dcrat | 9d380a759e6bcb5f49575b277d93af37f850e1378259c8887a8a78a30db6cd4f

Analysis

max time kernel
145s
max time network
140s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22/12/2024, 09:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_9d380a759e6bcb5f49575b277d93af37f850e1378259c8887a8a78a30db6cd4f.exe
Size

1.3MB
MD5

2828ef25efda46fcb885f592cf7e129d
SHA1

4df0d3927cd4ae37ba8b23bbf38eb9655705ae59
SHA256

9d380a759e6bcb5f49575b277d93af37f850e1378259c8887a8a78a30db6cd4f
SHA512

fd785bfa0b87cdb650ea6cd3c72b270bdf176dd0a62c613f6ec963fe57864019fa1a44076d5f4a60494906ad47e713f7aa956e3328d4cc4d827a04a64a9c0a80
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 42 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2896	1900	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2972	1900	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2764	1900	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2596	1900	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2612	1900	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2676	1900	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1408	1900	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2156	1900	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	648	1900	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	560	1900	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1628	1900	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2356	1900	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2840	1900	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2828	1900	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2944	1900	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1840	1900	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2584	1900	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1472	1900	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2128	1900	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	624	1900	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1508	1900	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2708	1900	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2864	1900	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2904	1900	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1272	1900	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2608	1900	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2056	1900	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1876	1900	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1788	1900	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	868	1900	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2976	1900	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2660	1900	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1288	1900	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1308	1900	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2596	1900	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2720	1900	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1996	1900	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2032	1900	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	840	1900	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1404	1900	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2840	1900	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2068	1900	schtasks.exe	34

DCRat payload 11 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x00080000000162b2-12.dat	dcrat
behavioral1/memory/2168-13-0x0000000001070000-0x0000000001180000-memory.dmp	dcrat
behavioral1/memory/1904-79-0x0000000001340000-0x0000000001450000-memory.dmp	dcrat
behavioral1/memory/2572-100-0x0000000000CB0000-0x0000000000DC0000-memory.dmp	dcrat
behavioral1/memory/1876-201-0x0000000000360000-0x0000000000470000-memory.dmp	dcrat
behavioral1/memory/576-262-0x0000000000330000-0x0000000000440000-memory.dmp	dcrat
behavioral1/memory/2332-322-0x0000000000F60000-0x0000000001070000-memory.dmp	dcrat
behavioral1/memory/2832-441-0x0000000000250000-0x0000000000360000-memory.dmp	dcrat
behavioral1/memory/1696-501-0x0000000001350000-0x0000000001460000-memory.dmp	dcrat
behavioral1/memory/1780-621-0x00000000002A0000-0x00000000003B0000-memory.dmp	dcrat
behavioral1/memory/1352-681-0x00000000000C0000-0x00000000001D0000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 16 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1120	powershell.exe
808	powershell.exe
1208	powershell.exe
2072	powershell.exe
700	powershell.exe
864	powershell.exe
2868	powershell.exe
2912	powershell.exe
1704	powershell.exe
2748	powershell.exe
2852	powershell.exe
2560	powershell.exe
2084	powershell.exe
2696	powershell.exe
2880	powershell.exe
832	powershell.exe

Executes dropped EXE 12 IoCs

pid	Process
2168	DllCommonsvc.exe
1904	DllCommonsvc.exe
2572	lsass.exe
1876	lsass.exe
576	lsass.exe
2332	lsass.exe
1664	lsass.exe
2832	lsass.exe
1696	lsass.exe
2512	lsass.exe
1780	lsass.exe
1352	lsass.exe

Loads dropped DLL 2 IoCs

pid	Process
2692	cmd.exe
2692	cmd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 10 IoCs

Web Service

T1102

flow	ioc
29	raw.githubusercontent.com
4	raw.githubusercontent.com
12	raw.githubusercontent.com
25	raw.githubusercontent.com
19	raw.githubusercontent.com
22	raw.githubusercontent.com
32	raw.githubusercontent.com
5	raw.githubusercontent.com
9	raw.githubusercontent.com
15	raw.githubusercontent.com

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows NT\TableTextService\b75386f1303e64	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\WmiPrvSE.exe	DllCommonsvc.exe
File opened for modification	C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\WmiPrvSE.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\24dbde2999530e	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows NT\TableTextService\taskhost.exe	DllCommonsvc.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\ehome\de-DE\taskhost.exe	DllCommonsvc.exe
File created	C:\Windows\ehome\de-DE\b75386f1303e64	DllCommonsvc.exe
File created	C:\Windows\PCHEALTH\ERRORREP\dwm.exe	DllCommonsvc.exe
File created	C:\Windows\PCHEALTH\ERRORREP\6cb0b6c459d5d3	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_9d380a759e6bcb5f49575b277d93af37f850e1378259c8887a8a78a30db6cd4f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 42 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
560	schtasks.exe
1508	schtasks.exe
2660	schtasks.exe
1288	schtasks.exe
1404	schtasks.exe
2612	schtasks.exe
2128	schtasks.exe
2608	schtasks.exe
2976	schtasks.exe
1272	schtasks.exe
1408	schtasks.exe
648	schtasks.exe
2584	schtasks.exe
2056	schtasks.exe
868	schtasks.exe
2840	schtasks.exe
2596	schtasks.exe
624	schtasks.exe
2708	schtasks.exe
2904	schtasks.exe
2720	schtasks.exe
2068	schtasks.exe
2840	schtasks.exe
2356	schtasks.exe
1876	schtasks.exe
1308	schtasks.exe
2596	schtasks.exe
2896	schtasks.exe
1472	schtasks.exe
2864	schtasks.exe
1788	schtasks.exe
2032	schtasks.exe
2944	schtasks.exe
2764	schtasks.exe
2676	schtasks.exe
2156	schtasks.exe
1628	schtasks.exe
2828	schtasks.exe
1840	schtasks.exe
1996	schtasks.exe
2972	schtasks.exe
840	schtasks.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
2168	DllCommonsvc.exe
700	powershell.exe
2084	powershell.exe
1704	powershell.exe
1120	powershell.exe
2696	powershell.exe
2560	powershell.exe
2072	powershell.exe
808	powershell.exe
1904	DllCommonsvc.exe
1904	DllCommonsvc.exe
1904	DllCommonsvc.exe
1904	DllCommonsvc.exe
1904	DllCommonsvc.exe
2880	powershell.exe
832	powershell.exe
2868	powershell.exe
864	powershell.exe
2912	powershell.exe
2748	powershell.exe
2852	powershell.exe
1208	powershell.exe
2572	lsass.exe
1876	lsass.exe
576	lsass.exe
2332	lsass.exe
1664	lsass.exe
2832	lsass.exe
1696	lsass.exe
2512	lsass.exe
1780	lsass.exe
1352	lsass.exe

Suspicious use of AdjustPrivilegeToken 28 IoCs

description	pid	Process
Token: SeDebugPrivilege	2168	DllCommonsvc.exe
Token: SeDebugPrivilege	700	powershell.exe
Token: SeDebugPrivilege	2084	powershell.exe
Token: SeDebugPrivilege	1704	powershell.exe
Token: SeDebugPrivilege	1120	powershell.exe
Token: SeDebugPrivilege	2696	powershell.exe
Token: SeDebugPrivilege	2560	powershell.exe
Token: SeDebugPrivilege	2072	powershell.exe
Token: SeDebugPrivilege	808	powershell.exe
Token: SeDebugPrivilege	1904	DllCommonsvc.exe
Token: SeDebugPrivilege	2880	powershell.exe
Token: SeDebugPrivilege	832	powershell.exe
Token: SeDebugPrivilege	2868	powershell.exe
Token: SeDebugPrivilege	864	powershell.exe
Token: SeDebugPrivilege	2912	powershell.exe
Token: SeDebugPrivilege	2748	powershell.exe
Token: SeDebugPrivilege	2852	powershell.exe
Token: SeDebugPrivilege	1208	powershell.exe
Token: SeDebugPrivilege	2572	lsass.exe
Token: SeDebugPrivilege	1876	lsass.exe
Token: SeDebugPrivilege	576	lsass.exe
Token: SeDebugPrivilege	2332	lsass.exe
Token: SeDebugPrivilege	1664	lsass.exe
Token: SeDebugPrivilege	2832	lsass.exe
Token: SeDebugPrivilege	1696	lsass.exe
Token: SeDebugPrivilege	2512	lsass.exe
Token: SeDebugPrivilege	1780	lsass.exe
Token: SeDebugPrivilege	1352	lsass.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2520 wrote to memory of 2504	2520	JaffaCakes118_9d380a759e6bcb5f49575b277d93af37f850e1378259c8887a8a78a30db6cd4f.exe	30
PID 2520 wrote to memory of 2504	2520	JaffaCakes118_9d380a759e6bcb5f49575b277d93af37f850e1378259c8887a8a78a30db6cd4f.exe	30
PID 2520 wrote to memory of 2504	2520	JaffaCakes118_9d380a759e6bcb5f49575b277d93af37f850e1378259c8887a8a78a30db6cd4f.exe	30
PID 2520 wrote to memory of 2504	2520	JaffaCakes118_9d380a759e6bcb5f49575b277d93af37f850e1378259c8887a8a78a30db6cd4f.exe	30
PID 2504 wrote to memory of 2692	2504	WScript.exe	31
PID 2504 wrote to memory of 2692	2504	WScript.exe	31
PID 2504 wrote to memory of 2692	2504	WScript.exe	31
PID 2504 wrote to memory of 2692	2504	WScript.exe	31
PID 2692 wrote to memory of 2168	2692	cmd.exe	33
PID 2692 wrote to memory of 2168	2692	cmd.exe	33
PID 2692 wrote to memory of 2168	2692	cmd.exe	33
PID 2692 wrote to memory of 2168	2692	cmd.exe	33
PID 2168 wrote to memory of 2560	2168	DllCommonsvc.exe	56
PID 2168 wrote to memory of 2560	2168	DllCommonsvc.exe	56
PID 2168 wrote to memory of 2560	2168	DllCommonsvc.exe	56
PID 2168 wrote to memory of 1120	2168	DllCommonsvc.exe	57
PID 2168 wrote to memory of 1120	2168	DllCommonsvc.exe	57
PID 2168 wrote to memory of 1120	2168	DllCommonsvc.exe	57
PID 2168 wrote to memory of 2072	2168	DllCommonsvc.exe	58
PID 2168 wrote to memory of 2072	2168	DllCommonsvc.exe	58
PID 2168 wrote to memory of 2072	2168	DllCommonsvc.exe	58
PID 2168 wrote to memory of 2084	2168	DllCommonsvc.exe	59
PID 2168 wrote to memory of 2084	2168	DllCommonsvc.exe	59
PID 2168 wrote to memory of 2084	2168	DllCommonsvc.exe	59
PID 2168 wrote to memory of 2696	2168	DllCommonsvc.exe	60
PID 2168 wrote to memory of 2696	2168	DllCommonsvc.exe	60
PID 2168 wrote to memory of 2696	2168	DllCommonsvc.exe	60
PID 2168 wrote to memory of 1704	2168	DllCommonsvc.exe	61
PID 2168 wrote to memory of 1704	2168	DllCommonsvc.exe	61
PID 2168 wrote to memory of 1704	2168	DllCommonsvc.exe	61
PID 2168 wrote to memory of 808	2168	DllCommonsvc.exe	62
PID 2168 wrote to memory of 808	2168	DllCommonsvc.exe	62
PID 2168 wrote to memory of 808	2168	DllCommonsvc.exe	62
PID 2168 wrote to memory of 700	2168	DllCommonsvc.exe	63
PID 2168 wrote to memory of 700	2168	DllCommonsvc.exe	63
PID 2168 wrote to memory of 700	2168	DllCommonsvc.exe	63
PID 2168 wrote to memory of 2132	2168	DllCommonsvc.exe	72
PID 2168 wrote to memory of 2132	2168	DllCommonsvc.exe	72
PID 2168 wrote to memory of 2132	2168	DllCommonsvc.exe	72
PID 2132 wrote to memory of 1624	2132	cmd.exe	74
PID 2132 wrote to memory of 1624	2132	cmd.exe	74
PID 2132 wrote to memory of 1624	2132	cmd.exe	74
PID 2132 wrote to memory of 1904	2132	cmd.exe	75
PID 2132 wrote to memory of 1904	2132	cmd.exe	75
PID 2132 wrote to memory of 1904	2132	cmd.exe	75
PID 1904 wrote to memory of 864	1904	DllCommonsvc.exe	97
PID 1904 wrote to memory of 864	1904	DllCommonsvc.exe	97
PID 1904 wrote to memory of 864	1904	DllCommonsvc.exe	97
PID 1904 wrote to memory of 2880	1904	DllCommonsvc.exe	98
PID 1904 wrote to memory of 2880	1904	DllCommonsvc.exe	98
PID 1904 wrote to memory of 2880	1904	DllCommonsvc.exe	98
PID 1904 wrote to memory of 832	1904	DllCommonsvc.exe	99
PID 1904 wrote to memory of 832	1904	DllCommonsvc.exe	99
PID 1904 wrote to memory of 832	1904	DllCommonsvc.exe	99
PID 1904 wrote to memory of 2748	1904	DllCommonsvc.exe	100
PID 1904 wrote to memory of 2748	1904	DllCommonsvc.exe	100
PID 1904 wrote to memory of 2748	1904	DllCommonsvc.exe	100
PID 1904 wrote to memory of 2852	1904	DllCommonsvc.exe	101
PID 1904 wrote to memory of 2852	1904	DllCommonsvc.exe	101
PID 1904 wrote to memory of 2852	1904	DllCommonsvc.exe	101
PID 1904 wrote to memory of 2912	1904	DllCommonsvc.exe	102
PID 1904 wrote to memory of 2912	1904	DllCommonsvc.exe	102
PID 1904 wrote to memory of 2912	1904	DllCommonsvc.exe	102
PID 1904 wrote to memory of 2868	1904	DllCommonsvc.exe	103

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9d380a759e6bcb5f49575b277d93af37f850e1378259c8887a8a78a30db6cd4f.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9d380a759e6bcb5f49575b277d93af37f850e1378259c8887a8a78a30db6cd4f.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2520
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2504
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2692
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2168
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2560
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\WmiPrvSE.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1120
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\System.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2072
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\OSPPSVC.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2084
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows NT\TableTextService\taskhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2696
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\ehome\de-DE\taskhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1704
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:808
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\PCHEALTH\ERRORREP\dwm.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:700
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\6AAlqGeUwh.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2132
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:1624
      - C:\providercommon\DllCommonsvc.exe
        
        "C:\providercommon\DllCommonsvc.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1904
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:864
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\lsass.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2880
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:832
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\dllhost.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2748
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\Idle.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2852
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\taskhost.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2912
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Favorites\OSPPSVC.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2868
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\DllCommonsvc.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1208
        
        C:\providercommon\lsass.exe
        
        "C:\providercommon\lsass.exe"
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2572
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\V61H6ynXXY.bat"
        8⤵
        
        PID:2600
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:1740
        
        C:\providercommon\lsass.exe
        
        "C:\providercommon\lsass.exe"
        9⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1876
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ezHXLeVHih.bat"
        10⤵
        
        PID:2276
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:2844
        
        C:\providercommon\lsass.exe
        
        "C:\providercommon\lsass.exe"
        11⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:576
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\z7AIE64VZ5.bat"
        12⤵
        
        PID:3032
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:2584
        
        C:\providercommon\lsass.exe
        
        "C:\providercommon\lsass.exe"
        13⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2332
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\y17QM3q8Rw.bat"
        14⤵
        
        PID:1864
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        15⤵
        
        PID:1512
        
        C:\providercommon\lsass.exe
        
        "C:\providercommon\lsass.exe"
        15⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1664
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\QqrgVo7Q94.bat"
        16⤵
        
        PID:2152
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        17⤵
        
        PID:2060
        
        C:\providercommon\lsass.exe
        
        "C:\providercommon\lsass.exe"
        17⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2832
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\WVE2eLfZN7.bat"
        18⤵
        
        PID:956
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        19⤵
        
        PID:1580
        
        C:\providercommon\lsass.exe
        
        "C:\providercommon\lsass.exe"
        19⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1696
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\UPAAmIRCFx.bat"
        20⤵
        
        PID:2756
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        21⤵
        
        PID:2748
        
        C:\providercommon\lsass.exe
        
        "C:\providercommon\lsass.exe"
        21⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2512
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\XkJigN4PJf.bat"
        22⤵
        
        PID:2836
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        23⤵
        
        PID:1784
        
        C:\providercommon\lsass.exe
        
        "C:\providercommon\lsass.exe"
        23⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1780
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\2tBWjDxv5U.bat"
        24⤵
        
        PID:2460
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        25⤵
        
        PID:2436
        
        C:\providercommon\lsass.exe
        
        "C:\providercommon\lsass.exe"
        25⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2896

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\OSPPSVC.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\TableTextService\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 10 /tr "'C:\Windows\ehome\de-DE\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Windows\ehome\de-DE\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 13 /tr "'C:\Windows\ehome\de-DE\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 10 /tr "'C:\Windows\PCHEALTH\ERRORREP\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2128

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\PCHEALTH\ERRORREP\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 10 /tr "'C:\Windows\PCHEALTH\ERRORREP\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 7 /tr "'C:\providercommon\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\providercommon\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\providercommon\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1272

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1788

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 5 /tr "'C:\providercommon\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\providercommon\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 10 /tr "'C:\providercommon\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1288

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 9 /tr "'C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 13 /tr "'C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\Favorites\OSPPSVC.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Users\All Users\Favorites\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\Favorites\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\DllCommonsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
24b1e3e09ea0c686979cfa6380de09b9

SHA1
dd1707e34dd4a80b177742f215d125a1cab90be1

SHA256
d343b93b479678a31765ac5ed4ee84a826444ad4a5ff8b090e46d9d03139424b

SHA512
51d38e16436e5e8ef21b2c2518cb0ba13d91c39df251b30bb8e9c5c4198e793c2d66b41ce61fcddc17e5e0225420bef2c0753d899c11412aadbcaef255ecb3cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e3136f4c3263ce3380657e553024fa7d

SHA1
fec8d107448d3ab079b173e0bee78b5e2474c485

SHA256
4da8770c1441d80191787ebe1ca9441082372ae64b287d76db0a84f4852950c1

SHA512
c66986b279a3161c5fe1a6077b5d89943888afdd5b0ce39eae8584395b861656afece732b59db232b9e48f94d2ae2649c10bd2d7cc2dc3ed0d6b443c8034f81c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a837cb22d51b75cba75b1f5cc0551fc0

SHA1
2d77ec97b0f66cbcdd029fe063efef15351a4e73

SHA256
ed58b7b273a2f184ca90ddf259dc3c871803a46fd082e93d6399ff0a1cb7dfb8

SHA512
229907ff61898cdccec8a08cfe01ad7a38e1f3c9cecbb8919d294911b58d36af72b05d4014f73409d7d74cf5b59e1ceb39fa3e6ae210347c8da8b7d06d4e8c37

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a86a293fb2ca149a8b185f1e8d87c767

SHA1
1ecc788c2adca0125bfb6fcb4ade71ac7016d153

SHA256
1c8cb17c3d4a246e23c8fd869063c4aa4dba588b9e6b4e776cba0ea931cb9ec6

SHA512
3fc9f3f453ea303df7af70330a75e9c4f22f6cc3e2a3538dc9b878af1908daa8a9510953d46d3c4bf82ce983f827d1ed4815e274283dde2794b94a950693a5d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9e048448b38eed327d1f806b702d70bd

SHA1
f51974d9c7bf413e941d82790a92addf338b7ed5

SHA256
203101b13bc1a04472504dc0018f88b276d19ffdd00b7f8358e528b377730dd0

SHA512
ae1f0b71baa157016585ffe20b63a3a681944fbb485e8c986b92f5ca842d2b3aa1ef0f5afe88455b1eee5f33f944ef8871674faa68761c5dc6f352ec66a6036a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
02073f66682217bf2822a986c7d8a147

SHA1
85cdb4afe9bc9407ff92a142b4bcfa318d7839d4

SHA256
323a02458912e215c291905744deacde35018f5c32b1e52c40f8fc7864d92acc

SHA512
af58ba74da9ba7059df65188608fdbd1f9cbc12ba1f03516c60d06600d5876ff100d782f570e73dbaaccbacc7006b1f5da049ba4bc9f7b70e70c26f9f16ec82a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e46b37716a0c14037ab0400ecfd8a287

SHA1
36920ee9c2efcf9309340cdff057327ed8e39fdb

SHA256
c8abddeec91dfe4f43549458bb903ad0d125ec7f6d76e5e71ce5f10ed41c99de

SHA512
aa6d556126ae79b768b3a79a0369de0320defbb33d2cdab84bdd064dae236dd5cbce7dba67603fb27716f6ef7bd54730e865f80c4fe28266ef57a3d5ddaa7ab9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
65ca7409c44b7fd9f6047813dc7d8368

SHA1
e327df0fee6d80c3a8541c982259b5bdbafeb449

SHA256
d9b91838418196eefd7155820622f1e282585f4bf334ea95f97aa477daf9dfb8

SHA512
a9d0315a9fd3fa5939e7df5b87bf74ced995741ac5fb10de630c06156c7f124907dfa3fa8040f01afb9b8c295b437b535e6f258451fb96e1486de8bf7a3f8380

Download Submit
C:\Users\Admin\AppData\Local\Temp\2tBWjDxv5U.bat

Filesize
192B

MD5
30dcb24957e9ca9a0243162c045a26f3

SHA1
3225e11c55f36e3b127a8dffc23b82fe94260ba6

SHA256
3acc7bba22a93ad2bd092f9b40abe2ce38cf8174dd1a191d9803a52b759674df

SHA512
9b688af25c670afccb3524e9b1b1fd961dee7bacdcf0a2a9afcb2a0980b8afea5f264cf34855680661184fb93b97ec7651565d8351e33e4333f243a57097c08d

Download Submit
C:\Users\Admin\AppData\Local\Temp\6AAlqGeUwh.bat

Filesize
199B

MD5
3510e87fac5805f1db548a89a040842e

SHA1
0ecae8068c62a76fe34547c89bb420bafb6b5d69

SHA256
4f63e9b9ac21745c8925d8e336f543a051f9150f9adf498d3a57de62dbada568

SHA512
85e185950606a1a48f8e63a25780b6f0b959fa5ae45cf8cfa879323ea34fc76d966b9d67ed36b9f923240228ffed501280ce19eee79ab4129a98c29001063498

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE8EA.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\QqrgVo7Q94.bat

Filesize
192B

MD5
a27b8c3a9082678f8add626dbbcdc3a9

SHA1
4c720a905c7bc646c12f31b13987a6538df3bd4d

SHA256
79b05c2dac36a5cbd3db582723b70374245063f1655a06f98977c0d67d395890

SHA512
d38f7ca64df06460decc9a71bd9247dce84d75ad8be82047b1c65c2a3af4499323e906a172d3534951fb62fdf6a0163c72ae5b7ea33128ecb6636141eacf43ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE90D.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\UPAAmIRCFx.bat

Filesize
192B

MD5
8185438612fd7896aeca0be2648f6c0e

SHA1
a153048b8563008d026a863d659f454c9e677ada

SHA256
ce17bf881f7fc65ea8b8e1f597d7b8e4ec370d1d78933a7de23472b567fa1503

SHA512
65b9607bcd44f4a0c9973fb008dec59fb516f7b907e2c8defb6a590127b7c9c54b5bb4193d8c216a83d215ac47b828f7ce35eb30e6b81cee5133795f2fe50745

Download Submit
C:\Users\Admin\AppData\Local\Temp\V61H6ynXXY.bat

Filesize
192B

MD5
91928a855f24e4fb1e14834c71a7896c

SHA1
d888bee166bb4e3661941ed854a876c824b06090

SHA256
4a4c394fa728a75f7bce114876420b55df27c8fb7bd359c20013a4c943c0fcdb

SHA512
0c0e316135c25daefb956c428f2a60b861b6e3922566624f1c95b6431c17d363590e05045a0a2ae624e0444723ec3479f801b4d635ef8c6b8733881ee735b344

Download Submit
C:\Users\Admin\AppData\Local\Temp\WVE2eLfZN7.bat

Filesize
192B

MD5
c068248883c5400364592e65f9d8992e

SHA1
9d5fe45550709aee8c078ecd0541d2a4e53d2e23

SHA256
f3459bc0af72733ecf56fb1f5750f8027570ed81a0001a29bc3ca9abb5ae2ee0

SHA512
5d3934c3953f6efddef2ce610dc0038f99afaff33d71f893c0a54af7adaa2481b952a3be13956e4a954ab11b573f0882a419072070301486cb5b61a1c9395283

Download Submit
C:\Users\Admin\AppData\Local\Temp\XkJigN4PJf.bat

Filesize
192B

MD5
2c1cb667f45e69fc53549208a754562f

SHA1
de203f1d50219821d00b364b3349621caa79f4c1

SHA256
5a340eae1800fc755ab3e8b28a4620fe5b01b34cdcbaadc0bbe7e9caf2b4f5af

SHA512
43488102cd4303f8c84b7107606c06b6b0d3c6f5a8fc4a74c86c583e2fdd0b18afed6c61371490927b8a3637aae33b7e3d1494c0d78be8f3b77d4b8dbdf6352f

Download Submit
C:\Users\Admin\AppData\Local\Temp\ezHXLeVHih.bat

Filesize
192B

MD5
a6375af1520e38c847dbe55081dc8d7f

SHA1
a646a2e845af2c3d80da388bbd06c60582766d75

SHA256
c1f6060fb7ece4125e3542ad8991972815897cdd77510d86257df474f5cfcaf8

SHA512
0f0e5970c031a6c911270bc5abaecdc34a236c07c26dc119aa1e39110de1649c4087e2ffe438e2944382b52987228a770dafda249515740ed9d126f95bd08dcf

Download Submit
C:\Users\Admin\AppData\Local\Temp\y17QM3q8Rw.bat

Filesize
192B

MD5
f0498cd13e2f96e8420d1f856df0237e

SHA1
298907199676066db96a7b9d15b9fc715672a3c3

SHA256
ac32888dfbd3f8b269000da7e9535e8fde43aad862931fbacd480a43e18bf8bc

SHA512
7da5d3ab4b3b6229cb72330dad197fa080994ec42dc3150fef379903dcb281c9ce6973ebe0e1c9f7c1d257211ba0544956307c6dbe1f0cc89c63d9f5f2f761b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\z7AIE64VZ5.bat

Filesize
192B

MD5
7dedd5806b87751b1a7acd22d8150a2d

SHA1
687e9c0aed552e1830dac9ccac57a8c7f8a97be2

SHA256
c5ecad7368184bbd22ed8caa1f051e2d11d48784928dd4257f7445345a93b286

SHA512
c4a3e40560f2bd1ba3668844a624e3bade82239a1f90b2abba690336a33a9826f58af5247e4983e2ab1b4ee1b408b17b0133ec276103591a77a9f1fcf20f2500

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
0894d94f59925fcf82105796fe4b0c76

SHA1
22c28295dc4c2014dc33d8ef7941bebff629e855

SHA256
7666adb1c17083db0939e4e568f46211f15148813ea0f9ba1719feaacbe40271

SHA512
78748d2a925dde3ab9c4be32345bf710733ca96e67d59cf48accbc46a8a99287a8385e5682de11961762ed8ed1ff2618979ca201c65b3f72f2bd50821495d18d

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/576-262-0x0000000000330000-0x0000000000440000-memory.dmp

Filesize
1.1MB

Download
memory/700-61-0x000000001B820000-0x000000001BB02000-memory.dmp

Filesize
2.9MB

Download
memory/1352-681-0x00000000000C0000-0x00000000001D0000-memory.dmp

Filesize
1.1MB

Download
memory/1696-501-0x0000000001350000-0x0000000001460000-memory.dmp

Filesize
1.1MB

Download
memory/1696-502-0x00000000002B0000-0x00000000002C2000-memory.dmp

Filesize
72KB

Download
memory/1780-621-0x00000000002A0000-0x00000000003B0000-memory.dmp

Filesize
1.1MB

Download
memory/1876-202-0x0000000000350000-0x0000000000362000-memory.dmp

Filesize
72KB

Download
memory/1876-201-0x0000000000360000-0x0000000000470000-memory.dmp

Filesize
1.1MB

Download
memory/1904-79-0x0000000001340000-0x0000000001450000-memory.dmp

Filesize
1.1MB

Download
memory/2084-62-0x0000000002860000-0x0000000002868000-memory.dmp

Filesize
32KB

Download
memory/2168-17-0x00000000002F0000-0x00000000002FC000-memory.dmp

Filesize
48KB

Download
memory/2168-16-0x0000000000160000-0x000000000016C000-memory.dmp

Filesize
48KB

Download
memory/2168-15-0x00000000002E0000-0x00000000002EC000-memory.dmp

Filesize
48KB

Download
memory/2168-14-0x0000000000150000-0x0000000000162000-memory.dmp

Filesize
72KB

Download
memory/2168-13-0x0000000001070000-0x0000000001180000-memory.dmp

Filesize
1.1MB

Download
memory/2332-322-0x0000000000F60000-0x0000000001070000-memory.dmp

Filesize
1.1MB

Download
memory/2572-100-0x0000000000CB0000-0x0000000000DC0000-memory.dmp

Filesize
1.1MB

Download
memory/2832-441-0x0000000000250000-0x0000000000360000-memory.dmp

Filesize
1.1MB

Download
memory/2880-107-0x000000001B810000-0x000000001BAF2000-memory.dmp

Filesize
2.9MB

Download
memory/2880-108-0x0000000001F40000-0x0000000001F48000-memory.dmp

Filesize
32KB

Download