:\Program Files (x86)\Microsoft Synchronization Services\WmiPrvSE.exe
        
        "C:\Program Files (x86)\Microsoft Synchronization Services\WmiPrvSE.exe"
        19⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2064
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\SK7IuFDp7o.bat"
        20⤵
        
        PID:1044
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        21⤵
        
        PID:1056
        
        C:\Program Files (x86)\Microsoft Synchronization Services\WmiPrvSE.exe
        
        "C:\Program Files (x86)\Microsoft Synchronization Services\WmiPrvSE.exe"
        21⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\MSOCache\All Users\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 7 /tr "'C:\Program Files\7-Zip\Lang\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files\7-Zip\Lang\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 9 /tr "'C:\Program Files\7-Zip\Lang\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 6 /tr "'C:\Windows\addins\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Windows\addins\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 5 /tr "'C:\Windows\addins\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 9 /tr "'C:\Program Files\Internet Explorer\images\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\images\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 7 /tr "'C:\Program Files\Internet Explorer\images\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 14 /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 5 /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\Searches\DllCommonsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\Users\Admin\Searches\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\Searches\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1452

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\providercommon\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\providercommon\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\providercommon\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 13 /tr "'C:\Users\Default User\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2368

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Users\Default User\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 6 /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 13 /tr "'C:\Users\Default User\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Users\Default User\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2196

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 7 /tr "'C:\Users\Default User\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Portable Devices\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Portable Devices\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Program Files\Uninstall Information\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2288

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Program Files\Uninstall Information\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1124

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Microsoft Synchronization Services\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Synchronization Services\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Microsoft Synchronization Services\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 14 /tr "'C:\Windows\SoftwareDistribution\DataStore\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Windows\SoftwareDistribution\DataStore\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 12 /tr "'C:\Windows\SoftwareDistribution\DataStore\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1148

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 7 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2280

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 7 /tr "'C:\Program Files\Java\jre7\lib\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files\Java\jre7\lib\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 10 /tr "'C:\Program Files\Java\jre7\lib\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
75dcc0787e0fa889d9bafdc0a814e688

SHA1
dc3820e99ef5f008991ab651c51070253d344d74

SHA256
f8bcbaa3f9f7081110acadcaedc726f476b58d769fa24170aa266e7e2a270e5c

SHA512
5d27a095766cd20be512fdc028c705d176b8fc4b35f0fc1d6c5714f765254027eded586a8cd561ae996ee544b2e2bbfd4df0ee64dc3b64abde127e8177923fda

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
11c80d20f4b60a806191b5c9c26bb4ed

SHA1
ead24b1d4e3c511e94dc099e80efd83434ea1490

SHA256
263c6cbe32cb8449928cf4122b4d4e4166f4bfe16357427c61446a8344a35f43

SHA512
8aedce9bc6aee887a961c701968b3659fc3d48963f66e516cd7a9650d9666e6ccce4056cc047d65ef8a402f0c308ebb5cf07ea88ab8f822496da330486b0925f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
85a101c499b03e03b0f3f6f33a21fb17

SHA1
2be65454be30f184053f5e9af4ddc62137052de0

SHA256
a57124b7865f75c1d18c4bf1164b8f37844e8a3f2a4ee5edfec7b81360531187

SHA512
849ca4771e8108ebea1dbdbc4c2a5b0b2961c4f1ecb55f8befa240933b454cf49ffa6e929ec3483535ed616184239f199426f8c265750c0fb684ce889a200096

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
13a18f5e6523fa3a176808fb3d3d51d6

SHA1
576a9838f0c0fe7fa516fb041d3d5c47350b09cc

SHA256
3a4d6a431622588721454526e11b7247b61b6144a71d0c03386318460bdebbd0

SHA512
104f7962c67e7677dcf862bec5bc0237739cf1578bb3d889cfe4a06cdb3f73e52c7b77074ed65d32c793aac270c5bf4be7004b8f8fd70d1d659f5f7986736dc0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
83a1e99742c7182c2766334162f5a06f

SHA1
2729cf1898128b79dc5005255a888455d62b4fc4

SHA256
c7e3c06839682b000af626abdcf69ae31081a5fa1570e7b9c6c0bacb6eae10d4

SHA512
d16abaf54f281676721b98aad45d3bd89747c9806e9d9e69a0ac362ee655791e49cce0e869ce6bce091f0b42b4c985f61328c9eab33fb950aa0c8ef6b4e02289

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
29d8bc1e3316d1c8e6902a9522750bd7

SHA1
a032c7b17bda9b3024723d4c13af0c5e8b901a18

SHA256
dddc2f19558e2b3f02afefca03644ee7367c4716ec81af9fec5b265368d1e096

SHA512
3b3768892529d27cccd0350c4d998fa2a271b561ac4c69785a0953ac306c464c8bda63625410e216276daad7ef69a2e52cbf1cee056f6635764d6454936ef2e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7535405799f200ba7641cd2bebadd930

SHA1
2dc1ef1101e1747a1bde09e28c9b087874f0e84f

SHA256
5ba0b4a101586bdb10da9952c720cd9b7a3bb1ad0720e0068e70d954b3f22a8e

SHA512
0f279968768da912faa6742bcf7229d517d217bbc68fa37b6b3a7b3cfc89c4442bdc28410118a26c1713f0470cc3e6a744ad0d8c1a9fef9b8bd0f73983ee4de7

Download Submit
C:\Users\Admin\AppData\Local\Temp\0MFyH7TMVd.bat

Filesize
235B

MD5
f99f791067bfb599d271ada5b87cbbba

SHA1
e8b8c56ee536395c29c93ad449863b0e1d4a59a6

SHA256
514a6f10f3a1a2929832752a93dc04bd61ac475aa0daab44a6da8c20348d1c0b

SHA512
50f550b53f72ecaafd83d418f041999a95346224b8cfe45cdd4b46deadb0852fe9c02341b910425abb03ce85396236c46901cb7dc6891901fc08358195d1d78c

Download Submit
C:\Users\Admin\AppData\Local\Temp\12JaEZR6zX.bat

Filesize
235B

MD5
56990057986d8a350e27a664e29b748f

SHA1
331f6c8c9da1fc6060712db755b752555103695e

SHA256
6c02dd9fa75890180c8cd57c4f4b9cd2550f34dc81ec0db517c43f6c495c8371

SHA512
528dbde656d3355071cff30057ef64f0b56a990fab8a5f2f429f80cdac12528e8267741eecdfb87c795024f4d04489640b235fb1a7b6bd34970ccdad23edd53a

Download Submit
C:\Users\Admin\AppData\Local\Temp\34gW2xHJWZ.bat

Filesize
235B

MD5
b3e5b3bd9da770373122f77796077c5c

SHA1
84f2f478ea7222e60198694b007f8226d5a064b8

SHA256
f420e24d19a40b3b5ae488af8390090c5b02e713476d0b5e6d872b6ac386ac5c

SHA512
0405bf2ad9ca3dcf7a9f545dd08c812e95a2291abc280249181b98abbcdfc2dfabe1398748a68f74a814fcb27aed60423b69f0299988a5360adb09c3fe6b31a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1C2A.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\SK7IuFDp7o.bat

Filesize
235B

MD5
41c11fd43b330bb1e5123cbfb0c23da6

SHA1
44bcb05b106e540e35be9a6e2f9b1b496a626fed

SHA256
dd5d49638c54181663e45adc7ff264d8168e7640a22c7b5f42c7e11cc518e2d5

SHA512
9bfb7450ded74309344aa717e1cd92d90b5de16f33b89c4bec4af0bb9181223c49892838f9babd2cf8f295bfd0ef5dcb3cf06fb710a8084be3e9878e34cb32c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\SU2rmp5bpW.bat

Filesize
235B

MD5
5110f3c94cf6bd726b42c56e377606b6

SHA1
dff7e61761a92abb5ffff78b8ea345426b841250

SHA256
a9e13048cd3945c0f6c62cab10d37cbe3ce3b96f53151792c154e08ba54df2d6

SHA512
8cd38b5693f1df17a36da92e3d8520ac8d4557fba5da2d15e1f51394dddf98ac49da8974b714254b4d8fedeb194c2e465abf511c9e9efd8093f1f226995cc4f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1C8B.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\b6uRiEqY03.bat

Filesize
235B

MD5
0d5dcb9dedda9111d66245c61946abb6

SHA1
b5805ae477a3fed088257bd65ddc8627dadb5de8

SHA256
c8c1e3eeab281843530155c2cc092de62b1b3d54a63c93346da701022afbd7f6

SHA512
3ca1a8942a340fa445009a005b99c64c435b88bd9997c618d46a3e1d64e868ee6e22e2dc34b8ff6ac2fd29fd7375ef565cb862fdb611691291cccabb59a0327f

Download Submit
C:\Users\Admin\AppData\Local\Temp\cqXkQwtlzQ.bat

Filesize
235B

MD5
73a6eec7264242543d2d612c481a60b0

SHA1
f9dccbdcc9518fe935fea364819dfbdfec6a742e

SHA256
8255591e2497bb5857234704451944cd30758c9e0c876a2d091cc551df9e30bc

SHA512
ed42b7c1bf00ed0f4df6cf983a24691010350ec15250162dd8f52ba1023e03cb67e768efed51b23d5b211e9093be46eb88d430dc0b71761bcb01b3e8cc53e598

Download Submit
C:\Users\Admin\AppData\Local\Temp\kYBl3UyOdq.bat

Filesize
235B

MD5
d7b85e46b80740c7e57303e10cb17625

SHA1
d1e2774e48d6736b93e14d92db98cddb60c31a07

SHA256
2d2af534d13ca786bd5e3a19793dfc7e8f2e6e0dda87ed4a82fe4820dd618e73

SHA512
19f680cada29b6195ea62fc91963307aa5eb960e1ba9e1302cb8add4b79edf30af00f7f03ecd0349ac76a4805fe328bf12ea92941fa708be02ab1e3b7aed8800

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
b1f82408896573d5eae27baebcd41535

SHA1
1e6922c731a5ebf07ffabf12a415933bbeb929fd

SHA256
11d501a70dd790b751667ff622fb4102c966cac04f7e7f93ab66e7d88807f781

SHA512
18fddcd1227e68703eb791c624b2de936a7e325b36f15da1d01d9d019c2d27b821ce4a443ad8208418b17d6491c9b7b9eadacc8c1fe9c979d846b742ce9dbc9c

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/1460-58-0x00000000000C0000-0x00000000001D0000-memory.dmp

Filesize
1.1MB

Download
memory/1676-83-0x0000000002290000-0x0000000002298000-memory.dmp

Filesize
32KB

Download
memory/1676-82-0x000000001B220000-0x000000001B502000-memory.dmp

Filesize
2.9MB

Download
memory/1688-331-0x0000000001020000-0x0000000001130000-memory.dmp

Filesize
1.1MB

Download
memory/2268-511-0x0000000000250000-0x0000000000262000-memory.dmp

Filesize
72KB

Download
memory/2508-73-0x000000001B200000-0x000000001B4E2000-memory.dmp

Filesize
2.9MB

Download
memory/2512-271-0x0000000000040000-0x0000000000150000-memory.dmp

Filesize
1.1MB

Download
memory/2692-451-0x0000000000460000-0x0000000000472000-memory.dmp

Filesize
72KB

Download
memory/2712-74-0x0000000001DE0000-0x0000000001DE8000-memory.dmp

Filesize
32KB

Download
memory/2776-391-0x0000000001340000-0x0000000001450000-memory.dmp

Filesize
1.1MB

Download
memory/2860-17-0x00000000002E0000-0x00000000002EC000-memory.dmp

Filesize
48KB

Download
memory/2860-16-0x00000000002D0000-0x00000000002DC000-memory.dmp

Filesize
48KB

Download
memory/2860-15-0x00000000002F0000-0x00000000002FC000-memory.dmp

Filesize
48KB

Download
memory/2860-14-0x00000000002C0000-0x00000000002D2000-memory.dmp

Filesize
72KB

Download
memory/2860-13-0x0000000000B60000-0x0000000000C70000-memory.dmp

Filesize
1.1MB

Download
memory/2936-211-0x0000000001180000-0x0000000001290000-memory.dmp

Filesize
1.1MB

Download
memory/3060-630-0x0000000000070000-0x0000000000180000-memory.dmp

Filesize
1.1MB

Download
memory/3060-631-0x0000000000450000-0x0000000000462000-memory.dmp

Filesize
72KB

Download