dcrat | c0d608e4c7ed8c7e727458cbd9f265e59dd454d6e7624b5f834284d7cb8804a4

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
22-12-2024 11:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_c0d608e4c7ed8c7e727458cbd9f265e59dd454d6e7624b5f834284d7cb8804a4.exe
Size

1.3MB
MD5

767e47d21d79ba98aff5be0d39ef2503
SHA1

0581e3b2df07deddee34e2df8cb141e1e9ee3ac9
SHA256

c0d608e4c7ed8c7e727458cbd9f265e59dd454d6e7624b5f834284d7cb8804a4
SHA512

580553fe002e4b5e69705dab38dc92b9d1265baea5818fd842f5b522e3d5085f7d9dfe7faaf5390f46482b89d555be9a4649061a832b699a972d5fa63714f863
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 45 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2896	2940	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3000	2940	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2844	2940	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2864	2940	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1668	2940	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2728	2940	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2696	2940	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2432	2940	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2328	2940	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2180	2940	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2276	2940	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2224	2940	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2196	2940	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2280	2940	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2568	2940	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1768	2940	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2736	2940	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1756	2940	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2636	2940	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	588	2940	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	592	2940	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2228	2940	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1612	2940	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1016	2940	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	572	2940	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	780	2940	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1628	2940	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2316	2940	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2512	2940	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2492	2940	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2852	2940	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1008	2940	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2752	2940	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2908	2940	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2784	2940	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2928	2940	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2732	2940	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2740	2940	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3044	2940	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2708	2940	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2724	2940	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2596	2940	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2692	2940	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2404	2940	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2696	2940	schtasks.exe	34

DCRat payload 9 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0008000000016875-12.dat	dcrat
behavioral1/memory/1500-13-0x0000000000B60000-0x0000000000C70000-memory.dmp	dcrat
behavioral1/memory/2984-145-0x0000000000AC0000-0x0000000000BD0000-memory.dmp	dcrat
behavioral1/memory/1288-204-0x0000000001150000-0x0000000001260000-memory.dmp	dcrat
behavioral1/memory/2892-382-0x00000000001B0000-0x00000000002C0000-memory.dmp	dcrat
behavioral1/memory/1288-442-0x00000000003E0000-0x00000000004F0000-memory.dmp	dcrat
behavioral1/memory/2420-503-0x0000000000C90000-0x0000000000DA0000-memory.dmp	dcrat
behavioral1/memory/2480-563-0x0000000000DB0000-0x0000000000EC0000-memory.dmp	dcrat
behavioral1/memory/2156-682-0x0000000000100000-0x0000000000210000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 17 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2240	powershell.exe
2420	powershell.exe
2620	powershell.exe
1184	powershell.exe
2684	powershell.exe
2456	powershell.exe
1528	powershell.exe
2244	powershell.exe
2600	powershell.exe
2776	powershell.exe
2448	powershell.exe
1664	powershell.exe
2520	powershell.exe
2168	powershell.exe
1928	powershell.exe
2312	powershell.exe
2808	powershell.exe

Executes dropped EXE 12 IoCs

pid	Process
1500	DllCommonsvc.exe
2480	DllCommonsvc.exe
2984	smss.exe
1288	smss.exe
700	smss.exe
1248	smss.exe
2892	smss.exe
1288	smss.exe
2420	smss.exe
2480	smss.exe
2724	smss.exe
2156	smss.exe

Loads dropped DLL 2 IoCs

pid	Process
1708	cmd.exe
1708	cmd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 11 IoCs

Web Service

T1102

flow	ioc
9	raw.githubusercontent.com
19	raw.githubusercontent.com
22	raw.githubusercontent.com
29	raw.githubusercontent.com
33	raw.githubusercontent.com
36	raw.githubusercontent.com
4	raw.githubusercontent.com
5	raw.githubusercontent.com
12	raw.githubusercontent.com
16	raw.githubusercontent.com
25	raw.githubusercontent.com

Drops file in Program Files directory 14 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Uninstall Information\powershell.exe	DllCommonsvc.exe
File created	C:\Program Files\Reference Assemblies\lsm.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Defender\cmd.exe	DllCommonsvc.exe
File created	C:\Program Files\Reference Assemblies\101b941d020240	DllCommonsvc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\features\csrss.exe	DllCommonsvc.exe
File created	C:\Program Files\Mozilla Firefox\powershell.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Defender\ebf1f9fa8afd6d	DllCommonsvc.exe
File created	C:\Program Files\Mozilla Firefox\browser\features\csrss.exe	DllCommonsvc.exe
File created	C:\Program Files\Mozilla Firefox\browser\features\886983d96e3d3e	DllCommonsvc.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\lsass.exe	DllCommonsvc.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\6203df4a6bafc7	DllCommonsvc.exe
File created	C:\Program Files\Mozilla Firefox\e978f868350d50	DllCommonsvc.exe
File created	C:\Program Files (x86)\Uninstall Information\e978f868350d50	DllCommonsvc.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\cmd.exe	DllCommonsvc.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SoftwareDistribution\AuthCabs\csrss.exe	DllCommonsvc.exe
File created	C:\Windows\SoftwareDistribution\AuthCabs\886983d96e3d3e	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_c0d608e4c7ed8c7e727458cbd9f265e59dd454d6e7624b5f834284d7cb8804a4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 45 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
592	schtasks.exe
2708	schtasks.exe
2568	schtasks.exe
588	schtasks.exe
2724	schtasks.exe
2492	schtasks.exe
2852	schtasks.exe
2752	schtasks.exe
2740	schtasks.exe
2844	schtasks.exe
2432	schtasks.exe
1612	schtasks.exe
1016	schtasks.exe
3044	schtasks.exe
2696	schtasks.exe
1768	schtasks.exe
2228	schtasks.exe
1628	schtasks.exe
2728	schtasks.exe
2180	schtasks.exe
2276	schtasks.exe
2280	schtasks.exe
2696	schtasks.exe
2196	schtasks.exe
2316	schtasks.exe
2512	schtasks.exe
1008	schtasks.exe
2784	schtasks.exe
2928	schtasks.exe
2732	schtasks.exe
2896	schtasks.exe
2224	schtasks.exe
1756	schtasks.exe
780	schtasks.exe
2736	schtasks.exe
2636	schtasks.exe
572	schtasks.exe
2908	schtasks.exe
3000	schtasks.exe
2864	schtasks.exe
1668	schtasks.exe
2328	schtasks.exe
2692	schtasks.exe
2404	schtasks.exe
2596	schtasks.exe

Suspicious behavior: EnumeratesProcesses 31 IoCs

pid	Process
1500	DllCommonsvc.exe
1500	DllCommonsvc.exe
1500	DllCommonsvc.exe
2448	powershell.exe
2420	powershell.exe
2244	powershell.exe
2620	powershell.exe
2600	powershell.exe
2480	DllCommonsvc.exe
2240	powershell.exe
2684	powershell.exe
1184	powershell.exe
2456	powershell.exe
2776	powershell.exe
2312	powershell.exe
2808	powershell.exe
1528	powershell.exe
2520	powershell.exe
2168	powershell.exe
1664	powershell.exe
1928	powershell.exe
2984	smss.exe
1288	smss.exe
700	smss.exe
1248	smss.exe
2892	smss.exe
1288	smss.exe
2420	smss.exe
2480	smss.exe
2724	smss.exe
2156	smss.exe

Suspicious use of AdjustPrivilegeToken 29 IoCs

description	pid	Process
Token: SeDebugPrivilege	1500	DllCommonsvc.exe
Token: SeDebugPrivilege	2448	powershell.exe
Token: SeDebugPrivilege	2420	powershell.exe
Token: SeDebugPrivilege	2480	DllCommonsvc.exe
Token: SeDebugPrivilege	2244	powershell.exe
Token: SeDebugPrivilege	2620	powershell.exe
Token: SeDebugPrivilege	2600	powershell.exe
Token: SeDebugPrivilege	2240	powershell.exe
Token: SeDebugPrivilege	2684	powershell.exe
Token: SeDebugPrivilege	1184	powershell.exe
Token: SeDebugPrivilege	2776	powershell.exe
Token: SeDebugPrivilege	2456	powershell.exe
Token: SeDebugPrivilege	2312	powershell.exe
Token: SeDebugPrivilege	2808	powershell.exe
Token: SeDebugPrivilege	1528	powershell.exe
Token: SeDebugPrivilege	2520	powershell.exe
Token: SeDebugPrivilege	2168	powershell.exe
Token: SeDebugPrivilege	1664	powershell.exe
Token: SeDebugPrivilege	1928	powershell.exe
Token: SeDebugPrivilege	2984	smss.exe
Token: SeDebugPrivilege	1288	smss.exe
Token: SeDebugPrivilege	700	smss.exe
Token: SeDebugPrivilege	1248	smss.exe
Token: SeDebugPrivilege	2892	smss.exe
Token: SeDebugPrivilege	1288	smss.exe
Token: SeDebugPrivilege	2420	smss.exe
Token: SeDebugPrivilege	2480	smss.exe
Token: SeDebugPrivilege	2724	smss.exe
Token: SeDebugPrivilege	2156	smss.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2132 wrote to memory of 2524	2132	JaffaCakes118_c0d608e4c7ed8c7e727458cbd9f265e59dd454d6e7624b5f834284d7cb8804a4.exe	30
PID 2132 wrote to memory of 2524	2132	JaffaCakes118_c0d608e4c7ed8c7e727458cbd9f265e59dd454d6e7624b5f834284d7cb8804a4.exe	30
PID 2132 wrote to memory of 2524	2132	JaffaCakes118_c0d608e4c7ed8c7e727458cbd9f265e59dd454d6e7624b5f834284d7cb8804a4.exe	30
PID 2132 wrote to memory of 2524	2132	JaffaCakes118_c0d608e4c7ed8c7e727458cbd9f265e59dd454d6e7624b5f834284d7cb8804a4.exe	30
PID 2524 wrote to memory of 1708	2524	WScript.exe	31
PID 2524 wrote to memory of 1708	2524	WScript.exe	31
PID 2524 wrote to memory of 1708	2524	WScript.exe	31
PID 2524 wrote to memory of 1708	2524	WScript.exe	31
PID 1708 wrote to memory of 1500	1708	cmd.exe	33
PID 1708 wrote to memory of 1500	1708	cmd.exe	33
PID 1708 wrote to memory of 1500	1708	cmd.exe	33
PID 1708 wrote to memory of 1500	1708	cmd.exe	33
PID 1500 wrote to memory of 2240	1500	DllCommonsvc.exe	50
PID 1500 wrote to memory of 2240	1500	DllCommonsvc.exe	50
PID 1500 wrote to memory of 2240	1500	DllCommonsvc.exe	50
PID 1500 wrote to memory of 2448	1500	DllCommonsvc.exe	51
PID 1500 wrote to memory of 2448	1500	DllCommonsvc.exe	51
PID 1500 wrote to memory of 2448	1500	DllCommonsvc.exe	51
PID 1500 wrote to memory of 2244	1500	DllCommonsvc.exe	52
PID 1500 wrote to memory of 2244	1500	DllCommonsvc.exe	52
PID 1500 wrote to memory of 2244	1500	DllCommonsvc.exe	52
PID 1500 wrote to memory of 2420	1500	DllCommonsvc.exe	54
PID 1500 wrote to memory of 2420	1500	DllCommonsvc.exe	54
PID 1500 wrote to memory of 2420	1500	DllCommonsvc.exe	54
PID 1500 wrote to memory of 2600	1500	DllCommonsvc.exe	56
PID 1500 wrote to memory of 2600	1500	DllCommonsvc.exe	56
PID 1500 wrote to memory of 2600	1500	DllCommonsvc.exe	56
PID 1500 wrote to memory of 2620	1500	DllCommonsvc.exe	57
PID 1500 wrote to memory of 2620	1500	DllCommonsvc.exe	57
PID 1500 wrote to memory of 2620	1500	DllCommonsvc.exe	57
PID 1500 wrote to memory of 2480	1500	DllCommonsvc.exe	62
PID 1500 wrote to memory of 2480	1500	DllCommonsvc.exe	62
PID 1500 wrote to memory of 2480	1500	DllCommonsvc.exe	62
PID 2480 wrote to memory of 1184	2480	DllCommonsvc.exe	93
PID 2480 wrote to memory of 1184	2480	DllCommonsvc.exe	93
PID 2480 wrote to memory of 1184	2480	DllCommonsvc.exe	93
PID 2480 wrote to memory of 1928	2480	DllCommonsvc.exe	94
PID 2480 wrote to memory of 1928	2480	DllCommonsvc.exe	94
PID 2480 wrote to memory of 1928	2480	DllCommonsvc.exe	94
PID 2480 wrote to memory of 2684	2480	DllCommonsvc.exe	95
PID 2480 wrote to memory of 2684	2480	DllCommonsvc.exe	95
PID 2480 wrote to memory of 2684	2480	DllCommonsvc.exe	95
PID 2480 wrote to memory of 2456	2480	DllCommonsvc.exe	96
PID 2480 wrote to memory of 2456	2480	DllCommonsvc.exe	96
PID 2480 wrote to memory of 2456	2480	DllCommonsvc.exe	96
PID 2480 wrote to memory of 2776	2480	DllCommonsvc.exe	97
PID 2480 wrote to memory of 2776	2480	DllCommonsvc.exe	97
PID 2480 wrote to memory of 2776	2480	DllCommonsvc.exe	97
PID 2480 wrote to memory of 1664	2480	DllCommonsvc.exe	98
PID 2480 wrote to memory of 1664	2480	DllCommonsvc.exe	98
PID 2480 wrote to memory of 1664	2480	DllCommonsvc.exe	98
PID 2480 wrote to memory of 2520	2480	DllCommonsvc.exe	99
PID 2480 wrote to memory of 2520	2480	DllCommonsvc.exe	99
PID 2480 wrote to memory of 2520	2480	DllCommonsvc.exe	99
PID 2480 wrote to memory of 2808	2480	DllCommonsvc.exe	100
PID 2480 wrote to memory of 2808	2480	DllCommonsvc.exe	100
PID 2480 wrote to memory of 2808	2480	DllCommonsvc.exe	100
PID 2480 wrote to memory of 2168	2480	DllCommonsvc.exe	101
PID 2480 wrote to memory of 2168	2480	DllCommonsvc.exe	101
PID 2480 wrote to memory of 2168	2480	DllCommonsvc.exe	101
PID 2480 wrote to memory of 1528	2480	DllCommonsvc.exe	102
PID 2480 wrote to memory of 1528	2480	DllCommonsvc.exe	102
PID 2480 wrote to memory of 1528	2480	DllCommonsvc.exe	102
PID 2480 wrote to memory of 2312	2480	DllCommonsvc.exe	103

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c0d608e4c7ed8c7e727458cbd9f265e59dd454d6e7624b5f834284d7cb8804a4.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c0d608e4c7ed8c7e727458cbd9f265e59dd454d6e7624b5f834284d7cb8804a4.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2132
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2524
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1708
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1500
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2240
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Defender\cmd.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2448
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\Idle.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2244
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\lsm.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2420
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\audiodg.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2600
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\SoftwareDistribution\AuthCabs\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2620
    - - C:\providercommon\DllCommonsvc.exe
        
        "C:\providercommon\DllCommonsvc.exe"
        5⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2480
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1184
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Mozilla Firefox\browser\features\csrss.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1928
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\csrss.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2684
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\csrss.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2456
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\lsass.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2776
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\conhost.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1664
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\smss.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2520
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Mozilla Firefox\powershell.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2808
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Uninstall Information\powershell.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2168
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\csrss.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1528
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Reference Assemblies\lsm.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2312
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\c6je8lAH0f.bat"
        6⤵
        
        PID:2196
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:708
        
        C:\MSOCache\All Users\smss.exe
        
        "C:\MSOCache\All Users\smss.exe"
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2984
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\15yWIDpGaf.bat"
        8⤵
        
        PID:1464
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:2460
        
        C:\MSOCache\All Users\smss.exe
        
        "C:\MSOCache\All Users\smss.exe"
        9⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1288
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\J97QZsi4Oz.bat"
        10⤵
        
        PID:1184
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:2312
        
        C:\MSOCache\All Users\smss.exe
        
        "C:\MSOCache\All Users\smss.exe"
        11⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:700
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\sodlpYYBfa.bat"
        12⤵
        
        PID:1560
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:2712
        
        C:\MSOCache\All Users\smss.exe
        
        "C:\MSOCache\All Users\smss.exe"
        13⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1248
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\DegeIw2hse.bat"
        14⤵
        
        PID:1812
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        15⤵
        
        PID:1672
        
        C:\MSOCache\All Users\smss.exe
        
        "C:\MSOCache\All Users\smss.exe"
        15⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2892
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\muCkezbCVz.bat"
        16⤵
        
        PID:300
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        17⤵
        
        PID:2976
        
        C:\MSOCache\All Users\smss.exe
        
        "C:\MSOCache\All Users\smss.exe"
        17⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1288
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\8NcI1AeIbp.bat"
        18⤵
        
        PID:872
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        19⤵
        
        PID:1064
        
        C:\MSOCache\All Users\smss.exe
        
        "C:\MSOCache\All Users\smss.exe"
        19⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2420
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\SU2rmp5bpW.bat"
        20⤵
        
        PID:2956
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        21⤵
        
        PID:2284
        
        C:\MSOCache\All Users\smss.exe
        
        "C:\MSOCache\All Users\smss.exe"
        21⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2480
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\NpgWdIWSbT.bat"
        22⤵
        
        PID:1796
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        23⤵
        
        PID:1816
        
        C:\MSOCache\All Users\smss.exe
        
        "C:\MSOCache\All Users\smss.exe"
        23⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2724
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\uruRJY5g5x.bat"
        24⤵
        
        PID:2452
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        25⤵
        
        PID:1792
        
        C:\MSOCache\All Users\smss.exe
        
        "C:\MSOCache\All Users\smss.exe"
        25⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2156
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\paq62miIo8.bat"
        26⤵
        
        PID:2512
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        27⤵
        
        PID:928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Defender\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2896

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Defender\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2328

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2180

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2276

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Windows\SoftwareDistribution\AuthCabs\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2196

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\SoftwareDistribution\AuthCabs\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2280

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Windows\SoftwareDistribution\AuthCabs\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Program Files\Mozilla Firefox\browser\features\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\browser\features\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Program Files\Mozilla Firefox\browser\features\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\providercommon\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\providercommon\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\providercommon\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\MSOCache\All Users\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 6 /tr "'C:\Program Files\Mozilla Firefox\powershell.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershell" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\powershell.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 8 /tr "'C:\Program Files\Mozilla Firefox\powershell.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Uninstall Information\powershell.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershell" /sc ONLOGON /tr "'C:\Program Files (x86)\Uninstall Information\powershell.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2740

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Uninstall Information\powershell.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\providercommon\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\providercommon\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\providercommon\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 10 /tr "'C:\Program Files\Reference Assemblies\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Program Files\Reference Assemblies\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 12 /tr "'C:\Program Files\Reference Assemblies\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
838dbde590c9b250552457c2fc98b50a

SHA1
419408f1ea2de180d851bd9073cc751799597018

SHA256
29d1fb5e747b0af33553556146ed95678db30719c2d0b74bac813a8588620f4c

SHA512
7a49c43a3808e999648591db35e741e78cdb5a3c39d0f8f2fc44e40ce85c5cd016a88cbb0cadb25ff709ec1d98ea5b4c40e2abeba967ae641b0abf448956b998

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
04a9530bb8f20da0888e1e0dc55a75e4

SHA1
b385daba42450b5142e822cb15c1b47e453dcd51

SHA256
dc577388e2746022b19068666af6bfcb7a4c1d8e2efed1a4c3b8e4d2dfbbbf1d

SHA512
c0ea9b20b09e096846e56ac9d38b39e0732cc9f398c09668c8fae7efde2dff5ab4a77f94e19208ff53c360112588280507ec110cb7bfdfe4787935b7a5d73f6b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f734285c53f9adfca8080640af2a9b2d

SHA1
67ec8e6285d3fe79c56419b3bfbdd4237cd14c78

SHA256
c742b25a084d1bb475c8d90a653d82571535beaba1afa7b7b282b2af5c505fa5

SHA512
f3904405cbe119c8533d740ab046783b98bf276128b74cb3c11cb88cf07c1f4e395b6c18d827b37553edcde7e2685acde227692991ad89286ee53e612358d0fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
67370f8a5655d38d7e57c26b79122b99

SHA1
c5ee066ada03642d27c2ceb054582dc86b08ba81

SHA256
89ade5df7a6aa05605004b9fcdf8d9d09dfc993a96ba0e16e93f9f72cfe80b4e

SHA512
759808913c5f8620c06ee9fe89d17cd16bc2c4df821ef66327b15ad16d4f6419751afdeb7dc0e89e505f7f8e2c3b352122496f482f78a7b61273d999053a5ff7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5637f73d5ab887d34d18d4fb6004c5a0

SHA1
c05079dedbed19f913313e1c0a85cbe9396aeab8

SHA256
01ac1f52ac95d5559621d946fa026650116df2b5eba2483d6d88ad7b120e0aa0

SHA512
1d3b9a6246d63c0d78ee57c78c1cfcd4a6f730e13ad62dfea96daf7b023986d77ee5bb126da135c01f2b27f9a1b0e5c58214a3d707254660392632d220d0a5e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
27cfff4fb968247da359819cde75f892

SHA1
a29ec0510891364c0b4b6488d004c8fe71b399c4

SHA256
604c8b5b76cddb2216f4d768e6782bd781c08715e2a5a3dd9d35c154af387322

SHA512
a797c1e644627e189199e75ac2fe0d7eff28fdd5ef08184ab820064bc1cdad131cf7c92761cd5e3d452eb2fb5e660faf0e11a5ffee0a10e46e9b7017c65e4c5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
21d4d4e523e4a32088c77736ef34c8d6

SHA1
3c5bba09580074a8a3307720554efc59a4b6684e

SHA256
258e55c538aafbe2d58dc592abb30ee9836615a0a470fa557d42dcc7e192ed0c

SHA512
e3c80f4c43d18b5bf1044b17340ebc43a2a231ef510345c7b7f641cc73b4c7922b67e61da2203925d3fc4390a94fef7025a9c80118916e745321aac91f5c5dbb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
81b5cd13f55990a8abea71977eb144f3

SHA1
d65a0517150b44c899bc028c1407e019eab6d280

SHA256
3ee803d8eb31a0d2bd22a89f6847fb4a66150de61b3d3341c36efde3f248a00c

SHA512
0eb37cbf8b76de0c17262185d28eb0ffea41d6597cb624d0a2979843a9fbe006ffab0477e04465aa5958748b7f45df1bff2eb8230993dda706c8720738ce21bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7a8f7779cbb7dd7c338ba6bdac093e18

SHA1
865b55b02ecf87b1f218a288dd8a566cf8200479

SHA256
057e74cc28b63ca3f8597b1984023e78e9ace196f5658d5ff1b8a9410bb8042d

SHA512
b107c412102f4d027b45ee43f30473408833a08a5b2a2462d53e89a024ec29e39356efa067e10fd6503d38b041d47a6c7740a09ce62d04680b6a31124608fd1e

Download Submit
C:\Users\Admin\AppData\Local\Temp\15yWIDpGaf.bat

Filesize
195B

MD5
ef8ccb4b0dd61e4d572868ee9384f8fd

SHA1
bfa95da7e85c25263d3c919a6704384b39632f96

SHA256
b086fe298b419db0c5b964963aaa78064988306c87fa5bcf0bc2b7e9a5f06d25

SHA512
8385bc85aaff18ea1dbb3b87dbc646bcb0d111c156e176e02b1d93936ab22d0b690e04672a1ce2cfd6a6b6281b5f57ce4dc9a60b63539e39cbfdee3bd5001d2b

Download Submit
C:\Users\Admin\AppData\Local\Temp\8NcI1AeIbp.bat

Filesize
195B

MD5
f5403de77810ee71b308cc383e820562

SHA1
b81bbf04ccbe83a1c75afb6b50a7372bd1b83593

SHA256
5d08031a59baa951c07efde38d50e85945226b56d328acd7b643558d2ef340a0

SHA512
6b2c11737afeabd34c35e8a2c04b6494f69dbd59002e351540b6e673cf93f57e644a4c6324feab1f5d63530d4f62fe598f2f50c26326b1a8a7e81c0f071d445a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7D1E.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\DegeIw2hse.bat

Filesize
195B

MD5
083cb3ec12ffa563fc5565dbabac1d7c

SHA1
91622801cadf79a527add56f1680b96d34c44101

SHA256
e04834874285f8b31f55e8234b2629cd0d27df3476e58cfcf6b7ef6b384edcb9

SHA512
001d51b702bf60a8485e64b2c7a2b680ccb4deb3c2f904e5d1c1711c27d1cbf6e3ff793125bf5d9a4619359d0bb7822666d50fc178f9398e1fe53d27145c32d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\J97QZsi4Oz.bat

Filesize
195B

MD5
eb9d80edb7df9ec1c766b8a598762fa2

SHA1
282b4e473b41ee7565b90f34ee1f63f3884ed03a

SHA256
b78087fb16e8f28f06be7fb67e27490ce4bc5bb1f33b06c406a02eca0f562b95

SHA512
c9eab8f8037d4a93e035b5b7886f6525372ca0f7cbdf3bf713c23feeff63d1d2b5d746f8f2ac8d0000bb6f5f640d29b34948b61272cc162cca68f86cc4f2aa10

Download Submit
C:\Users\Admin\AppData\Local\Temp\NpgWdIWSbT.bat

Filesize
195B

MD5
60f520da09f827064e38f923780490bf

SHA1
4e703183744e07e443bcd4a0c397947b00f606df

SHA256
03a6588bdac2ad00e25872352c3abc31aa48896f36b857f83c6fa96d8dd31db3

SHA512
3db3c985f56be43563b2bc6cd791990baaa5951087b32b06a793386dd43ab0d2e08c77ea46a60d464499870a1c99bc216cb64ab9f5150f83c80ea899897dd9fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\SU2rmp5bpW.bat

Filesize
195B

MD5
abca11c2d1877d19ba00e21f07727163

SHA1
5fc02570124bea39a6c82d3e1fe59f2f3f2bab0d

SHA256
d68d771a849c7199fb380fd9baf5bd12356d9996a5bdef49b59ac5ba6d537fe4

SHA512
31204d08016e7b8d2ce30c17eebce034ef1254be5a9c84071a49ff2f6dd6eba07be1526f42544c38dc4564b845d99b591d89bfabef59b1c763f652e9d9247cd1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7D40.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\c6je8lAH0f.bat

Filesize
195B

MD5
0167dea4ea50ca6a870f3382a5a33d86

SHA1
8687750f047dfc31c6befa094c00eaec4e1e68e4

SHA256
929092e90d478dec62896da97559e48c89884c92f5f5a8b5e7f857201e43ca9f

SHA512
c8758cb05b07f197e18908245005486a07b58a3275b6c16c0eb68a0e147fc7509cc2fa7becfb066e90056d3c478e65056ac154454b55ab90b87b8ae7e98c3797

Download Submit
C:\Users\Admin\AppData\Local\Temp\muCkezbCVz.bat

Filesize
195B

MD5
693020aad216380a552f911a0becbfe1

SHA1
57420a79020da4d9e801f30f9d27dd0786e78b0a

SHA256
f0a2c81522b7db1411afcbe959b31b6be35f11f7019284842df8ab59431a5bef

SHA512
f16d6b8541b895dd897315bce4a02946d349bfb1622226a7bc20ac361981d8f78d7bbea76f64316d1b973117b0a5690868f959428003732d5d40d2f12e36eb15

Download Submit
C:\Users\Admin\AppData\Local\Temp\paq62miIo8.bat

Filesize
195B

MD5
eb02db9c98e7c308d3fe80410a164e81

SHA1
4b9d5c12a07fff8000f3c58cbc00d8c970932d98

SHA256
fde0dc35d97a420896371b7b6e4a5a8b696fcf1d4bf019adf16d90dd1bbcd08b

SHA512
4ac3da3f761397920c29d04c8a4517519bc047f7f25a5e8bdd4deffe6528be9c610b79608a7809668eb600d9ab35c48835f4a53cd30f22e1ab2c5ddf69639399

Download Submit
C:\Users\Admin\AppData\Local\Temp\sodlpYYBfa.bat

Filesize
195B

MD5
021800aa9d2f9a3e2d92d77cc772765e

SHA1
872f5eedcf26ba3a3655df8525581885d71aa495

SHA256
5d66cc8edbcace055c6c61998b32d246d209f80ddae94c1cc7fbe5fa64e10d70

SHA512
7259f8f7ee48bd42d25e5c2fd19a8deb892ff0052728f3bb543d5abab120f79505c508e5cb1f91c44adf09a6aeed59e058a69a73db201b9c9cb4e767793f08fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\uruRJY5g5x.bat

Filesize
195B

MD5
57e176859715989f9840535e83d28908

SHA1
0bed71f0691cbfcdc9bc10355c32c13ff9ec5820

SHA256
3e213479d22d72dadc6c88c8b022615ddf29c719a91fd317a623cd7f758834b5

SHA512
12549b4757a0c908337f4492267d1d7d842127bc5c3215f494c62b09e9b6975fb3bcc9e7eeb7eb8b0fb3cee8a8edaab4863d98e12cf0177e31027e3bd0c7cccb

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
5afd322b139e4041ea3bfbff81f20bee

SHA1
b66fa2277cc5466f1de58e833c3dd069f11a4af7

SHA256
6b0add2236f40e3b8f9fdd6b5f315bebabc2fbb2472ddd424c93a2bbba68fb95

SHA512
9fdf7b23dcaeb7c42767509e7d5de8e7090faab0706d966d1f3640fc51cecec81165d9a5e4d0a17f4d45763eca1fee9ed98938c760d1c00d2966a9a143271ef7

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/1288-442-0x00000000003E0000-0x00000000004F0000-memory.dmp

Filesize
1.1MB

Download
memory/1288-204-0x0000000001150000-0x0000000001260000-memory.dmp

Filesize
1.1MB

Download
memory/1288-443-0x0000000000140000-0x0000000000152000-memory.dmp

Filesize
72KB

Download
memory/1500-17-0x000000001AE80000-0x000000001AE8C000-memory.dmp

Filesize
48KB

Download
memory/1500-14-0x00000000003D0000-0x00000000003E2000-memory.dmp

Filesize
72KB

Download
memory/1500-13-0x0000000000B60000-0x0000000000C70000-memory.dmp

Filesize
1.1MB

Download
memory/1500-15-0x0000000000410000-0x000000000041C000-memory.dmp

Filesize
48KB

Download
memory/1500-16-0x0000000002150000-0x000000000215C000-memory.dmp

Filesize
48KB

Download
memory/2156-682-0x0000000000100000-0x0000000000210000-memory.dmp

Filesize
1.1MB

Download
memory/2420-503-0x0000000000C90000-0x0000000000DA0000-memory.dmp

Filesize
1.1MB

Download
memory/2448-38-0x000000001B6A0000-0x000000001B982000-memory.dmp

Filesize
2.9MB

Download
memory/2448-39-0x0000000001FE0000-0x0000000001FE8000-memory.dmp

Filesize
32KB

Download
memory/2480-563-0x0000000000DB0000-0x0000000000EC0000-memory.dmp

Filesize
1.1MB

Download
memory/2480-45-0x00000000003D0000-0x00000000003E2000-memory.dmp

Filesize
72KB

Download
memory/2684-91-0x0000000001F60000-0x0000000001F68000-memory.dmp

Filesize
32KB

Download
memory/2684-90-0x000000001B6E0000-0x000000001B9C2000-memory.dmp

Filesize
2.9MB

Download
memory/2892-382-0x00000000001B0000-0x00000000002C0000-memory.dmp

Filesize
1.1MB

Download
memory/2984-145-0x0000000000AC0000-0x0000000000BD0000-memory.dmp

Filesize
1.1MB

Download