dcrat | cdb72eda65ea4ecee1e8b3804d45eadcabfbe709204111c5316652b74612f5a0

Analysis

max time kernel
148s
max time network
150s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22-12-2024 08:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_cdb72eda65ea4ecee1e8b3804d45eadcabfbe709204111c5316652b74612f5a0.exe
Size

1.3MB
MD5

2b87e817761aa12e533f131488d60a24
SHA1

8846891b8bc70f042e5edb0cd101dd6a7234d32e
SHA256

cdb72eda65ea4ecee1e8b3804d45eadcabfbe709204111c5316652b74612f5a0
SHA512

f348c61ec8c956cd03a295aab707dbb1f8e1a2ce817daeb4e03183df97bdde3485d554c0b670d3fb8b774fca780c368912aee7df1300e2641e75fb680001fb00
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 48 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2124	2688	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1716	2688	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	444	2688	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2548	2688	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2960	2688	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2504	2688	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	536	2688	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2012	2688	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	532	2688	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1100	2688	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1696	2688	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1332	2688	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	584	2688	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1884	2688	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2664	2688	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2132	2688	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2332	2688	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1500	2688	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	580	2688	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	880	2688	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2236	2688	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1892	2688	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1740	2688	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2284	2688	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1988	2688	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1412	2688	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2028	2688	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	764	2688	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1912	2688	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2008	2688	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	784	2688	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	928	2688	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2996	2688	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	768	2688	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1808	2688	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1564	2688	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2412	2688	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1132	2688	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1820	2688	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2476	2688	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2328	2688	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2176	2688	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2120	2688	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2984	2688	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3028	2688	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1936	2688	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1920	2688	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1512	2688	schtasks.exe	34

DCRat payload 11 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x000700000001927a-9.dat	dcrat
behavioral1/memory/2656-13-0x0000000000340000-0x0000000000450000-memory.dmp	dcrat
behavioral1/memory/2956-56-0x00000000001E0000-0x00000000002F0000-memory.dmp	dcrat
behavioral1/memory/2968-201-0x0000000000110000-0x0000000000220000-memory.dmp	dcrat
behavioral1/memory/1512-261-0x00000000011B0000-0x00000000012C0000-memory.dmp	dcrat
behavioral1/memory/2108-321-0x0000000000190000-0x00000000002A0000-memory.dmp	dcrat
behavioral1/memory/2220-381-0x0000000000F90000-0x00000000010A0000-memory.dmp	dcrat
behavioral1/memory/2768-441-0x0000000000FB0000-0x00000000010C0000-memory.dmp	dcrat
behavioral1/memory/2108-560-0x0000000000200000-0x0000000000310000-memory.dmp	dcrat
behavioral1/memory/1600-620-0x0000000000A30000-0x0000000000B40000-memory.dmp	dcrat
behavioral1/memory/1000-681-0x0000000000D40000-0x0000000000E50000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 17 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2720	powershell.exe
1948	powershell.exe
1724	powershell.exe
2696	powershell.exe
1608	powershell.exe
2196	powershell.exe
2108	powershell.exe
2976	powershell.exe
2832	powershell.exe
2928	powershell.exe
2652	powershell.exe
2792	powershell.exe
2788	powershell.exe
2708	powershell.exe
2932	powershell.exe
1604	powershell.exe
1720	powershell.exe

Executes dropped EXE 12 IoCs

pid	Process
2656	DllCommonsvc.exe
2956	spoolsv.exe
2968	spoolsv.exe
1512	spoolsv.exe
2108	spoolsv.exe
2220	spoolsv.exe
2768	spoolsv.exe
2196	spoolsv.exe
2108	spoolsv.exe
1600	spoolsv.exe
1000	spoolsv.exe
1380	spoolsv.exe

Loads dropped DLL 2 IoCs

pid	Process
2764	cmd.exe
2764	cmd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 11 IoCs

Web Service

T1102

flow	ioc
4	raw.githubusercontent.com
5	raw.githubusercontent.com
20	raw.githubusercontent.com
30	raw.githubusercontent.com
37	raw.githubusercontent.com
9	raw.githubusercontent.com
13	raw.githubusercontent.com
16	raw.githubusercontent.com
23	raw.githubusercontent.com
27	raw.githubusercontent.com
34	raw.githubusercontent.com

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Uninstall Information\f3b6ecef712a24	DllCommonsvc.exe
File created	C:\Program Files\MSBuild\Microsoft\sppsvc.exe	DllCommonsvc.exe
File created	C:\Program Files\MSBuild\Microsoft\0a1fd5f707cd16	DllCommonsvc.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\de-DE\System.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Portable Devices\WmiPrvSE.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Portable Devices\24dbde2999530e	DllCommonsvc.exe
File created	C:\Program Files (x86)\Uninstall Information\spoolsv.exe	DllCommonsvc.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Fonts\cc11b995f2a76d	DllCommonsvc.exe
File created	C:\Windows\Installer\{90140000-006E-0409-0000-0000000FF1CE}\lsm.exe	DllCommonsvc.exe
File created	C:\Windows\Installer\{90140000-006E-0409-0000-0000000FF1CE}\101b941d020240	DllCommonsvc.exe
File created	C:\Windows\Fonts\winlogon.exe	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_cdb72eda65ea4ecee1e8b3804d45eadcabfbe709204111c5316652b74612f5a0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 48 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1100	schtasks.exe
2332	schtasks.exe
880	schtasks.exe
2008	schtasks.exe
1920	schtasks.exe
2012	schtasks.exe
2132	schtasks.exe
2996	schtasks.exe
1132	schtasks.exe
2176	schtasks.exe
1936	schtasks.exe
2124	schtasks.exe
1716	schtasks.exe
2548	schtasks.exe
536	schtasks.exe
532	schtasks.exe
1696	schtasks.exe
1332	schtasks.exe
1500	schtasks.exe
768	schtasks.exe
2476	schtasks.exe
1512	schtasks.exe
2960	schtasks.exe
1412	schtasks.exe
1808	schtasks.exe
3028	schtasks.exe
2664	schtasks.exe
2236	schtasks.exe
1892	schtasks.exe
1564	schtasks.exe
2412	schtasks.exe
1820	schtasks.exe
2120	schtasks.exe
580	schtasks.exe
1740	schtasks.exe
2284	schtasks.exe
2028	schtasks.exe
764	schtasks.exe
928	schtasks.exe
2984	schtasks.exe
444	schtasks.exe
2504	schtasks.exe
584	schtasks.exe
1884	schtasks.exe
1988	schtasks.exe
1912	schtasks.exe
784	schtasks.exe
2328	schtasks.exe

Suspicious behavior: EnumeratesProcesses 29 IoCs

pid	Process
2656	DllCommonsvc.exe
2708	powershell.exe
2832	powershell.exe
2652	powershell.exe
2928	powershell.exe
2696	powershell.exe
2956	spoolsv.exe
1604	powershell.exe
2792	powershell.exe
2720	powershell.exe
2788	powershell.exe
2108	powershell.exe
1608	powershell.exe
1724	powershell.exe
1948	powershell.exe
2976	powershell.exe
2196	powershell.exe
1720	powershell.exe
2932	powershell.exe
2968	spoolsv.exe
1512	spoolsv.exe
2108	spoolsv.exe
2220	spoolsv.exe
2768	spoolsv.exe
2196	spoolsv.exe
2108	spoolsv.exe
1600	spoolsv.exe
1000	spoolsv.exe
1380	spoolsv.exe

Suspicious use of AdjustPrivilegeToken 29 IoCs

description	pid	Process
Token: SeDebugPrivilege	2656	DllCommonsvc.exe
Token: SeDebugPrivilege	2708	powershell.exe
Token: SeDebugPrivilege	2832	powershell.exe
Token: SeDebugPrivilege	2652	powershell.exe
Token: SeDebugPrivilege	2928	powershell.exe
Token: SeDebugPrivilege	2696	powershell.exe
Token: SeDebugPrivilege	2956	spoolsv.exe
Token: SeDebugPrivilege	1604	powershell.exe
Token: SeDebugPrivilege	2792	powershell.exe
Token: SeDebugPrivilege	2720	powershell.exe
Token: SeDebugPrivilege	2788	powershell.exe
Token: SeDebugPrivilege	2108	powershell.exe
Token: SeDebugPrivilege	1608	powershell.exe
Token: SeDebugPrivilege	1724	powershell.exe
Token: SeDebugPrivilege	1948	powershell.exe
Token: SeDebugPrivilege	2976	powershell.exe
Token: SeDebugPrivilege	2196	powershell.exe
Token: SeDebugPrivilege	1720	powershell.exe
Token: SeDebugPrivilege	2932	powershell.exe
Token: SeDebugPrivilege	2968	spoolsv.exe
Token: SeDebugPrivilege	1512	spoolsv.exe
Token: SeDebugPrivilege	2108	spoolsv.exe
Token: SeDebugPrivilege	2220	spoolsv.exe
Token: SeDebugPrivilege	2768	spoolsv.exe
Token: SeDebugPrivilege	2196	spoolsv.exe
Token: SeDebugPrivilege	2108	spoolsv.exe
Token: SeDebugPrivilege	1600	spoolsv.exe
Token: SeDebugPrivilege	1000	spoolsv.exe
Token: SeDebugPrivilege	1380	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2336 wrote to memory of 2952	2336	JaffaCakes118_cdb72eda65ea4ecee1e8b3804d45eadcabfbe709204111c5316652b74612f5a0.exe	30
PID 2336 wrote to memory of 2952	2336	JaffaCakes118_cdb72eda65ea4ecee1e8b3804d45eadcabfbe709204111c5316652b74612f5a0.exe	30
PID 2336 wrote to memory of 2952	2336	JaffaCakes118_cdb72eda65ea4ecee1e8b3804d45eadcabfbe709204111c5316652b74612f5a0.exe	30
PID 2336 wrote to memory of 2952	2336	JaffaCakes118_cdb72eda65ea4ecee1e8b3804d45eadcabfbe709204111c5316652b74612f5a0.exe	30
PID 2952 wrote to memory of 2764	2952	WScript.exe	31
PID 2952 wrote to memory of 2764	2952	WScript.exe	31
PID 2952 wrote to memory of 2764	2952	WScript.exe	31
PID 2952 wrote to memory of 2764	2952	WScript.exe	31
PID 2764 wrote to memory of 2656	2764	cmd.exe	33
PID 2764 wrote to memory of 2656	2764	cmd.exe	33
PID 2764 wrote to memory of 2656	2764	cmd.exe	33
PID 2764 wrote to memory of 2656	2764	cmd.exe	33
PID 2656 wrote to memory of 1948	2656	DllCommonsvc.exe	83
PID 2656 wrote to memory of 1948	2656	DllCommonsvc.exe	83
PID 2656 wrote to memory of 1948	2656	DllCommonsvc.exe	83
PID 2656 wrote to memory of 2196	2656	DllCommonsvc.exe	84
PID 2656 wrote to memory of 2196	2656	DllCommonsvc.exe	84
PID 2656 wrote to memory of 2196	2656	DllCommonsvc.exe	84
PID 2656 wrote to memory of 2108	2656	DllCommonsvc.exe	85
PID 2656 wrote to memory of 2108	2656	DllCommonsvc.exe	85
PID 2656 wrote to memory of 2108	2656	DllCommonsvc.exe	85
PID 2656 wrote to memory of 2928	2656	DllCommonsvc.exe	86
PID 2656 wrote to memory of 2928	2656	DllCommonsvc.exe	86
PID 2656 wrote to memory of 2928	2656	DllCommonsvc.exe	86
PID 2656 wrote to memory of 2932	2656	DllCommonsvc.exe	87
PID 2656 wrote to memory of 2932	2656	DllCommonsvc.exe	87
PID 2656 wrote to memory of 2932	2656	DllCommonsvc.exe	87
PID 2656 wrote to memory of 2976	2656	DllCommonsvc.exe	88
PID 2656 wrote to memory of 2976	2656	DllCommonsvc.exe	88
PID 2656 wrote to memory of 2976	2656	DllCommonsvc.exe	88
PID 2656 wrote to memory of 2652	2656	DllCommonsvc.exe	89
PID 2656 wrote to memory of 2652	2656	DllCommonsvc.exe	89
PID 2656 wrote to memory of 2652	2656	DllCommonsvc.exe	89
PID 2656 wrote to memory of 1604	2656	DllCommonsvc.exe	90
PID 2656 wrote to memory of 1604	2656	DllCommonsvc.exe	90
PID 2656 wrote to memory of 1604	2656	DllCommonsvc.exe	90
PID 2656 wrote to memory of 1608	2656	DllCommonsvc.exe	91
PID 2656 wrote to memory of 1608	2656	DllCommonsvc.exe	91
PID 2656 wrote to memory of 1608	2656	DllCommonsvc.exe	91
PID 2656 wrote to memory of 1720	2656	DllCommonsvc.exe	92
PID 2656 wrote to memory of 1720	2656	DllCommonsvc.exe	92
PID 2656 wrote to memory of 1720	2656	DllCommonsvc.exe	92
PID 2656 wrote to memory of 1724	2656	DllCommonsvc.exe	93
PID 2656 wrote to memory of 1724	2656	DllCommonsvc.exe	93
PID 2656 wrote to memory of 1724	2656	DllCommonsvc.exe	93
PID 2656 wrote to memory of 2696	2656	DllCommonsvc.exe	94
PID 2656 wrote to memory of 2696	2656	DllCommonsvc.exe	94
PID 2656 wrote to memory of 2696	2656	DllCommonsvc.exe	94
PID 2656 wrote to memory of 2792	2656	DllCommonsvc.exe	95
PID 2656 wrote to memory of 2792	2656	DllCommonsvc.exe	95
PID 2656 wrote to memory of 2792	2656	DllCommonsvc.exe	95
PID 2656 wrote to memory of 2788	2656	DllCommonsvc.exe	96
PID 2656 wrote to memory of 2788	2656	DllCommonsvc.exe	96
PID 2656 wrote to memory of 2788	2656	DllCommonsvc.exe	96
PID 2656 wrote to memory of 2832	2656	DllCommonsvc.exe	97
PID 2656 wrote to memory of 2832	2656	DllCommonsvc.exe	97
PID 2656 wrote to memory of 2832	2656	DllCommonsvc.exe	97
PID 2656 wrote to memory of 2708	2656	DllCommonsvc.exe	98
PID 2656 wrote to memory of 2708	2656	DllCommonsvc.exe	98
PID 2656 wrote to memory of 2708	2656	DllCommonsvc.exe	98
PID 2656 wrote to memory of 2720	2656	DllCommonsvc.exe	99
PID 2656 wrote to memory of 2720	2656	DllCommonsvc.exe	99
PID 2656 wrote to memory of 2720	2656	DllCommonsvc.exe	99
PID 2656 wrote to memory of 2956	2656	DllCommonsvc.exe	117

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_cdb72eda65ea4ecee1e8b3804d45eadcabfbe709204111c5316652b74612f5a0.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_cdb72eda65ea4ecee1e8b3804d45eadcabfbe709204111c5316652b74612f5a0.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2336
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2952
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2764
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2656
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1948
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Cookies\dwm.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2196
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Libraries\winlogon.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2108
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\services.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2928
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\MSBuild\Microsoft\sppsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2932
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\sppsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2976
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\OSPPSVC.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2652
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\audiodg.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1604
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Temp\Crashpad\attachments\conhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1608
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Installer\{90140000-006E-0409-0000-0000000FF1CE}\lsm.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1720
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Portable Devices\WmiPrvSE.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1724
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\winlogon.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2696
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Fonts\winlogon.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2792
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\spoolsv.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2788
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\spoolsv.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2832
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Uninstall Information\spoolsv.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2708
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\conhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2720
    - - C:\Users\Admin\spoolsv.exe
        
        "C:\Users\Admin\spoolsv.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2956
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\5ixwcMXCIg.bat"
        6⤵
        
        PID:3032
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:1972
        
        C:\Users\Admin\spoolsv.exe
        
        "C:\Users\Admin\spoolsv.exe"
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2968
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\LdHmevWlG3.bat"
        8⤵
        
        PID:2608
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:856
        
        C:\Users\Admin\spoolsv.exe
        
        "C:\Users\Admin\spoolsv.exe"
        9⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1512
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\cwtcXGf4Cf.bat"
        10⤵
        
        PID:1488
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:960
        
        C:\Users\Admin\spoolsv.exe
        
        "C:\Users\Admin\spoolsv.exe"
        11⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2108
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\yMeEqlK1gO.bat"
        12⤵
        
        PID:1292
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:2260
        
        C:\Users\Admin\spoolsv.exe
        
        "C:\Users\Admin\spoolsv.exe"
        13⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2220
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\WtKWrLEt72.bat"
        14⤵
        
        PID:2620
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        15⤵
        
        PID:2540
        
        C:\Users\Admin\spoolsv.exe
        
        "C:\Users\Admin\spoolsv.exe"
        15⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2768
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\7ouYA2TrKB.bat"
        16⤵
        
        PID:2740
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        17⤵
        
        PID:1556
        
        C:\Users\Admin\spoolsv.exe
        
        "C:\Users\Admin\spoolsv.exe"
        17⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2196
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\5bc4V3lt5Q.bat"
        18⤵
        
        PID:1896
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        19⤵
        
        PID:1916
        
        C:\Users\Admin\spoolsv.exe
        
        "C:\Users\Admin\spoolsv.exe"
        19⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2108
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\3Lxx1rvPQX.bat"
        20⤵
        
        PID:1160
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        21⤵
        
        PID:2300
        
        C:\Users\Admin\spoolsv.exe
        
        "C:\Users\Admin\spoolsv.exe"
        21⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1600
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\UyITBGB0nG.bat"
        22⤵
        
        PID:968
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        23⤵
        
        PID:1640
        
        C:\Users\Admin\spoolsv.exe
        
        "C:\Users\Admin\spoolsv.exe"
        23⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1000
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\B7rL9EqqPR.bat"
        24⤵
        
        PID:2596
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        25⤵
        
        PID:3004
        
        C:\Users\Admin\spoolsv.exe
        
        "C:\Users\Admin\spoolsv.exe"
        25⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\Cookies\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2124

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Users\Admin\Cookies\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\Cookies\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\Users\Public\Libraries\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Users\Public\Libraries\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 10 /tr "'C:\Users\Public\Libraries\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\MSOCache\All Users\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 10 /tr "'C:\Program Files\MSBuild\Microsoft\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1100

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files\MSBuild\Microsoft\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\Program Files\MSBuild\Microsoft\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1332

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 14 /tr "'C:\providercommon\OSPPSVC.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2132

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\providercommon\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2332

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 11 /tr "'C:\providercommon\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1500

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 9 /tr "'C:\Windows\Temp\Crashpad\attachments\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Windows\Temp\Crashpad\attachments\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1740

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 14 /tr "'C:\Windows\Temp\Crashpad\attachments\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 5 /tr "'C:\Windows\Installer\{90140000-006E-0409-0000-0000000FF1CE}\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Windows\Installer\{90140000-006E-0409-0000-0000000FF1CE}\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 7 /tr "'C:\Windows\Installer\{90140000-006E-0409-0000-0000000FF1CE}\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Portable Devices\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Portable Devices\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 6 /tr "'C:\providercommon\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\providercommon\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 6 /tr "'C:\providercommon\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\Windows\Fonts\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\Fonts\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\Windows\Fonts\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Users\Admin\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1132

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 10 /tr "'C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2328

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 7 /tr "'C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2176

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Uninstall Information\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2120

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files (x86)\Uninstall Information\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Uninstall Information\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 9 /tr "'C:\providercommon\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\providercommon\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 10 /tr "'C:\providercommon\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9755bd8980612fc22274cb92da9de05b

SHA1
32c1204621be50ef04c262160e961194d60883c3

SHA256
3136a426c6de5f9698fb214c98906263918cccecfffb5e87c19e8d7086290cdd

SHA512
759b87b581d44499d62268dbbf69b8bf961fb82077ec4b5cb0d286ffe097c34c08979d70d8ad233bab8a2fb2edda4cc2c6205fc994a46ee58fe4071a7a57edc8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d5abf3bb0255931653167cdb0bada9b3

SHA1
2b245d63500feaccd775dc02c7297382c1ef2009

SHA256
641d99052e7aa3e5379f2165343b77a271a793e779fb2803a3349053205811d2

SHA512
56dc9e4e670d7f6f6744536d68a0cbbe0568b28a816d3965fcf99513256861cd4e13a6651116d8cf355b5578207a2b190d20a091e4f00c4179a8dd28b4289179

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1b8b42823a0957c3a0bab9560704bece

SHA1
a9527825c0af1cecfff0a842ad9d460ebafeb2f2

SHA256
0069b7120c3259864148c7cff86e9b89c837a373e5519c58a688d29e9133aae6

SHA512
b0de0fe3c7f4b2bcc2fbe1cab09d4ac71b5eee72ca7c4956097307d82a4bb69306094053a3a07a2af7218410bfcbe8d1baedf6706bf09c05a67ab78602fd037a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0deb5441abe5e72524b0f5339510483d

SHA1
4753e848e5e3071c304987021a486e6c5366c56d

SHA256
edf8f76a7e53ddc8a413f47be97655efde97afb4fe5968b49d74ada6910268b2

SHA512
d735e13e7ef52dd2980d567e6e1a8e95bc861b8af7b74ee0b1f180d9566a119ae164cef25e710fc2ac9203df9486ee6103c8f4724aa6c658fb738f7f3937fc55

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9d64a38ce157cb6c6ad16bd6daaeed9f

SHA1
35c838661db874f05b5fb2fcffb50f4b81b61a4b

SHA256
0046bef33c3685c0716f309c5a6d2e460326f670f45b0fef3e13cef92933b4cf

SHA512
8cd92d8356f848ea9abdb2d2b0a5b9f6cd81ddddaa91981d6aeeff3fb1b1a30fea6b8f71229d99d1bd405f4216908d7dfe4386ba410885c3f820af5df926ea34

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e5f0d66e22d3cd3f86fb79d7fa4172ca

SHA1
befe531974c7e39d5fd959f5ce8210ac01137eda

SHA256
31507df499f1f4235c79102c8b19cf76c92d0a01bb950ceef769444f8393426b

SHA512
70e78c8410b928d605b4d82feca841c0b2d5f8364301451acfeed36b30f62aa93aed8424b78896dd2b9441c4ec3bce3798b87420a57b3045b0326a4fb7778120

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2e53c74b3294b3fea0710325484817ad

SHA1
507d05e51bc17f0cc2a444196df5931a6d1b67fd

SHA256
1832d38605c5141adeb3574eb4402fe682279b009bce1e2d4ef6675c9a23be09

SHA512
41ed12523b7b7b22b49db427ec7fd39beac8702164b2fdfa813529ee40ca8f9725b960f69ac93112c33c3ea9973d414e586cdd1ea53e68033bd24ab9b52ab8bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
02bb0936319fc4467b992b7dc307ed77

SHA1
ddca6ed33e370b1a6acb0550a7d17333a8e6d944

SHA256
3f55be8558a9df0410ad7f317b73d9d488b4ac0a571fbd18dd045fdb719d00ea

SHA512
6180774b84f11310294af43fc536f6dff673d7274ccfae1ae40e4be51d9494eae3cd7a176901df4cd418fe647a0c3ed9be7a6fe1c7eda0709f95ec698cde5d0a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5ce8e976849166a35e055672e3e2a5e6

SHA1
db37ccebbec7755dc46e6a81a64f094c289926e1

SHA256
13eded10b456099a4b172064e11a0e7c872cf1e98ed783edaaf5f3f5f1d6944b

SHA512
15fd75990547de145ff343dae88fafedf55f06df781ee7d04f009a56bdab29f51457657384eaa79baef43a505e302924bc61e85bfacc56d3369316e2672f5e0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\3Lxx1rvPQX.bat

Filesize
191B

MD5
ea9f2093caa28332b01d7c8858057192

SHA1
1e9e7ecee791d35a208b48d9eb522291bca6659e

SHA256
5ab758401c25586c1f40efcb4b750e19605ccb5cf3695cdbecada7aa18ceff62

SHA512
7abbbf860db38ad5f081a6eb2f78313face0604ed7d594e33940ffea81e8b9b3bb3c39077eddd911e46ab9d016ecb117527afa9dc3b60fbd6e335599f84b41ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\5bc4V3lt5Q.bat

Filesize
191B

MD5
9990b814a8b82c9e4ee2e3c753dc00ac

SHA1
8ebe64e6d3e47118bfbd908672efe291fc034120

SHA256
416ffc415d7cfbd70305c7abaa3b391f66d83818343f10b9140de6f12b32736d

SHA512
855ee5c2598fb4cca1cc2f5a4624ea1fa7e26938f506ddba9a5a44ab0547f52590e1e39e13f089ce5d23490bf61afa99bdf2a77309008f4ae22fcf988dcfd2f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\5ixwcMXCIg.bat

Filesize
191B

MD5
9f1f2a4111d6c7f792a1b32c520bbd44

SHA1
3121db56325f156f554ade810e4bd49fb130af84

SHA256
3691b7214e321cb9e750034f242deda5f9c358eca8234450fd717cbdc05f0ff3

SHA512
242d91f8f37102a2a2d84c24d0dcceaa2a4e030ef5ec0f0ef673ad1f14f5146731161484141c5af4b778729b6da8129a4a877f1a126ed6092ca4b492ab73e717

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ouYA2TrKB.bat

Filesize
191B

MD5
ba53cd6e6dcc97f9849dff122405783d

SHA1
d5cac9a4b62b76507022d713b65ddbe9ea40fca4

SHA256
e6532e5c0c67f852265c0bfb361cb1c321e48f8a63a41bcd87154c5fbfb5da15

SHA512
f3c8a1e0b8fbcc6c0bfe4a3b565920d49eb3448def6dd7ba2bd8ab9cedf2052d6df8e25b064f15ee4d46855a2c46d61986f4dde412f84002ccaa60ef6f4cf7be

Download Submit
C:\Users\Admin\AppData\Local\Temp\B7rL9EqqPR.bat

Filesize
191B

MD5
ab83f0defbd453769e64b9577832b2d5

SHA1
1767d82f524d072012b04a470e77b113ff5c76db

SHA256
9b9456dd16c20b21db97b87ce00add5df4a7eabe4216d270b39bb14cc116edb2

SHA512
4ad64569547508e3c29ce7ffc3acc87f807e1ff522beb282b64eb9950897082889af7a3c5b5f31ef99afeaa582f7be487d0fa3ee40231e2ae6cc9a00e6868fa4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6C4C.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\LdHmevWlG3.bat

Filesize
191B

MD5
636109c61b7d2f379c11bfba0f66b55e

SHA1
e23d21a4211e6c6b362caa66ba70f889fcaf7106

SHA256
598eedad905afd9f894c8fb36babd12e076769085f889782547909fde0e445e1

SHA512
5d298481c1d29963c786fdcb6b5cb10e23b5f16aaa5c69abacd1f60945cced3d594ccdd8d2dff6267e2fc68bf09776e30aec029cc55cb162a164ddb79af0eeae

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6C4F.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\UyITBGB0nG.bat

Filesize
191B

MD5
b48e9c449538341b2c632b8ccc634ef1

SHA1
f69e9b5511b70ca0a2a8e079e2c59e9095cf3644

SHA256
9f24dbc1dd383b0f7068c9f26bb199e82f5b2f25b6b72f5f661417c12cc12261

SHA512
5b152d3bbfbf1cf9907b4612b9ecbff4bf921e5d55dcd2ad0920253ff12285b42565252e2bbea92d6d69018b7e0336c975a063c89b18fc524a07c0f168aa553f

Download Submit
C:\Users\Admin\AppData\Local\Temp\WtKWrLEt72.bat

Filesize
191B

MD5
b0360ea8c9820cc4d7749af46bec7c64

SHA1
3b632664e1b88d8656e51ce09cb8e157d040d3eb

SHA256
3710055fd0374741a1a9da3f2a87c85b8b1fdd2958230aa024c417fe0a5e3b68

SHA512
2dbb7dbac369b10fe0dd0abb6fad01a4cb5948846ac464146c1a03e1223610bf157ec42fa0d4ced8e5835f574911ec1cc3c2c6245c270ae18534c6cc06b8629a

Download Submit
C:\Users\Admin\AppData\Local\Temp\cwtcXGf4Cf.bat

Filesize
191B

MD5
33fe8bb88b5d4fd164171be4fa2fae68

SHA1
22703b16fa68cba1776b6885f43638f5f7db0f79

SHA256
feeb2b03bd066f007bf104e0dac80055b99d3c205d68c0822f8ddcd3984fba7b

SHA512
38177c26713c51f5b888608b97e0eec18c9bbc83934c1205e685076793e41247aebd3db5417b2406f3cdcfa4df0ce05c5a5e338584cd4cc842b62e08452b562e

Download Submit
C:\Users\Admin\AppData\Local\Temp\yMeEqlK1gO.bat

Filesize
191B

MD5
a0d40ccc609a80bfc1662a2526dc3b50

SHA1
79be5331d185deb0adadcd448f609f940dc3e140

SHA256
1ba73426d5737c86a92f59c62ca2687932d91b724304cfd9525981985cdacaab

SHA512
db8ae8b2effd406ff2ac5c8a769cdf99b25867cf1e90eab993febd3035a935854d1b06d55932f6ffd20305f8358da4bd67e6893a0e9a192c3c3dc430654b7541

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
87e92d15e3bed06ad4b0c2ef2621d6c7

SHA1
016243f5202a338ae49dfd7347be5c9b0f45e1f1

SHA256
7b93b1891cba7ee7500f6335926ba33e6531506863d8fa64b0b1c1bf98467b34

SHA512
6f1afe0d130393de9f9c76e7c9b46bf808eedc9c604edc6117cacb3a5e75c2f36e95ad15a9f4639950b468bc23b5dcb79b170d097d0ad43b1c1a0872ddd0c14d

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
memory/1000-681-0x0000000000D40000-0x0000000000E50000-memory.dmp

Filesize
1.1MB

Download
memory/1380-741-0x0000000000350000-0x0000000000362000-memory.dmp

Filesize
72KB

Download
memory/1512-261-0x00000000011B0000-0x00000000012C0000-memory.dmp

Filesize
1.1MB

Download
memory/1600-621-0x0000000000350000-0x0000000000362000-memory.dmp

Filesize
72KB

Download
memory/1600-620-0x0000000000A30000-0x0000000000B40000-memory.dmp

Filesize
1.1MB

Download
memory/2108-560-0x0000000000200000-0x0000000000310000-memory.dmp

Filesize
1.1MB

Download
memory/2108-321-0x0000000000190000-0x00000000002A0000-memory.dmp

Filesize
1.1MB

Download
memory/2220-381-0x0000000000F90000-0x00000000010A0000-memory.dmp

Filesize
1.1MB

Download
memory/2652-86-0x000000001B650000-0x000000001B932000-memory.dmp

Filesize
2.9MB

Download
memory/2656-16-0x0000000000560000-0x000000000056C000-memory.dmp

Filesize
48KB

Download
memory/2656-15-0x0000000000570000-0x000000000057C000-memory.dmp

Filesize
48KB

Download
memory/2656-17-0x0000000000580000-0x000000000058C000-memory.dmp

Filesize
48KB

Download
memory/2656-14-0x0000000000550000-0x0000000000562000-memory.dmp

Filesize
72KB

Download
memory/2656-13-0x0000000000340000-0x0000000000450000-memory.dmp

Filesize
1.1MB

Download
memory/2768-441-0x0000000000FB0000-0x00000000010C0000-memory.dmp

Filesize
1.1MB

Download
memory/2832-87-0x0000000001D20000-0x0000000001D28000-memory.dmp

Filesize
32KB

Download
memory/2956-56-0x00000000001E0000-0x00000000002F0000-memory.dmp

Filesize
1.1MB

Download
memory/2968-201-0x0000000000110000-0x0000000000220000-memory.dmp

Filesize
1.1MB

Download