dcrat | 6bbccf17aa51ce9f5a6d0118509cf6143ef98e44f42e2c3c5fc5076c2caa7225

Analysis

max time kernel
146s
max time network
142s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22-12-2024 11:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_6bbccf17aa51ce9f5a6d0118509cf6143ef98e44f42e2c3c5fc5076c2caa7225.exe
Size

1.3MB
MD5

01b6f94735723cdc7fb235d4014c467f
SHA1

0b1e73e0a71b13fe8e124bfca00ca0575c0e19e7
SHA256

6bbccf17aa51ce9f5a6d0118509cf6143ef98e44f42e2c3c5fc5076c2caa7225
SHA512

9bff84c869f84abcaf6471a65a07017347d69ffcbdc74fa873a9b14b82d5bd5aead77845e7f5e335cd10ff028edb1f6ff2077a8cb268a196cc056c8da67b830e
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 48 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2640	2664	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2540	2664	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1476	2664	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2356	2664	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2404	2664	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1928	2664	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1944	2664	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	264	2664	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2856	2664	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2984	2664	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2148	2664	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2876	2664	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2324	2664	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2088	2664	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2184	2664	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1848	2664	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2928	2664	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	996	2664	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1732	2664	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3036	2664	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	748	2664	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2444	2664	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2284	2664	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2208	2664	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2340	2664	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2460	2664	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1620	2664	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1208	2664	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2364	2664	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2064	2664	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1600	2664	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1396	2664	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	344	2664	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1768	2664	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1532	2664	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1668	2664	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2204	2664	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	752	2664	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	952	2664	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1960	2664	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2392	2664	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	564	2664	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2352	2664	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3044	2664	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1968	2664	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	888	2664	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1012	2664	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3060	2664	schtasks.exe	34

DCRat payload 5 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x00070000000170b5-9.dat	dcrat
behavioral1/memory/2940-13-0x0000000000B30000-0x0000000000C40000-memory.dmp	dcrat
behavioral1/memory/2636-65-0x0000000001230000-0x0000000001340000-memory.dmp	dcrat
behavioral1/memory/2848-495-0x0000000001250000-0x0000000001360000-memory.dmp	dcrat
behavioral1/memory/2792-673-0x0000000000250000-0x0000000000360000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 17 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2804	powershell.exe
1580	powershell.exe
2888	powershell.exe
3024	powershell.exe
2908	powershell.exe
2820	powershell.exe
1588	powershell.exe
2812	powershell.exe
2708	powershell.exe
2472	powershell.exe
1528	powershell.exe
1684	powershell.exe
2792	powershell.exe
2448	powershell.exe
2824	powershell.exe
2716	powershell.exe
2760	powershell.exe

Executes dropped EXE 11 IoCs

pid	Process
2940	DllCommonsvc.exe
2636	taskhost.exe
1752	taskhost.exe
2928	taskhost.exe
2444	taskhost.exe
1048	taskhost.exe
876	taskhost.exe
2848	taskhost.exe
2036	taskhost.exe
2696	taskhost.exe
2792	taskhost.exe

Loads dropped DLL 2 IoCs

pid	Process
2536	cmd.exe
2536	cmd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 10 IoCs

Web Service

T1102

flow	ioc
16	raw.githubusercontent.com
23	raw.githubusercontent.com
27	raw.githubusercontent.com
34	raw.githubusercontent.com
5	raw.githubusercontent.com
12	raw.githubusercontent.com
19	raw.githubusercontent.com
30	raw.githubusercontent.com
4	raw.githubusercontent.com
9	raw.githubusercontent.com

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\Packages\Debugger\taskhost.exe	DllCommonsvc.exe
File created	C:\Program Files\Internet Explorer\es-ES\6ccacd8608530f	DllCommonsvc.exe
File created	C:\Program Files\Windows Photo Viewer\en-US\56085415360792	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\Packages\Debugger\b75386f1303e64	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\DllCommonsvc.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\a76d7bf15d8370	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows NT\TableTextService\ja-JP\conhost.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows NT\TableTextService\ja-JP\088424020bedd6	DllCommonsvc.exe
File created	C:\Program Files\Internet Explorer\es-ES\Idle.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\dllhost.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\5940a34987c991	DllCommonsvc.exe
File created	C:\Program Files\Windows Photo Viewer\en-US\wininit.exe	DllCommonsvc.exe

Drops file in Windows directory 7 IoCs

description	ioc	Process
File created	C:\Windows\system\sppsvc.exe	DllCommonsvc.exe
File created	C:\Windows\system\0a1fd5f707cd16	DllCommonsvc.exe
File created	C:\Windows\it-IT\lsm.exe	DllCommonsvc.exe
File opened for modification	C:\Windows\it-IT\lsm.exe	DllCommonsvc.exe
File created	C:\Windows\it-IT\101b941d020240	DllCommonsvc.exe
File created	C:\Windows\Help\Windows\fr-FR\DllCommonsvc.exe	DllCommonsvc.exe
File created	C:\Windows\Help\Windows\fr-FR\a76d7bf15d8370	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_6bbccf17aa51ce9f5a6d0118509cf6143ef98e44f42e2c3c5fc5076c2caa7225.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 48 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2324	schtasks.exe
2460	schtasks.exe
1532	schtasks.exe
752	schtasks.exe
952	schtasks.exe
564	schtasks.exe
2984	schtasks.exe
264	schtasks.exe
1732	schtasks.exe
2444	schtasks.exe
1768	schtasks.exe
888	schtasks.exe
1012	schtasks.exe
1476	schtasks.exe
2064	schtasks.exe
3060	schtasks.exe
2404	schtasks.exe
2148	schtasks.exe
2184	schtasks.exe
1208	schtasks.exe
1944	schtasks.exe
1600	schtasks.exe
1668	schtasks.exe
2204	schtasks.exe
1848	schtasks.exe
2088	schtasks.exe
996	schtasks.exe
748	schtasks.exe
1620	schtasks.exe
1396	schtasks.exe
2392	schtasks.exe
3044	schtasks.exe
2540	schtasks.exe
1968	schtasks.exe
2356	schtasks.exe
2876	schtasks.exe
2928	schtasks.exe
3036	schtasks.exe
2284	schtasks.exe
344	schtasks.exe
2640	schtasks.exe
2856	schtasks.exe
2208	schtasks.exe
2340	schtasks.exe
2364	schtasks.exe
1960	schtasks.exe
2352	schtasks.exe
1928	schtasks.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
2940	DllCommonsvc.exe
2940	DllCommonsvc.exe
2940	DllCommonsvc.exe
2940	DllCommonsvc.exe
2940	DllCommonsvc.exe
1588	powershell.exe
1528	powershell.exe
1580	powershell.exe
1684	powershell.exe
3024	powershell.exe
2792	powershell.exe
2824	powershell.exe
2760	powershell.exe
2908	powershell.exe
2716	powershell.exe
2448	powershell.exe
2472	powershell.exe
2888	powershell.exe
2812	powershell.exe
2708	powershell.exe
2804	powershell.exe
2820	powershell.exe
2636	taskhost.exe
1752	taskhost.exe
2928	taskhost.exe
2444	taskhost.exe
1048	taskhost.exe
876	taskhost.exe
2848	taskhost.exe
2036	taskhost.exe
2696	taskhost.exe
2792	taskhost.exe

Suspicious use of AdjustPrivilegeToken 28 IoCs

description	pid	Process
Token: SeDebugPrivilege	2940	DllCommonsvc.exe
Token: SeDebugPrivilege	1588	powershell.exe
Token: SeDebugPrivilege	1528	powershell.exe
Token: SeDebugPrivilege	1580	powershell.exe
Token: SeDebugPrivilege	1684	powershell.exe
Token: SeDebugPrivilege	3024	powershell.exe
Token: SeDebugPrivilege	2792	powershell.exe
Token: SeDebugPrivilege	2824	powershell.exe
Token: SeDebugPrivilege	2760	powershell.exe
Token: SeDebugPrivilege	2908	powershell.exe
Token: SeDebugPrivilege	2716	powershell.exe
Token: SeDebugPrivilege	2448	powershell.exe
Token: SeDebugPrivilege	2472	powershell.exe
Token: SeDebugPrivilege	2888	powershell.exe
Token: SeDebugPrivilege	2812	powershell.exe
Token: SeDebugPrivilege	2708	powershell.exe
Token: SeDebugPrivilege	2804	powershell.exe
Token: SeDebugPrivilege	2820	powershell.exe
Token: SeDebugPrivilege	2636	taskhost.exe
Token: SeDebugPrivilege	1752	taskhost.exe
Token: SeDebugPrivilege	2928	taskhost.exe
Token: SeDebugPrivilege	2444	taskhost.exe
Token: SeDebugPrivilege	1048	taskhost.exe
Token: SeDebugPrivilege	876	taskhost.exe
Token: SeDebugPrivilege	2848	taskhost.exe
Token: SeDebugPrivilege	2036	taskhost.exe
Token: SeDebugPrivilege	2696	taskhost.exe
Token: SeDebugPrivilege	2792	taskhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2472 wrote to memory of 2820	2472	JaffaCakes118_6bbccf17aa51ce9f5a6d0118509cf6143ef98e44f42e2c3c5fc5076c2caa7225.exe	30
PID 2472 wrote to memory of 2820	2472	JaffaCakes118_6bbccf17aa51ce9f5a6d0118509cf6143ef98e44f42e2c3c5fc5076c2caa7225.exe	30
PID 2472 wrote to memory of 2820	2472	JaffaCakes118_6bbccf17aa51ce9f5a6d0118509cf6143ef98e44f42e2c3c5fc5076c2caa7225.exe	30
PID 2472 wrote to memory of 2820	2472	JaffaCakes118_6bbccf17aa51ce9f5a6d0118509cf6143ef98e44f42e2c3c5fc5076c2caa7225.exe	30
PID 2820 wrote to memory of 2536	2820	WScript.exe	31
PID 2820 wrote to memory of 2536	2820	WScript.exe	31
PID 2820 wrote to memory of 2536	2820	WScript.exe	31
PID 2820 wrote to memory of 2536	2820	WScript.exe	31
PID 2536 wrote to memory of 2940	2536	cmd.exe	33
PID 2536 wrote to memory of 2940	2536	cmd.exe	33
PID 2536 wrote to memory of 2940	2536	cmd.exe	33
PID 2536 wrote to memory of 2940	2536	cmd.exe	33
PID 2940 wrote to memory of 1580	2940	DllCommonsvc.exe	83
PID 2940 wrote to memory of 1580	2940	DllCommonsvc.exe	83
PID 2940 wrote to memory of 1580	2940	DllCommonsvc.exe	83
PID 2940 wrote to memory of 1588	2940	DllCommonsvc.exe	84
PID 2940 wrote to memory of 1588	2940	DllCommonsvc.exe	84
PID 2940 wrote to memory of 1588	2940	DllCommonsvc.exe	84
PID 2940 wrote to memory of 1684	2940	DllCommonsvc.exe	85
PID 2940 wrote to memory of 1684	2940	DllCommonsvc.exe	85
PID 2940 wrote to memory of 1684	2940	DllCommonsvc.exe	85
PID 2940 wrote to memory of 1528	2940	DllCommonsvc.exe	86
PID 2940 wrote to memory of 1528	2940	DllCommonsvc.exe	86
PID 2940 wrote to memory of 1528	2940	DllCommonsvc.exe	86
PID 2940 wrote to memory of 2792	2940	DllCommonsvc.exe	88
PID 2940 wrote to memory of 2792	2940	DllCommonsvc.exe	88
PID 2940 wrote to memory of 2792	2940	DllCommonsvc.exe	88
PID 2940 wrote to memory of 2812	2940	DllCommonsvc.exe	89
PID 2940 wrote to memory of 2812	2940	DllCommonsvc.exe	89
PID 2940 wrote to memory of 2812	2940	DllCommonsvc.exe	89
PID 2940 wrote to memory of 2708	2940	DllCommonsvc.exe	90
PID 2940 wrote to memory of 2708	2940	DllCommonsvc.exe	90
PID 2940 wrote to memory of 2708	2940	DllCommonsvc.exe	90
PID 2940 wrote to memory of 2888	2940	DllCommonsvc.exe	91
PID 2940 wrote to memory of 2888	2940	DllCommonsvc.exe	91
PID 2940 wrote to memory of 2888	2940	DllCommonsvc.exe	91
PID 2940 wrote to memory of 2804	2940	DllCommonsvc.exe	92
PID 2940 wrote to memory of 2804	2940	DllCommonsvc.exe	92
PID 2940 wrote to memory of 2804	2940	DllCommonsvc.exe	92
PID 2940 wrote to memory of 2472	2940	DllCommonsvc.exe	93
PID 2940 wrote to memory of 2472	2940	DllCommonsvc.exe	93
PID 2940 wrote to memory of 2472	2940	DllCommonsvc.exe	93
PID 2940 wrote to memory of 2448	2940	DllCommonsvc.exe	94
PID 2940 wrote to memory of 2448	2940	DllCommonsvc.exe	94
PID 2940 wrote to memory of 2448	2940	DllCommonsvc.exe	94
PID 2940 wrote to memory of 3024	2940	DllCommonsvc.exe	95
PID 2940 wrote to memory of 3024	2940	DllCommonsvc.exe	95
PID 2940 wrote to memory of 3024	2940	DllCommonsvc.exe	95
PID 2940 wrote to memory of 2908	2940	DllCommonsvc.exe	96
PID 2940 wrote to memory of 2908	2940	DllCommonsvc.exe	96
PID 2940 wrote to memory of 2908	2940	DllCommonsvc.exe	96
PID 2940 wrote to memory of 2824	2940	DllCommonsvc.exe	97
PID 2940 wrote to memory of 2824	2940	DllCommonsvc.exe	97
PID 2940 wrote to memory of 2824	2940	DllCommonsvc.exe	97
PID 2940 wrote to memory of 2716	2940	DllCommonsvc.exe	98
PID 2940 wrote to memory of 2716	2940	DllCommonsvc.exe	98
PID 2940 wrote to memory of 2716	2940	DllCommonsvc.exe	98
PID 2940 wrote to memory of 2820	2940	DllCommonsvc.exe	99
PID 2940 wrote to memory of 2820	2940	DllCommonsvc.exe	99
PID 2940 wrote to memory of 2820	2940	DllCommonsvc.exe	99
PID 2940 wrote to memory of 2760	2940	DllCommonsvc.exe	100
PID 2940 wrote to memory of 2760	2940	DllCommonsvc.exe	100
PID 2940 wrote to memory of 2760	2940	DllCommonsvc.exe	100
PID 2940 wrote to memory of 2636	2940	DllCommonsvc.exe	111

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6bbccf17aa51ce9f5a6d0118509cf6143ef98e44f42e2c3c5fc5076c2caa7225.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6bbccf17aa51ce9f5a6d0118509cf6143ef98e44f42e2c3c5fc5076c2caa7225.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2472
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2820
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2536
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2940
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1580
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\it-IT\lsm.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1588
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\conhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1684
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Help\Windows\fr-FR\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1528
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\Packages\Debugger\taskhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2792
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\spoolsv.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2812
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\smss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2708
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2888
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows NT\TableTextService\ja-JP\conhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2804
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\system\sppsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2472
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Internet Explorer\es-ES\Idle.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2448
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\services.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3024
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Favorites\Windows Live\System.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2908
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\dllhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2824
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Photo Viewer\en-US\wininit.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2716
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2820
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\taskhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2760
    - - C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\Packages\Debugger\taskhost.exe
        
        "C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\Packages\Debugger\taskhost.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2636
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\pCY6B1XXru.bat"
        6⤵
        
        PID:1300
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:1584
        
        C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\Packages\Debugger\taskhost.exe
        
        "C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\Packages\Debugger\taskhost.exe"
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1752
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\OS3CX563UF.bat"
        8⤵
        
        PID:2992
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:876
        
        C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\Packages\Debugger\taskhost.exe
        
        "C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\Packages\Debugger\taskhost.exe"
        9⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2928
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\MKE9IzBoeI.bat"
        10⤵
        
        PID:1000
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:2208
        
        C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\Packages\Debugger\taskhost.exe
        
        "C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\Packages\Debugger\taskhost.exe"
        11⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2444
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ounU5LkXKE.bat"
        12⤵
        
        PID:664
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:1584
        
        C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\Packages\Debugger\taskhost.exe
        
        "C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\Packages\Debugger\taskhost.exe"
        13⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1048
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\arqkgCRh4V.bat"
        14⤵
        
        PID:1636
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        15⤵
        
        PID:1448
        
        C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\Packages\Debugger\taskhost.exe
        
        "C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\Packages\Debugger\taskhost.exe"
        15⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:876
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\3a8tNGcxSj.bat"
        16⤵
        
        PID:1820
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        17⤵
        
        PID:760
        
        C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\Packages\Debugger\taskhost.exe
        
        "C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\Packages\Debugger\taskhost.exe"
        17⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2848
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\or7X1gMNi7.bat"
        18⤵
        
        PID:1844
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        19⤵
        
        PID:1496
        
        C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\Packages\Debugger\taskhost.exe
        
        "C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\Packages\Debugger\taskhost.exe"
        19⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2036
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\vIn8vbLsXf.bat"
        20⤵
        
        PID:2452
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        21⤵
        
        PID:1748
        
        C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\Packages\Debugger\taskhost.exe
        
        "C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\Packages\Debugger\taskhost.exe"
        21⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2696
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\BAWHCtE00Z.bat"
        22⤵
        
        PID:2660
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        23⤵
        
        PID:2940
        
        C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\Packages\Debugger\taskhost.exe
        
        "C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\Packages\Debugger\taskhost.exe"
        23⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 5 /tr "'C:\Windows\it-IT\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Windows\it-IT\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 12 /tr "'C:\Windows\it-IT\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 13 /tr "'C:\Windows\Help\Windows\fr-FR\DllCommonsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\Windows\Help\Windows\fr-FR\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:264

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 14 /tr "'C:\Windows\Help\Windows\fr-FR\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\Packages\Debugger\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\Packages\Debugger\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2148

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\Packages\Debugger\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 13 /tr "'C:\providercommon\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\providercommon\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\providercommon\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\DllCommonsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\ja-JP\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\TableTextService\ja-JP\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\ja-JP\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 14 /tr "'C:\Windows\system\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Windows\system\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 8 /tr "'C:\Windows\system\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 5 /tr "'C:\Program Files\Internet Explorer\es-ES\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\es-ES\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2364

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 7 /tr "'C:\Program Files\Internet Explorer\es-ES\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 5 /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 5 /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:344

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\Favorites\Windows Live\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Users\Admin\Favorites\Windows Live\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\Favorites\Windows Live\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2204

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Photo Viewer\en-US\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\en-US\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Photo Viewer\en-US\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f94cfb810e15380060ad5e04a95fed59

SHA1
1080718be40baa5bace93e9acaf01242ba6dc8e1

SHA256
920e59b81ce16c0831aa3ab569508711c2048079e972ba7e40f5a0b743c7460a

SHA512
46cdb55d6cdad252effe18c34c2b9572908b9d4f8c527324ba6a1b2741efb1eef6406428835117afc2fdf80b26139ad863b465c1277d54c140a25cd5c74d102a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
19a42a41c718a238ed592a61ce3d3273

SHA1
c9e41dc753bffe59fb2e9396b622b13fa444019b

SHA256
fd5779cacf5bac6981c5aeb6cf2fffc462ad7f9ac287fdca44a48047167c5868

SHA512
c1af0d2b35bcf74bdb3f3009f241c256d43abc3acf9cb758196fc0ea8cec6b3a8189b1f23fef7859161b8f04498b1091d517bca1c0306774469c41bc898bc0dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
99dd27c8b11e27d2a726be15c5f83052

SHA1
3b7113a0c5e72f35bf9c382c1791f26524d52503

SHA256
6e6efacdd3d052cd12829ee51193bfe42a515c68baeb7ee2f52127f9a9be3eb6

SHA512
c56d7ba76668b8058f6a702dd96d32b4e5ce4f2206edeb7b2e04f440af10535f314f22614924b56f7756800bc9da5744f7281607d2f9dd8a8b3581d5aa94bc71

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0dfb8264d13f22390dc8a3f9e6f65cb2

SHA1
4180ddd807fd2ec396fd183619d721e433f1c37d

SHA256
740fbca1ca6f77472d6c9934442b18ce9bd44104c12e6258b37a33bfaf32f5c7

SHA512
8a25bed22822c2685032ab10fefadd6a1be9b157a54e5001b5a97c0a0c858d98bb10d184565f7a2285afd581335ac491a0bbffdd6a240d94f43c408e4082bbb9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
110d3a8a06e3fd57e5dc73c90c2d4949

SHA1
261e1c611f9ebf2f7912823b0ae3ba06544f8f56

SHA256
14b5773a31d7e99c5849d01cefbdae53cb3744a0fedc09686bc066c857391a12

SHA512
30b20d6b9280e84441c11c78d0914e1e89d5ca36f2912d4115c576a7072d801978299e6a3ed0b631351468da8aa63dfc759a416d5dadd5abb3168148359bbf56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fad6b3538c156ce86ef19fe2e62b8283

SHA1
58bef0065252644444fc2c62b98a912918cadc92

SHA256
b6159686e599c0f7071848e0faaf28be6eecc951accfbc356d5ad4ccadaf17ff

SHA512
fdd2680a63e0295a7f8f7fd1214316287787ecf043d94353fa9b329c47252334af184366d875331c52b0a5b2399209e47596f2430e4733ef6a46edc14c208e5f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d57bc56a961c2f6781d63cfaf768d9a0

SHA1
2b8375603e2cec3bd1d4453092083b1290ea7bd5

SHA256
017c952d59c3fa00c769b120b325b2c2f5c4be9a439a90c34cb5529cc02bb030

SHA512
c6314032ab5946521618a6225389b283f73c8ed9a83a266b3281aafa0e85c49a4f8f82f1acfc23b0e650ed9db507769f3bf8b753c6b4886c670c8f0f0a9478e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c5493f58d5090854a0e751aa0521becf

SHA1
fac83cf7c78df6568d4b669c5eef2b18f74ac598

SHA256
789fed3fb04274fe5fa2475353449220fb1e9ec5003b5f7c0dd27a0e1f685565

SHA512
9d308c17b0f57005eb6ec0f9d6eaffdf813fccf5ae78b785c9569e5adf38793e57ce2f627333607871621f66a599717ac7a42199bfb0604b820bc780da543231

Download Submit
C:\Users\Admin\AppData\Local\Temp\3a8tNGcxSj.bat

Filesize
252B

MD5
1a73e795f27dc5492f2bbcc8988e0d9c

SHA1
e9985874ad4e315367a7cbb5f394383efd66d654

SHA256
63b7d7e1ed2ca81786b8aab7b3f6d876be2379254ce42de6d583b91d68c43ac3

SHA512
ae105937da45d7c9cc37716e40ecc4c8e8a1a0a5a940d45750221f3b85d7b85151c8790f1ff171442f4ca736112e16434cb5cc3356d6cb64b4a2f58e2f4992d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\BAWHCtE00Z.bat

Filesize
252B

MD5
7e4bd87a30fcd912359c6cbe6e698ea4

SHA1
b12356e653d9b9b4a9b64cf349ad4a826199b4be

SHA256
1b560c009f70b3958eda9ef73b1ae63d7c7bd865ade8d5433f105d3422ee4997

SHA512
4ea721e04969a10858546b30c19b825e52f0a077cb8c6f5ced5fb7f5edbcfd131e6851cc01cc9062a72acc4aa805e03bef7ab8121401a8e165e3df497848b14a

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA9F7.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\MKE9IzBoeI.bat

Filesize
252B

MD5
4666bea97a12f4411c12f37d1be67eae

SHA1
15d5fc53f5c4ff9672428e33ae1e0dae4e08511b

SHA256
10c95a8292a212316cbc9b587d9f5c47156fb892fa8d2364c3aae7313a15cafd

SHA512
67560343ea8b3f369d2332f6de397e4db5964855eda08bdf640aff352ec43c4d4f847eefb0a69775318e16e74b2754211dce227ae60f6a56a4ed683eb19ebe9e

Download Submit
C:\Users\Admin\AppData\Local\Temp\OS3CX563UF.bat

Filesize
252B

MD5
2f7936797269770cbbc8b915d03c9aea

SHA1
d7f1f473f9f16211d379c15b5d183d6f886da02d

SHA256
7c7c951cfc7b3b9554429e6d4897959b5f9436f71a4dc7c96698242ac6d4fa75

SHA512
e2f6ea89fea66c771b25f0eb9c7be6a175b771f73add67189b3adbb2afee950ad5eebd88104fad89fe5df76424ed020a72c6bdd0ee30dda45b99ee99132fd80a

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarAA1A.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\arqkgCRh4V.bat

Filesize
252B

MD5
8104639095fea5e1ab6541cd3d462257

SHA1
6bf4ed4d505447bad23037d254ded9b0d97fbfaf

SHA256
3b6a9f393ebaac6c3598ba27e2ff4a3eac5f59e68fd36f14360c5b33cb6cba7c

SHA512
ee47bb931afecd98c36a55eb209b46464c2565592135604b7b0504a8f695384ad921c1db53f2cf8add5fdfc0dcb486f1f36bcba8df8569870fdf73b8b7e8801e

Download Submit
C:\Users\Admin\AppData\Local\Temp\or7X1gMNi7.bat

Filesize
252B

MD5
cad7d520b4b20905bdef7eb99e2b7f56

SHA1
403087d1ddce02b584d148e520e865abd87e3454

SHA256
70a76e189935e900e48f38bb73ff511bec27608935685ae196db42fa6f2dc370

SHA512
c0526b87f44ada76a1baa25865f5ea4d7b89ffe31f4110445cfdde6c72368d6b3e9a1495e0fc5593248b269bcd40fdf7dba71355bdbbdc99b280d581816e9a56

Download Submit
C:\Users\Admin\AppData\Local\Temp\ounU5LkXKE.bat

Filesize
252B

MD5
85e5173037fab7891f2478bf9cbfacd5

SHA1
1372a092ce6a080b51f0b2adfef16085e1efd56f

SHA256
eb25565f51f3e6087a25d9aae177510ee6c488059908a5058e1d04018671ee11

SHA512
79ad4800a245daa69f08ac95ef913bcb86b493ab2c5ae3314d2b8d5bf5768a7a7801bb220f1b5ccc25970109dcf4fa429c2730c45851bd37f639c7942edf1a8c

Download Submit
C:\Users\Admin\AppData\Local\Temp\pCY6B1XXru.bat

Filesize
252B

MD5
a30c4524d5db6432c30e68d3e4497ff6

SHA1
771abc6927fde78500268b4030ac48033671ffe1

SHA256
345bc5aa03670a9f7015f66926cd9ba856b6cfbdd3f38fe822c24f5f13a34d3c

SHA512
de8e8aba835c3683f356160fd999f0f8229d02b1225ab880a6d91216f82abaaca75a16500ad799d7870cc02f41a0240f66e38e4ac62cbb252bacb5eac5a4a71e

Download Submit
C:\Users\Admin\AppData\Local\Temp\vIn8vbLsXf.bat

Filesize
252B

MD5
2d161a5fdcc51748ef7451f4521c8350

SHA1
76e66f2d5c6230da8f152c0cc69414605ad93e60

SHA256
2be5df756e535ec4eb0e3c7ce8b49f687f85853453ab8af124e4280c56dc12ba

SHA512
c6b05d07e537df89988a99f187292878e3a05d00d4192eabbd0e6546ed4f1ac135ddab566a58f7fa718f3f602f33ad367e12527965d20d3f147c3b9458197ce5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6B47ARTL3HEBSFVOGNQT.temp

Filesize
7KB

MD5
2fb0fd23c7e7e9120bf676b72f5ce787

SHA1
e7fdad14a14f06e4d055d0cb4663084f69347833

SHA256
8ac93b848eae3221bf2b48ee632e6ee5d3607f40d5ece3d0dafec3b35a8b9915

SHA512
2304641ff9ed698dc232b5bf66412ba011c89e5dcf22ba2c629684214633641149a12753a3e45c542593872f91bf50d75a67795541e118f666bfce3b5201620a

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
memory/1048-376-0x0000000000150000-0x0000000000162000-memory.dmp

Filesize
72KB

Download
memory/1588-66-0x000000001B540000-0x000000001B822000-memory.dmp

Filesize
2.9MB

Download
memory/1588-71-0x0000000001F20000-0x0000000001F28000-memory.dmp

Filesize
32KB

Download
memory/1752-197-0x00000000003C0000-0x00000000003D2000-memory.dmp

Filesize
72KB

Download
memory/2636-65-0x0000000001230000-0x0000000001340000-memory.dmp

Filesize
1.1MB

Download
memory/2636-138-0x0000000000340000-0x0000000000352000-memory.dmp

Filesize
72KB

Download
memory/2792-673-0x0000000000250000-0x0000000000360000-memory.dmp

Filesize
1.1MB

Download
memory/2848-495-0x0000000001250000-0x0000000001360000-memory.dmp

Filesize
1.1MB

Download
memory/2928-257-0x0000000000150000-0x0000000000162000-memory.dmp

Filesize
72KB

Download
memory/2940-13-0x0000000000B30000-0x0000000000C40000-memory.dmp

Filesize
1.1MB

Download
memory/2940-14-0x0000000000350000-0x0000000000362000-memory.dmp

Filesize
72KB

Download
memory/2940-15-0x00000000003F0000-0x00000000003FC000-memory.dmp

Filesize
48KB

Download
memory/2940-16-0x00000000003E0000-0x00000000003EC000-memory.dmp

Filesize
48KB

Download
memory/2940-17-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download