dcrat | fb0bc4298bd226e11aed1385000863710a549373cd880260bd452ba34f63521d

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22-12-2024 09:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_fb0bc4298bd226e11aed1385000863710a549373cd880260bd452ba34f63521d.exe
Size

1.3MB
MD5

379aa0d269ed327c05fda922fd789f94
SHA1

8d3188283968aff545ad9ae97924a80c075025f0
SHA256

fb0bc4298bd226e11aed1385000863710a549373cd880260bd452ba34f63521d
SHA512

c71dd051d85a16e98cd8701b2a976848b5a221bda4f76511e736f771627a7cb3db242f8841bfab1d6b26c8828e45b70a26ff4c5f7728ba99ead84aa4fabd1186
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 42 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2812	2760	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2576	2760	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2728	2760	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2596	2760	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2704	2760	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1708	2760	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2584	2760	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2632	2760	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3024	2760	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2992	2760	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1972	2760	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1180	2760	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	396	2760	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1296	2760	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1660	2760	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2000	2760	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2272	2760	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2476	2760	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1548	2760	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	380	2760	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	584	2760	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1756	2760	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2880	2760	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1644	2760	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2164	2760	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2192	2760	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2136	2760	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2208	2760	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2784	2760	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1472	2760	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1208	2760	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1144	2760	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	844	2760	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1204	2760	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1236	2760	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1272	2760	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2344	2760	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2076	2760	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1552	2760	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1372	2760	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2216	2760	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	764	2760	schtasks.exe	34

DCRat payload 12 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x00060000000186c8-9.dat	dcrat
behavioral1/memory/2536-13-0x00000000009D0000-0x0000000000AE0000-memory.dmp	dcrat
behavioral1/memory/2620-126-0x0000000000290000-0x00000000003A0000-memory.dmp	dcrat
behavioral1/memory/1992-185-0x00000000008C0000-0x00000000009D0000-memory.dmp	dcrat
behavioral1/memory/2900-245-0x0000000000D80000-0x0000000000E90000-memory.dmp	dcrat
behavioral1/memory/1576-364-0x0000000000050000-0x0000000000160000-memory.dmp	dcrat
behavioral1/memory/1508-425-0x0000000000AE0000-0x0000000000BF0000-memory.dmp	dcrat
behavioral1/memory/1600-485-0x0000000000C90000-0x0000000000DA0000-memory.dmp	dcrat
behavioral1/memory/1588-545-0x0000000000320000-0x0000000000430000-memory.dmp	dcrat
behavioral1/memory/1924-605-0x0000000000940000-0x0000000000A50000-memory.dmp	dcrat
behavioral1/memory/2964-665-0x0000000000B50000-0x0000000000C60000-memory.dmp	dcrat
behavioral1/memory/1208-725-0x00000000000F0000-0x0000000000200000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 15 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2868	powershell.exe
2100	powershell.exe
2820	powershell.exe
2968	powershell.exe
2516	powershell.exe
2468	powershell.exe
2964	powershell.exe
3048	powershell.exe
792	powershell.exe
2368	powershell.exe
2304	powershell.exe
1888	powershell.exe
1500	powershell.exe
2320	powershell.exe
2940	powershell.exe

Executes dropped EXE 12 IoCs

pid	Process
2536	DllCommonsvc.exe
2620	winlogon.exe
1992	winlogon.exe
2900	winlogon.exe
2568	winlogon.exe
1576	winlogon.exe
1508	winlogon.exe
1600	winlogon.exe
1588	winlogon.exe
1924	winlogon.exe
2964	winlogon.exe
1208	winlogon.exe

Loads dropped DLL 2 IoCs

pid	Process
1916	cmd.exe
1916	cmd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 11 IoCs

Web Service

T1102

flow	ioc
9	raw.githubusercontent.com
16	raw.githubusercontent.com
23	raw.githubusercontent.com
29	raw.githubusercontent.com
32	raw.githubusercontent.com
4	raw.githubusercontent.com
5	raw.githubusercontent.com
26	raw.githubusercontent.com
35	raw.githubusercontent.com
12	raw.githubusercontent.com
19	raw.githubusercontent.com

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\101b941d020240	DllCommonsvc.exe
File created	C:\Program Files\Microsoft Games\Purble Place\en-US\OSPPSVC.exe	DllCommonsvc.exe
File created	C:\Program Files\Microsoft Games\Purble Place\en-US\1610b97d3ab4a7	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\services.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\c5b4cb5e9653cc	DllCommonsvc.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\lsm.exe	DllCommonsvc.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\tracing\csrss.exe	DllCommonsvc.exe
File created	C:\Windows\tracing\886983d96e3d3e	DllCommonsvc.exe
File created	C:\Windows\Cursors\dwm.exe	DllCommonsvc.exe
File created	C:\Windows\Cursors\6cb0b6c459d5d3	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_fb0bc4298bd226e11aed1385000863710a549373cd880260bd452ba34f63521d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 42 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2192	schtasks.exe
2136	schtasks.exe
2728	schtasks.exe
1972	schtasks.exe
1660	schtasks.exe
2272	schtasks.exe
2576	schtasks.exe
2596	schtasks.exe
1180	schtasks.exe
2476	schtasks.exe
2076	schtasks.exe
764	schtasks.exe
2632	schtasks.exe
1644	schtasks.exe
1472	schtasks.exe
1208	schtasks.exe
396	schtasks.exe
1272	schtasks.exe
1552	schtasks.exe
2208	schtasks.exe
2584	schtasks.exe
1296	schtasks.exe
380	schtasks.exe
1756	schtasks.exe
844	schtasks.exe
1204	schtasks.exe
1236	schtasks.exe
2344	schtasks.exe
3024	schtasks.exe
2000	schtasks.exe
1548	schtasks.exe
584	schtasks.exe
2216	schtasks.exe
2812	schtasks.exe
2704	schtasks.exe
2992	schtasks.exe
2880	schtasks.exe
1372	schtasks.exe
1708	schtasks.exe
2164	schtasks.exe
2784	schtasks.exe
1144	schtasks.exe

Suspicious behavior: EnumeratesProcesses 31 IoCs

pid	Process
2536	DllCommonsvc.exe
2536	DllCommonsvc.exe
2536	DllCommonsvc.exe
2536	DllCommonsvc.exe
2536	DllCommonsvc.exe
2304	powershell.exe
2468	powershell.exe
2868	powershell.exe
2968	powershell.exe
2820	powershell.exe
2320	powershell.exe
2100	powershell.exe
2368	powershell.exe
792	powershell.exe
1500	powershell.exe
2964	powershell.exe
1888	powershell.exe
3048	powershell.exe
2940	powershell.exe
2516	powershell.exe
2620	winlogon.exe
1992	winlogon.exe
2900	winlogon.exe
2568	winlogon.exe
1576	winlogon.exe
1508	winlogon.exe
1600	winlogon.exe
1588	winlogon.exe
1924	winlogon.exe
2964	winlogon.exe
1208	winlogon.exe

Suspicious use of AdjustPrivilegeToken 27 IoCs

description	pid	Process
Token: SeDebugPrivilege	2536	DllCommonsvc.exe
Token: SeDebugPrivilege	2304	powershell.exe
Token: SeDebugPrivilege	2468	powershell.exe
Token: SeDebugPrivilege	2868	powershell.exe
Token: SeDebugPrivilege	2968	powershell.exe
Token: SeDebugPrivilege	2820	powershell.exe
Token: SeDebugPrivilege	2320	powershell.exe
Token: SeDebugPrivilege	2100	powershell.exe
Token: SeDebugPrivilege	2368	powershell.exe
Token: SeDebugPrivilege	792	powershell.exe
Token: SeDebugPrivilege	1500	powershell.exe
Token: SeDebugPrivilege	2964	powershell.exe
Token: SeDebugPrivilege	1888	powershell.exe
Token: SeDebugPrivilege	3048	powershell.exe
Token: SeDebugPrivilege	2940	powershell.exe
Token: SeDebugPrivilege	2516	powershell.exe
Token: SeDebugPrivilege	2620	winlogon.exe
Token: SeDebugPrivilege	1992	winlogon.exe
Token: SeDebugPrivilege	2900	winlogon.exe
Token: SeDebugPrivilege	2568	winlogon.exe
Token: SeDebugPrivilege	1576	winlogon.exe
Token: SeDebugPrivilege	1508	winlogon.exe
Token: SeDebugPrivilege	1600	winlogon.exe
Token: SeDebugPrivilege	1588	winlogon.exe
Token: SeDebugPrivilege	1924	winlogon.exe
Token: SeDebugPrivilege	2964	winlogon.exe
Token: SeDebugPrivilege	1208	winlogon.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 2328	1976	JaffaCakes118_fb0bc4298bd226e11aed1385000863710a549373cd880260bd452ba34f63521d.exe	30
PID 1976 wrote to memory of 2328	1976	JaffaCakes118_fb0bc4298bd226e11aed1385000863710a549373cd880260bd452ba34f63521d.exe	30
PID 1976 wrote to memory of 2328	1976	JaffaCakes118_fb0bc4298bd226e11aed1385000863710a549373cd880260bd452ba34f63521d.exe	30
PID 1976 wrote to memory of 2328	1976	JaffaCakes118_fb0bc4298bd226e11aed1385000863710a549373cd880260bd452ba34f63521d.exe	30
PID 2328 wrote to memory of 1916	2328	WScript.exe	31
PID 2328 wrote to memory of 1916	2328	WScript.exe	31
PID 2328 wrote to memory of 1916	2328	WScript.exe	31
PID 2328 wrote to memory of 1916	2328	WScript.exe	31
PID 1916 wrote to memory of 2536	1916	cmd.exe	33
PID 1916 wrote to memory of 2536	1916	cmd.exe	33
PID 1916 wrote to memory of 2536	1916	cmd.exe	33
PID 1916 wrote to memory of 2536	1916	cmd.exe	33
PID 2536 wrote to memory of 2468	2536	DllCommonsvc.exe	77
PID 2536 wrote to memory of 2468	2536	DllCommonsvc.exe	77
PID 2536 wrote to memory of 2468	2536	DllCommonsvc.exe	77
PID 2536 wrote to memory of 2304	2536	DllCommonsvc.exe	78
PID 2536 wrote to memory of 2304	2536	DllCommonsvc.exe	78
PID 2536 wrote to memory of 2304	2536	DllCommonsvc.exe	78
PID 2536 wrote to memory of 2820	2536	DllCommonsvc.exe	79
PID 2536 wrote to memory of 2820	2536	DllCommonsvc.exe	79
PID 2536 wrote to memory of 2820	2536	DllCommonsvc.exe	79
PID 2536 wrote to memory of 2968	2536	DllCommonsvc.exe	80
PID 2536 wrote to memory of 2968	2536	DllCommonsvc.exe	80
PID 2536 wrote to memory of 2968	2536	DllCommonsvc.exe	80
PID 2536 wrote to memory of 2940	2536	DllCommonsvc.exe	81
PID 2536 wrote to memory of 2940	2536	DllCommonsvc.exe	81
PID 2536 wrote to memory of 2940	2536	DllCommonsvc.exe	81
PID 2536 wrote to memory of 2100	2536	DllCommonsvc.exe	84
PID 2536 wrote to memory of 2100	2536	DllCommonsvc.exe	84
PID 2536 wrote to memory of 2100	2536	DllCommonsvc.exe	84
PID 2536 wrote to memory of 2964	2536	DllCommonsvc.exe	86
PID 2536 wrote to memory of 2964	2536	DllCommonsvc.exe	86
PID 2536 wrote to memory of 2964	2536	DllCommonsvc.exe	86
PID 2536 wrote to memory of 3048	2536	DllCommonsvc.exe	87
PID 2536 wrote to memory of 3048	2536	DllCommonsvc.exe	87
PID 2536 wrote to memory of 3048	2536	DllCommonsvc.exe	87
PID 2536 wrote to memory of 2320	2536	DllCommonsvc.exe	88
PID 2536 wrote to memory of 2320	2536	DllCommonsvc.exe	88
PID 2536 wrote to memory of 2320	2536	DllCommonsvc.exe	88
PID 2536 wrote to memory of 792	2536	DllCommonsvc.exe	89
PID 2536 wrote to memory of 792	2536	DllCommonsvc.exe	89
PID 2536 wrote to memory of 792	2536	DllCommonsvc.exe	89
PID 2536 wrote to memory of 2868	2536	DllCommonsvc.exe	90
PID 2536 wrote to memory of 2868	2536	DllCommonsvc.exe	90
PID 2536 wrote to memory of 2868	2536	DllCommonsvc.exe	90
PID 2536 wrote to memory of 1500	2536	DllCommonsvc.exe	91
PID 2536 wrote to memory of 1500	2536	DllCommonsvc.exe	91
PID 2536 wrote to memory of 1500	2536	DllCommonsvc.exe	91
PID 2536 wrote to memory of 1888	2536	DllCommonsvc.exe	92
PID 2536 wrote to memory of 1888	2536	DllCommonsvc.exe	92
PID 2536 wrote to memory of 1888	2536	DllCommonsvc.exe	92
PID 2536 wrote to memory of 2516	2536	DllCommonsvc.exe	102
PID 2536 wrote to memory of 2516	2536	DllCommonsvc.exe	102
PID 2536 wrote to memory of 2516	2536	DllCommonsvc.exe	102
PID 2536 wrote to memory of 2368	2536	DllCommonsvc.exe	103
PID 2536 wrote to memory of 2368	2536	DllCommonsvc.exe	103
PID 2536 wrote to memory of 2368	2536	DllCommonsvc.exe	103
PID 2536 wrote to memory of 2148	2536	DllCommonsvc.exe	107
PID 2536 wrote to memory of 2148	2536	DllCommonsvc.exe	107
PID 2536 wrote to memory of 2148	2536	DllCommonsvc.exe	107
PID 2148 wrote to memory of 2408	2148	cmd.exe	109
PID 2148 wrote to memory of 2408	2148	cmd.exe	109
PID 2148 wrote to memory of 2408	2148	cmd.exe	109
PID 2148 wrote to memory of 2620	2148	cmd.exe	111

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_fb0bc4298bd226e11aed1385000863710a549373cd880260bd452ba34f63521d.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_fb0bc4298bd226e11aed1385000863710a549373cd880260bd452ba34f63521d.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2328
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1916
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2536
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2468
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\spoolsv.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2304
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\System.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2820
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Cursors\dwm.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2968
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\winlogon.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2940
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\spoolsv.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2100
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\lsm.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2964
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\tracing\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3048
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Microsoft Games\Purble Place\en-US\OSPPSVC.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2320
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\services.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:792
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Adobe\Updater6\conhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2868
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Mozilla Maintenance Service\logs\lsm.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1500
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\System.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1888
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\wininit.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2516
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Application Data\wininit.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2368
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\OW5v6OfRjY.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2148
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:2408
      - C:\Users\Default User\winlogon.exe
        
        "C:\Users\Default User\winlogon.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2620
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\unLkZH0FaU.bat"
        7⤵
        
        PID:2972
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:988
        
        C:\Users\Default User\winlogon.exe
        
        "C:\Users\Default User\winlogon.exe"
        8⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1992
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\H7kUlUtrsw.bat"
        9⤵
        
        PID:3036
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:2840
        
        C:\Users\Default User\winlogon.exe
        
        "C:\Users\Default User\winlogon.exe"
        10⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2900
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\a1rZrAbBst.bat"
        11⤵
        
        PID:1620
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:2104
        
        C:\Users\Default User\winlogon.exe
        
        "C:\Users\Default User\winlogon.exe"
        12⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2568
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\yMeEqlK1gO.bat"
        13⤵
        
        PID:2272
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        14⤵
        
        PID:1660
        
        C:\Users\Default User\winlogon.exe
        
        "C:\Users\Default User\winlogon.exe"
        14⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1576
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\EH4KCibIlQ.bat"
        15⤵
        
        PID:2092
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        16⤵
        
        PID:2580
        
        C:\Users\Default User\winlogon.exe
        
        "C:\Users\Default User\winlogon.exe"
        16⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1508
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\LdHmevWlG3.bat"
        17⤵
        
        PID:1696
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        18⤵
        
        PID:2108
        
        C:\Users\Default User\winlogon.exe
        
        "C:\Users\Default User\winlogon.exe"
        18⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1600
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\vhzsSyDvNE.bat"
        19⤵
        
        PID:1092
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        20⤵
        
        PID:1248
        
        C:\Users\Default User\winlogon.exe
        
        "C:\Users\Default User\winlogon.exe"
        20⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1588
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\9dhy3B39XM.bat"
        21⤵
        
        PID:2872
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        22⤵
        
        PID:2500
        
        C:\Users\Default User\winlogon.exe
        
        "C:\Users\Default User\winlogon.exe"
        22⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1924
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\XErLL4imMU.bat"
        23⤵
        
        PID:1904
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        24⤵
        
        PID:1800
        
        C:\Users\Default User\winlogon.exe
        
        "C:\Users\Default User\winlogon.exe"
        24⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2964
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\NpgWdIWSbT.bat"
        25⤵
        
        PID:960
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        26⤵
        
        PID:2196
        
        C:\Users\Default User\winlogon.exe
        
        "C:\Users\Default User\winlogon.exe"
        26⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\MSOCache\All Users\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\Windows\Cursors\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\Cursors\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\Windows\Cursors\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 12 /tr "'C:\Users\Default User\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Users\Default User\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'C:\Users\Default User\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1180

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 11 /tr "'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1296

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 5 /tr "'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2272

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 11 /tr "'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Windows\tracing\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\tracing\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Windows\tracing\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 7 /tr "'C:\Program Files\Microsoft Games\Purble Place\en-US\OSPPSVC.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Program Files\Microsoft Games\Purble Place\en-US\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 8 /tr "'C:\Program Files\Microsoft Games\Purble Place\en-US\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2164

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2192

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2136

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\Adobe\Updater6\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Users\All Users\Adobe\Updater6\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 11 /tr "'C:\Users\All Users\Adobe\Updater6\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 7 /tr "'C:\providercommon\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1204

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\providercommon\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 11 /tr "'C:\providercommon\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1272

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2344

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Users\Default User\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\Users\Default User\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 6 /tr "'C:\Users\All Users\Application Data\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Users\All Users\Application Data\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\Application Data\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a8a2ea4f92ff41fcdb70259df28c57d0

SHA1
ee71eb66527d7ae5fef15fdc5cb8a95e1eafaa5b

SHA256
3eaab257e5dede14f0bd5a87c20309934e095893be3d6016ee1a598f4d2d2e67

SHA512
ae15e7970252966109c7a573b4295b7b13116692069cf185269f175eb99fc571b4dc48a7f98701cb04ff12d7bab5ae0cdef8dc791c32862a62fb0774f10a1f25

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
562e1e0464a7816c09a6125355bc88bd

SHA1
a8337bab95449564266b4c06612caac652080c7e

SHA256
30583fbcbdc1362ba34a2793db31fb3250ad44d83957921134a291040bc664c7

SHA512
2966a61aeb77edc65d16f8a223bb087a84fb43d1dda0341023c4eb60b4af923cb052a68d6c3d83447538b9c6f56ebb19eedc48f299e268df6a8122de59f751cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aff93ad3740dbf326ffe53a278feed72

SHA1
3ac3f0898a67651269a2406d5b3a9dd110d79ddc

SHA256
d0f7ff1dec646f987816678f7993853354b8ab7722c9ad8e26090f234bf004dd

SHA512
1bec1b9bf0b0618fb265649c47802ae47131711a805b1547f94dd9ab8dea4bdbc2ff2ea2235dfa9917eb224914df829db9d472faa00693c759b53e811bf93509

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8d10c14c231ff9b3394c4b98753f6576

SHA1
fe0455abba58f3e79aa48c17455504e689ae22ea

SHA256
e6ca5bad3939bbcb41f2a9edea3e94a286b03cc1879440e0ec2d85587bf83a5c

SHA512
c15b864fec8f29137507f52cdade95cae48e303446a6681ba6876f66e4d33d37729bbb6209877bb909f3955f5bd6e8ca25f07d462b3fef48c7271c35daf4e696

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
567f338fb2b5a02c821cacfce0c48b74

SHA1
9d587dea098e77c5c6129a8a1cfdd782091e3ecd

SHA256
7fea3c914116955d7c674122980eb4ad837945294f2268ccff2a4e8f04ab387a

SHA512
dbbe88e11f58adf815d88124708cf800ff5d12720e5f303d4c4e2460df70eae49889de12ff1499cd000364a2fc57ea959c5ce5ec40e992a69cd84027a06820aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c90bb823e724db6f554f2bf00f43bca7

SHA1
847ed59f435718a852c5bc3f202278b77b4bcde3

SHA256
23dfccd52f75e62d794bab1d7278f719f57b09430c0dcb99965add2f23691b21

SHA512
fa1ac86d92686e726dd9b004d6d7c7acb2be1d4104ed06560d10735293137392f66686e0d8d7a7936b270b1b9f1aa392eb94eea1cfb3080acf2c25140a967e07

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f0796f543ff2e3541a82b1b881317656

SHA1
86b6f6e02978470bced0352258494ebf524e98dd

SHA256
f498db4600a9221a5da73ccf2bce438e21ce4ce6cafdc4a5d0014ed30b3428ce

SHA512
716014ce4744b8853a56e3c32893b26ebd95f35c26799bc12a0aa90a5ade5c88746bc93af88aeef76551af9e9e586fc8c324b4c556cce926a0f752403c721c07

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fed4b6a09ec4f77b000ed00cfdb775af

SHA1
cc720631fa71e032e075fca63a5e9aa29f74a4d1

SHA256
a929d7ee48ae7aee2d7d8a8a9b85d1dc215300f7fae318871148f1c12320f519

SHA512
3e5e8049141a30e4e8ff215683a9ecd406b60770399da5648bcedd3b6b2727e9a6939ea27226d0937e02c2c1c503e820f6505a00d94659ad0ada0798bd1555d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1ce3b60fa21bd2c81bec68a1adf624d9

SHA1
7e6fb0a1d78524a7b3fb3099870c3760bd523231

SHA256
3fd0e32d98425386716627f2b6f589a367f26b82b072a61a717a859d25d05a05

SHA512
9dd7635a69be10f8cc0bea9f677e5931bba20f165e2a5da265c932250f3b9d5d55360e45c095433cedd35496d1e0b0ea4cf88fb3cfabd5306a5dd21096b6485f

Download Submit
C:\Users\Admin\AppData\Local\Temp\9dhy3B39XM.bat

Filesize
199B

MD5
99ccd3afb7a081384687bf5144e3c7e2

SHA1
e587b852103ae755884f0097b0ff8c1cce33be17

SHA256
8b07c9f9bdb98fed316439228e1cb17b96521fbc5ab13dbf816b222e1e0c26df

SHA512
bdb0205e4099c6dd0d05c4a22cafda235747376cf69b41fa50131e73ee12d70f177ff730845586ffb7543164de9d85496ed1f1ad6f06ec196ffe501064c64713

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabECE0.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\EH4KCibIlQ.bat

Filesize
199B

MD5
01704575bcac0d96c53c4fd417e4969b

SHA1
24ab8e09b78d3d7cbc56843096af680e4a1728f6

SHA256
e36c7fd325226742fe66c1bc0bdbda886f1d84638f2b3f827d7fff9f5cbb5590

SHA512
7550d23f23b0992c67b7dc29afe9a338ded337c86b965258d13456359f3bfc6efcbdb750c8cce6343dfbd262c0304cdc4bd7eed53ea37b5559673787f3a2b0db

Download Submit
C:\Users\Admin\AppData\Local\Temp\H7kUlUtrsw.bat

Filesize
199B

MD5
8d3ba5b52eb83c9a81e6b878f72f3bee

SHA1
3113ec0ba02e7da992f50b487cb957359b63987c

SHA256
1cb0f24e9b592be7111b7446af8e8916daf08a491daa9f3f764d005028d408fb

SHA512
abfd046077dae0db920e602b82edcc367429c6c95d321916c99d13a671b31508c7d2248a169b80774f5f969e6f674546b82d430bd2341db9cc94e585bbc885e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\LdHmevWlG3.bat

Filesize
199B

MD5
f13b7d68765f3fb95879f5e7a3c80cf1

SHA1
500aef44b151a26dca55d16cdc090f86c1c3b77a

SHA256
97a220198b176f62cdb56213e7c1e9bf8b7b466bbf73458ca488fa2201f9e7d7

SHA512
300f6ffe5f34e945db8fb2e57d3644881576a5b094ca107da0ecda7560b8485ee9f30816e0781905c978623dd27541b933d094772d91cd52fe8e48a03008e910

Download Submit
C:\Users\Admin\AppData\Local\Temp\NpgWdIWSbT.bat

Filesize
199B

MD5
34273cdab614dd814e49b6826a4f7283

SHA1
0046ef2ec17ca59690074b9af33998fcd56b97ee

SHA256
8c480f8018d9ddd1abeececae3f55c604745710a336db4430dc30ab5c1a4d3eb

SHA512
a9bd4b8ea97f41fa8edce54abb30c5d8a4c4077e4071bee7c2f620fd65745724e7b75fd1a34350ce07a5d34bbfdf657e7ef4e3e7e8ad59739298837da811f68e

Download Submit
C:\Users\Admin\AppData\Local\Temp\OW5v6OfRjY.bat

Filesize
199B

MD5
859c4b150d0354bda660fb3f75a9891a

SHA1
8e5d2c134de46c1ace7c01a2d36f496ca51a36a2

SHA256
1fb88c622a1a07d2ac363b0923f92904c58528d20fb05aa9fbca3feb8f51c080

SHA512
c72ab62717ffa3b5bdbde7eac2cb735f7452ff5f434136e7e1836bcb8020fad7d7d8003031036e44645221ff3e657a5433ebf90bdf3dab5ac0c5e384b3b57eb9

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarED03.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\XErLL4imMU.bat

Filesize
199B

MD5
49c0a2cdff03be855c979913ae1a9e41

SHA1
4cff9ac692235d31305a433fdbbd860bbdab63e1

SHA256
04dbd78c04df9431441ea796afa403565186e197cb75fbed22315f2edef7546b

SHA512
e37bfba58da18bcc525a0a35edded7d79e5cbee1a7a48ab3e0fb1093fd44104f3a3872560a5b832f1084c24cfd7ff848b2f9e9180169530f31f49cbd54f572c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\a1rZrAbBst.bat

Filesize
199B

MD5
17ecc1229f051fab4aa72ee0ea3d3229

SHA1
2a3e91f9153e12bde13dc06891165541be7a91b6

SHA256
2dcf641b680074e5738b7a6016e159ff33d6a3ce3c4b9654baabf12514e7758b

SHA512
6a0ef1475a3c5ec9ad03556a5f9589f99f43fe15205ce3037fc7aa3b7fc06179b1b6ac907031e0632a0a8303d5370ebe4e8a8c365067de2521761382669dceca

Download Submit
C:\Users\Admin\AppData\Local\Temp\unLkZH0FaU.bat

Filesize
199B

MD5
aa53ec9e76804331f02178b0c463b891

SHA1
599f9f2dd762ed4f208d3cf62c6f356c0ec3ce43

SHA256
4963e19cde10226d3adfa5bfa8463a2bd7e38be4a3aac5771656aa437b2cb604

SHA512
32c16db4c326e83602827ffa003bf67c8cc5ced0a62b7fe43a369b6f94e25aab7d212f97cc5b73ae645cc209acb77a99f5f22222a90cf6f21c8a46a9896af5ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\vhzsSyDvNE.bat

Filesize
199B

MD5
f0bbf7429fe89d63c5eb965b6b6c2c6e

SHA1
e101a808dfcea88e93d65a5014615e80dc4f0dda

SHA256
af5563751d202ccd5d446c168e3495777ac0f893f39833a1303ad3920a066962

SHA512
7aa709208ebff2c59a80f6af0d3b27d849c901bfcb6f0c9be918758d6c679f8c251071f39bb7355d340bd22dd41f337234c41d4830d34ce70501e86a9386dd57

Download Submit
C:\Users\Admin\AppData\Local\Temp\yMeEqlK1gO.bat

Filesize
199B

MD5
17b298be5310dfd884127edbd3721fa5

SHA1
1c490e7a08276e001155895fde8eac2b8ef6031d

SHA256
f4dff583bdf9b6cbb24fa4431baf1c5d58839656254a652083f111622a56b854

SHA512
7a0fd7fce0210b69fa2cd77e3a92a70926752a34e63619ecf9a3c702cc8e14157d9cc123444f5c8cc640cb79696e754009a78654e62691f26843c871cae89bcd

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5KOHTCUOPDI7DR9AO3CD.temp

Filesize
7KB

MD5
b0d693571cdfa4a21cf6157b7766037c

SHA1
ccd5e03da3e93f07f943cc6f8e5bd94ceba2c782

SHA256
3cfc7a6d03a57f4f43d5db457d804f54d7e6bb092424a8271e68679bcb8c5937

SHA512
4efbc735837fcb156022f2a932a9eff13216fa34059a1fcb53bd002b3fda3ed3bbceebbf6d73da7be00afc30ca39a7ec938737ff11863ddc9b3bf1a16f57ce36

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
memory/1208-725-0x00000000000F0000-0x0000000000200000-memory.dmp

Filesize
1.1MB

Download
memory/1508-425-0x0000000000AE0000-0x0000000000BF0000-memory.dmp

Filesize
1.1MB

Download
memory/1576-365-0x0000000000540000-0x0000000000552000-memory.dmp

Filesize
72KB

Download
memory/1576-364-0x0000000000050000-0x0000000000160000-memory.dmp

Filesize
1.1MB

Download
memory/1588-545-0x0000000000320000-0x0000000000430000-memory.dmp

Filesize
1.1MB

Download
memory/1600-485-0x0000000000C90000-0x0000000000DA0000-memory.dmp

Filesize
1.1MB

Download
memory/1924-605-0x0000000000940000-0x0000000000A50000-memory.dmp

Filesize
1.1MB

Download
memory/1992-185-0x00000000008C0000-0x00000000009D0000-memory.dmp

Filesize
1.1MB

Download
memory/2304-56-0x0000000001DD0000-0x0000000001DD8000-memory.dmp

Filesize
32KB

Download
memory/2304-55-0x000000001B510000-0x000000001B7F2000-memory.dmp

Filesize
2.9MB

Download
memory/2536-16-0x0000000000300000-0x000000000030C000-memory.dmp

Filesize
48KB

Download
memory/2536-17-0x0000000000310000-0x000000000031C000-memory.dmp

Filesize
48KB

Download
memory/2536-15-0x00000000002E0000-0x00000000002EC000-memory.dmp

Filesize
48KB

Download
memory/2536-14-0x00000000002D0000-0x00000000002E2000-memory.dmp

Filesize
72KB

Download
memory/2536-13-0x00000000009D0000-0x0000000000AE0000-memory.dmp

Filesize
1.1MB

Download
memory/2620-126-0x0000000000290000-0x00000000003A0000-memory.dmp

Filesize
1.1MB

Download
memory/2900-245-0x0000000000D80000-0x0000000000E90000-memory.dmp

Filesize
1.1MB

Download
memory/2964-665-0x0000000000B50000-0x0000000000C60000-memory.dmp

Filesize
1.1MB

Download