dcrat | 346b17c3b64930e9ec6509fd38bdb30c24c4e04761a57e9fd0eefe13addce0af

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
22-12-2024 12:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_346b17c3b64930e9ec6509fd38bdb30c24c4e04761a57e9fd0eefe13addce0af.exe
Size

1.3MB
MD5

5fbc4bca617169252bda8262e9b737a9
SHA1

ac83bf7260fbe3716603d46f70aec1fbc86683f2
SHA256

346b17c3b64930e9ec6509fd38bdb30c24c4e04761a57e9fd0eefe13addce0af
SHA512

95f7674512882251acef53907c1c6b0bf68da43ef2e4ab28053328b85bb8f5d4608963826d852b0ac19fce2689761731364545415830ec657b36cba088eba62c
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 42 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2800	2940	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2888	2940	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2784	2940	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2880	2940	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1668	2940	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2932	2940	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2696	2940	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2788	2940	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1804	2940	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2072	2940	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	112	2940	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2224	2940	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2196	2940	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2280	2940	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1812	2940	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2424	2940	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2232	2940	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1184	2940	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2056	2940	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1800	2940	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1268	2940	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1960	2940	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1284	2940	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2124	2940	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2628	2940	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1576	2940	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1944	2940	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1664	2940	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	708	2940	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	628	2940	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1636	2940	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	916	2940	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1820	2940	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1672	2940	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	872	2940	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1972	2940	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	308	2940	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1720	2940	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2028	2940	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2652	2940	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2348	2940	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2636	2940	schtasks.exe	34

DCRat payload 13 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0008000000016875-12.dat	dcrat
behavioral1/memory/1500-13-0x0000000000A60000-0x0000000000B70000-memory.dmp	dcrat
behavioral1/memory/784-52-0x00000000000B0000-0x00000000001C0000-memory.dmp	dcrat
behavioral1/memory/892-188-0x0000000000CE0000-0x0000000000DF0000-memory.dmp	dcrat
behavioral1/memory/2208-248-0x0000000000080000-0x0000000000190000-memory.dmp	dcrat
behavioral1/memory/1268-308-0x0000000000B90000-0x0000000000CA0000-memory.dmp	dcrat
behavioral1/memory/2988-368-0x0000000000230000-0x0000000000340000-memory.dmp	dcrat
behavioral1/memory/2044-429-0x0000000000270000-0x0000000000380000-memory.dmp	dcrat
behavioral1/memory/1680-490-0x0000000001040000-0x0000000001150000-memory.dmp	dcrat
behavioral1/memory/2676-551-0x0000000000320000-0x0000000000430000-memory.dmp	dcrat
behavioral1/memory/2436-611-0x0000000000830000-0x0000000000940000-memory.dmp	dcrat
behavioral1/memory/1620-671-0x00000000009F0000-0x0000000000B00000-memory.dmp	dcrat
behavioral1/memory/1760-731-0x00000000000D0000-0x00000000001E0000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 15 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
888	powershell.exe
588	powershell.exe
496	powershell.exe
700	powershell.exe
2504	powershell.exe
1656	powershell.exe
536	powershell.exe
2148	powershell.exe
1328	powershell.exe
904	powershell.exe
2536	powershell.exe
592	powershell.exe
2228	powershell.exe
1060	powershell.exe
712	powershell.exe

Executes dropped EXE 12 IoCs

pid	Process
1500	DllCommonsvc.exe
784	lsass.exe
892	lsass.exe
2208	lsass.exe
1268	lsass.exe
2988	lsass.exe
2044	lsass.exe
1680	lsass.exe
2676	lsass.exe
2436	lsass.exe
1620	lsass.exe
1760	lsass.exe

Loads dropped DLL 2 IoCs

pid	Process
1708	cmd.exe
1708	cmd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 12 IoCs

Web Service

T1102

flow	ioc
4	raw.githubusercontent.com
5	raw.githubusercontent.com
9	raw.githubusercontent.com
19	raw.githubusercontent.com
26	raw.githubusercontent.com
33	raw.githubusercontent.com
40	raw.githubusercontent.com
12	raw.githubusercontent.com
16	raw.githubusercontent.com
23	raw.githubusercontent.com
30	raw.githubusercontent.com
37	raw.githubusercontent.com

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File created	C:\Program Files\VideoLAN\VLC\lua\playlist\conhost.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Journal\services.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Journal\c5b4cb5e9653cc	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Defender\it-IT\System.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Defender\it-IT\27d1bcfc3c54e0	DllCommonsvc.exe
File created	C:\Program Files\VideoLAN\VLC\lua\playlist\088424020bedd6	DllCommonsvc.exe
File opened for modification	C:\Program Files\Windows Journal\services.exe	DllCommonsvc.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\OSPPSVC.exe	DllCommonsvc.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\1610b97d3ab4a7	DllCommonsvc.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\AppPatch\es-ES\Idle.exe	DllCommonsvc.exe
File created	C:\Windows\AppPatch\es-ES\6ccacd8608530f	DllCommonsvc.exe
File created	C:\Windows\LiveKernelReports\services.exe	DllCommonsvc.exe
File created	C:\Windows\LiveKernelReports\c5b4cb5e9653cc	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_346b17c3b64930e9ec6509fd38bdb30c24c4e04761a57e9fd0eefe13addce0af.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 42 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
708	schtasks.exe
1720	schtasks.exe
112	schtasks.exe
2280	schtasks.exe
2232	schtasks.exe
1184	schtasks.exe
2124	schtasks.exe
2196	schtasks.exe
916	schtasks.exe
1820	schtasks.exe
2784	schtasks.exe
2696	schtasks.exe
1812	schtasks.exe
628	schtasks.exe
2028	schtasks.exe
2932	schtasks.exe
1284	schtasks.exe
1576	schtasks.exe
1664	schtasks.exe
1972	schtasks.exe
2800	schtasks.exe
2224	schtasks.exe
2056	schtasks.exe
2348	schtasks.exe
308	schtasks.exe
2652	schtasks.exe
1668	schtasks.exe
2788	schtasks.exe
1268	schtasks.exe
1944	schtasks.exe
1636	schtasks.exe
2628	schtasks.exe
872	schtasks.exe
2636	schtasks.exe
2888	schtasks.exe
1804	schtasks.exe
2072	schtasks.exe
2424	schtasks.exe
1960	schtasks.exe
2880	schtasks.exe
1800	schtasks.exe
1672	schtasks.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
1500	DllCommonsvc.exe
1500	DllCommonsvc.exe
1500	DllCommonsvc.exe
1500	DllCommonsvc.exe
1500	DllCommonsvc.exe
1500	DllCommonsvc.exe
1500	DllCommonsvc.exe
1500	DllCommonsvc.exe
1500	DllCommonsvc.exe
700	powershell.exe
588	powershell.exe
2536	powershell.exe
888	powershell.exe
2228	powershell.exe
536	powershell.exe
1656	powershell.exe
712	powershell.exe
2148	powershell.exe
2504	powershell.exe
592	powershell.exe
496	powershell.exe
1060	powershell.exe
904	powershell.exe
1328	powershell.exe
784	lsass.exe
892	lsass.exe
2208	lsass.exe
1268	lsass.exe
2988	lsass.exe
2044	lsass.exe
1680	lsass.exe
2676	lsass.exe
2436	lsass.exe
1620	lsass.exe
1760	lsass.exe

Suspicious use of AdjustPrivilegeToken 27 IoCs

description	pid	Process
Token: SeDebugPrivilege	1500	DllCommonsvc.exe
Token: SeDebugPrivilege	700	powershell.exe
Token: SeDebugPrivilege	588	powershell.exe
Token: SeDebugPrivilege	2536	powershell.exe
Token: SeDebugPrivilege	888	powershell.exe
Token: SeDebugPrivilege	784	lsass.exe
Token: SeDebugPrivilege	2228	powershell.exe
Token: SeDebugPrivilege	536	powershell.exe
Token: SeDebugPrivilege	1656	powershell.exe
Token: SeDebugPrivilege	712	powershell.exe
Token: SeDebugPrivilege	2148	powershell.exe
Token: SeDebugPrivilege	2504	powershell.exe
Token: SeDebugPrivilege	592	powershell.exe
Token: SeDebugPrivilege	496	powershell.exe
Token: SeDebugPrivilege	1060	powershell.exe
Token: SeDebugPrivilege	904	powershell.exe
Token: SeDebugPrivilege	1328	powershell.exe
Token: SeDebugPrivilege	892	lsass.exe
Token: SeDebugPrivilege	2208	lsass.exe
Token: SeDebugPrivilege	1268	lsass.exe
Token: SeDebugPrivilege	2988	lsass.exe
Token: SeDebugPrivilege	2044	lsass.exe
Token: SeDebugPrivilege	1680	lsass.exe
Token: SeDebugPrivilege	2676	lsass.exe
Token: SeDebugPrivilege	2436	lsass.exe
Token: SeDebugPrivilege	1620	lsass.exe
Token: SeDebugPrivilege	1760	lsass.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2272 wrote to memory of 444	2272	JaffaCakes118_346b17c3b64930e9ec6509fd38bdb30c24c4e04761a57e9fd0eefe13addce0af.exe	30
PID 2272 wrote to memory of 444	2272	JaffaCakes118_346b17c3b64930e9ec6509fd38bdb30c24c4e04761a57e9fd0eefe13addce0af.exe	30
PID 2272 wrote to memory of 444	2272	JaffaCakes118_346b17c3b64930e9ec6509fd38bdb30c24c4e04761a57e9fd0eefe13addce0af.exe	30
PID 2272 wrote to memory of 444	2272	JaffaCakes118_346b17c3b64930e9ec6509fd38bdb30c24c4e04761a57e9fd0eefe13addce0af.exe	30
PID 444 wrote to memory of 1708	444	WScript.exe	31
PID 444 wrote to memory of 1708	444	WScript.exe	31
PID 444 wrote to memory of 1708	444	WScript.exe	31
PID 444 wrote to memory of 1708	444	WScript.exe	31
PID 1708 wrote to memory of 1500	1708	cmd.exe	33
PID 1708 wrote to memory of 1500	1708	cmd.exe	33
PID 1708 wrote to memory of 1500	1708	cmd.exe	33
PID 1708 wrote to memory of 1500	1708	cmd.exe	33
PID 1500 wrote to memory of 588	1500	DllCommonsvc.exe	77
PID 1500 wrote to memory of 588	1500	DllCommonsvc.exe	77
PID 1500 wrote to memory of 588	1500	DllCommonsvc.exe	77
PID 1500 wrote to memory of 2536	1500	DllCommonsvc.exe	78
PID 1500 wrote to memory of 2536	1500	DllCommonsvc.exe	78
PID 1500 wrote to memory of 2536	1500	DllCommonsvc.exe	78
PID 1500 wrote to memory of 1060	1500	DllCommonsvc.exe	79
PID 1500 wrote to memory of 1060	1500	DllCommonsvc.exe	79
PID 1500 wrote to memory of 1060	1500	DllCommonsvc.exe	79
PID 1500 wrote to memory of 592	1500	DllCommonsvc.exe	80
PID 1500 wrote to memory of 592	1500	DllCommonsvc.exe	80
PID 1500 wrote to memory of 592	1500	DllCommonsvc.exe	80
PID 1500 wrote to memory of 496	1500	DllCommonsvc.exe	81
PID 1500 wrote to memory of 496	1500	DllCommonsvc.exe	81
PID 1500 wrote to memory of 496	1500	DllCommonsvc.exe	81
PID 1500 wrote to memory of 2228	1500	DllCommonsvc.exe	82
PID 1500 wrote to memory of 2228	1500	DllCommonsvc.exe	82
PID 1500 wrote to memory of 2228	1500	DllCommonsvc.exe	82
PID 1500 wrote to memory of 1656	1500	DllCommonsvc.exe	83
PID 1500 wrote to memory of 1656	1500	DllCommonsvc.exe	83
PID 1500 wrote to memory of 1656	1500	DllCommonsvc.exe	83
PID 1500 wrote to memory of 536	1500	DllCommonsvc.exe	84
PID 1500 wrote to memory of 536	1500	DllCommonsvc.exe	84
PID 1500 wrote to memory of 536	1500	DllCommonsvc.exe	84
PID 1500 wrote to memory of 700	1500	DllCommonsvc.exe	85
PID 1500 wrote to memory of 700	1500	DllCommonsvc.exe	85
PID 1500 wrote to memory of 700	1500	DllCommonsvc.exe	85
PID 1500 wrote to memory of 712	1500	DllCommonsvc.exe	86
PID 1500 wrote to memory of 712	1500	DllCommonsvc.exe	86
PID 1500 wrote to memory of 712	1500	DllCommonsvc.exe	86
PID 1500 wrote to memory of 2148	1500	DllCommonsvc.exe	87
PID 1500 wrote to memory of 2148	1500	DllCommonsvc.exe	87
PID 1500 wrote to memory of 2148	1500	DllCommonsvc.exe	87
PID 1500 wrote to memory of 2504	1500	DllCommonsvc.exe	88
PID 1500 wrote to memory of 2504	1500	DllCommonsvc.exe	88
PID 1500 wrote to memory of 2504	1500	DllCommonsvc.exe	88
PID 1500 wrote to memory of 1328	1500	DllCommonsvc.exe	89
PID 1500 wrote to memory of 1328	1500	DllCommonsvc.exe	89
PID 1500 wrote to memory of 1328	1500	DllCommonsvc.exe	89
PID 1500 wrote to memory of 904	1500	DllCommonsvc.exe	90
PID 1500 wrote to memory of 904	1500	DllCommonsvc.exe	90
PID 1500 wrote to memory of 904	1500	DllCommonsvc.exe	90
PID 1500 wrote to memory of 888	1500	DllCommonsvc.exe	91
PID 1500 wrote to memory of 888	1500	DllCommonsvc.exe	91
PID 1500 wrote to memory of 888	1500	DllCommonsvc.exe	91
PID 1500 wrote to memory of 784	1500	DllCommonsvc.exe	107
PID 1500 wrote to memory of 784	1500	DllCommonsvc.exe	107
PID 1500 wrote to memory of 784	1500	DllCommonsvc.exe	107
PID 784 wrote to memory of 2932	784	lsass.exe	108
PID 784 wrote to memory of 2932	784	lsass.exe	108
PID 784 wrote to memory of 2932	784	lsass.exe	108
PID 2932 wrote to memory of 2760	2932	cmd.exe	110

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_346b17c3b64930e9ec6509fd38bdb30c24c4e04761a57e9fd0eefe13addce0af.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_346b17c3b64930e9ec6509fd38bdb30c24c4e04761a57e9fd0eefe13addce0af.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2272
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:444
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1708
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1500
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:588
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Journal\services.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2536
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\OSPPSVC.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1060
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\lsass.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:592
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Defender\it-IT\System.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:496
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\taskhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2228
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1656
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\AppPatch\es-ES\Idle.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:536
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\lsass.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:700
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\cmd.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:712
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\lsass.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2148
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\LiveKernelReports\services.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2504
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\VideoLAN\VLC\lua\playlist\conhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1328
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\taskhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:904
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Local Settings\spoolsv.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:888
    - - C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\lsass.exe
        
        "C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\lsass.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:784
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\oqEnL4f5pl.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2932
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:2760
        
        C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\lsass.exe
        
        "C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\lsass.exe"
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:892
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\D9KWG0zl28.bat"
        8⤵
        
        PID:2808
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:2020
        
        C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\lsass.exe
        
        "C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\lsass.exe"
        9⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2208
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\be8zRZs4e0.bat"
        10⤵
        
        PID:2952
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:1012
        
        C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\lsass.exe
        
        "C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\lsass.exe"
        11⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1268
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\34gW2xHJWZ.bat"
        12⤵
        
        PID:2344
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:1456
        
        C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\lsass.exe
        
        "C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\lsass.exe"
        13⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2988
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ww4YVzclJm.bat"
        14⤵
        
        PID:1748
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        15⤵
        
        PID:2016
        
        C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\lsass.exe
        
        "C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\lsass.exe"
        15⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2044
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\FgAoPiAcVL.bat"
        16⤵
        
        PID:904
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        17⤵
        
        PID:1740
        
        C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\lsass.exe
        
        "C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\lsass.exe"
        17⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1680
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\BAdWWGXi7E.bat"
        18⤵
        
        PID:2404
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        19⤵
        
        PID:2868
        
        C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\lsass.exe
        
        "C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\lsass.exe"
        19⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2676
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\rE1HJofSUb.bat"
        20⤵
        
        PID:2024
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        21⤵
        
        PID:2536
        
        C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\lsass.exe
        
        "C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\lsass.exe"
        21⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2436
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\GN7B3lpeta.bat"
        22⤵
        
        PID:1944
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        23⤵
        
        PID:712
        
        C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\lsass.exe
        
        "C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\lsass.exe"
        23⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1620
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\hJP5Gj8VmP.bat"
        24⤵
        
        PID:1840
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        25⤵
        
        PID:2456
        
        C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\lsass.exe
        
        "C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\lsass.exe"
        25⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1760
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\mylROGge0S.bat"
        26⤵
        
        PID:3052
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        27⤵
        
        PID:1068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Journal\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files\Windows Journal\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Journal\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 11 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\OSPPSVC.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 7 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2788

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Defender\it-IT\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2072

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\it-IT\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Defender\it-IT\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 10 /tr "'C:\Users\Default User\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2196

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Users\Default User\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2280

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 11 /tr "'C:\Users\Default User\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2424

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2232

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 7 /tr "'C:\Windows\AppPatch\es-ES\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Windows\AppPatch\es-ES\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\Windows\AppPatch\es-ES\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'C:\Users\Default User\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Users\Default User\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'C:\Users\Default User\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Users\Default User\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 11 /tr "'C:\Users\Default User\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\providercommon\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2124

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\providercommon\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\providercommon\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 9 /tr "'C:\Windows\LiveKernelReports\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Windows\LiveKernelReports\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 12 /tr "'C:\Windows\LiveKernelReports\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 10 /tr "'C:\Program Files\VideoLAN\VLC\lua\playlist\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\VLC\lua\playlist\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 10 /tr "'C:\Program Files\VideoLAN\VLC\lua\playlist\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 11 /tr "'C:\Users\Default\Local Settings\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Users\Default\Local Settings\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 12 /tr "'C:\Users\Default\Local Settings\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
17543df129db0241eabea5a6d26f3c4d

SHA1
d7ab9a5d0dbe5ea6ab9cde85bab6da47d05f8347

SHA256
f45b8bf121dffa2f1f96bd994fa93efc4ee8dfb4667aa7ce1065145c0a537b57

SHA512
2e13b9cf1fe4994fde8aa15ce0e2bcc9e594e7fd4b16aec57ac4e73b5daa256bdc6bb2005215c84a44ed2ff641a1aaaa8886ba5dd33ae38adffcaa26c74d16db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b4acf99bd49a62ad655b4c14ba9c637e

SHA1
55e4a006f3153db94e5e1697cb9e1e69af5068b2

SHA256
066cac463e8dfb57c856fd9630de74de0f88a4f88afefeab2df7a0b50b1873cf

SHA512
6a34d9b7e630db53b40e38b3248a2b6a60ef6e00552ea47140f461c9199f5f050f96419a935266616db05823fa7e0b0cf26dfbd2fe0d19d3717c1aedefe8b9e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
48e79c4768c7f5f375bd94be8c3b74bd

SHA1
90c62715ea3a0c11d0624530493ad4dc40818132

SHA256
fde3cd1730cc675beb8bd1107bd0dcf831f42e5a77b304b3d4ada2037560d6d8

SHA512
842b3f05139bc583ca291af6e4d4ec4b3cad7d10934708bd5ee74c1eff6c869283e25093ad3ba461f410350165b292866dcc161c748102388655099bc945bff7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
88db11f65e63c1e2a50c61f8ee4ffaaf

SHA1
05c8cf12599cd2e404ad13023a040a8b8b51f92c

SHA256
fa22cbb94edd4702f8b43fd3209147ce14dc9bd33440586087cb85cb2567c72e

SHA512
f274abe883d2e537e0919a065419d8297e44dc621df673b4b913146c4eaa7434fe102b3efd8a113f7d4195decfbc2084c9e16333a52078542f774fb30f46f0c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1f841902c3b47d4fe56e5e8587fc39a6

SHA1
79e6bb046e0555f4fcbb47e555e200a024e5d5b1

SHA256
d9e3958d48b880ad5592b810e2550886ecf182ef6a0ed328728115c1440825bd

SHA512
8057e5e110d73e8415d8f8cfd1bb7463b0481e9ff08f598fba3566b44b766724080073270bf7f10167d2d3203ea6f6634440c61552baa33982650ac55b662c5f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
29d2b8118439e5a0352b144cd1498050

SHA1
d21b7597aab85e1fba5a8d46c80402ab3677c4f0

SHA256
a3ddb20bf5f0d9eef1a39c095b54835e2c610ff39be79be8b66b16edbf402266

SHA512
ddbd8876b292f08423fec847b1fe30046c922456e226ca54c1904ae503b8201e328800d8d2a841a31805d202a9c9d8e563e3a7b38a76298f80e28322a421e0fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
12047c7917b58c995cefdaacd5bcb307

SHA1
34e57bd1fcaa8894342416fb87479617635048ee

SHA256
238c8c6627d751e50035575bafabf1d87c279734696d4fabf49c93a3ba7f46ff

SHA512
1221d21a17515f778ed4b53b6f4744eb22a2ea4081e688134666b7ed7c5e759338ca826ae7295c0a4f8d890e552c6b1451961ff25aa628fe3d4c234c147510b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
669006014c31bbe825c54de3704afc73

SHA1
0c949394e9ccb6c7ce099f16d1e8e8afce1ece83

SHA256
638bdc934f1bf63c2c5a4bee6c81850e8c58cce448ca64da4efe09cbbfc63bd9

SHA512
70e7d93d780a958f99bd6c10ac1b13a97c6788bf39f074290478cf3d4eb3c2f525429c14892b17cce013b71a31ea6439e56796380a1ffe4bab9478edbbfbd4ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2789d7df7d8456207b95a4ae7b1af980

SHA1
49a44df72d270eb1e25f1a4b785054bda4ee8d46

SHA256
dd6bc670131a0564d86811a95b4bd59fe91ea7ccde8326165acf1b4c94bc97a6

SHA512
b7a14c07ff31dccf702a2d52ebcd28b5cd68e92f869ba7c7d040abba9bd1524631de5e9ef9bbcb82be29d8ffcdd6004079dd2f51972c53fd699760bd1daf34b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9fecc2b319e5d7109ba5810b4fae0772

SHA1
90618753d737dd77434fbef788630ffe207bf29d

SHA256
24b16dc217f91041cf0acec18a7ba3fed4b3f80a195eddeec6b18b3c70deaaac

SHA512
35318cd2c3b1cf90636193b45ef5b12ce947322edfc40c6e39daa878f6616b14ad6167df2e197da6bd2ed213cd9447fddfcd898534669fa55a54d08b2ba3f27d

Download Submit
C:\Users\Admin\AppData\Local\Temp\34gW2xHJWZ.bat

Filesize
237B

MD5
1a51dda5bb156b5272e85aa520a794a6

SHA1
b876b881ffb05e19c6b3449f19bf2e47924c1bbf

SHA256
a6a2daf203452587894bb36180ae2a4bdef2d8c9a2699a66bb226c9d80f0d273

SHA512
7aae416a59e31ecdde78c24bdb533aa4d518d599daeb479a288292b3bcc29480459e917e87a67dd16ac6637acf0c05c8d4edf28197f287efe7803d0cfc301936

Download Submit
C:\Users\Admin\AppData\Local\Temp\BAdWWGXi7E.bat

Filesize
237B

MD5
e85d8ad9f7712ccfe989e52139aa524b

SHA1
ee4f10ff5657ad50977f4ac5a43b7bf25bed7e2b

SHA256
5078729cdb16fd76cda87d0d84b3d311e2dd5c0a4563091b80fe773d99fa7fed

SHA512
eb329e713e9c406c66b4f8d50d23d55b536f564d9c2524d1f4be9e84b85782302e96d73e930b20895bae0f2f4e1482369634563df09a790d002f84d82770cd0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab450E.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\D9KWG0zl28.bat

Filesize
237B

MD5
6e75970a773548f85450b2a5bc0e7cec

SHA1
a47ac2d13ffa4b950657f432f7bbd2ceb1bd81dd

SHA256
de66c044bd3ffbcfd283daa4c77442d94ce9704c4a66e452c499065e392f8ab8

SHA512
e5f9699f689cf56f1ac5559223fc72c93444159ec9ea361264159be867a139b1548ac1690ed1da723646f6dd0f1295637cc0fccabf502bdaa8bb54023fce4dc5

Download Submit
C:\Users\Admin\AppData\Local\Temp\FgAoPiAcVL.bat

Filesize
237B

MD5
0a8fa932cf53334c0cce7f1ddab22f20

SHA1
c32e9839e64c80b19fa70f6d93d1e6f18764e3b7

SHA256
ef0c58faaee2188cc02766685c9e2a4323af1913a212c93779333cbc441b9673

SHA512
5d6fedb438b1656fa68ba854a698e50f2a010c2042d18be5e7c04834f265ef87cf6c17269e5fe20fd180af5e5019386fc079f1f5f78babdd29043db802ae70db

Download Submit
C:\Users\Admin\AppData\Local\Temp\GN7B3lpeta.bat

Filesize
237B

MD5
b9b1f105885243e9ff02adb576db6859

SHA1
09a38d10c7f18d4312f389a622a3e576e18572c6

SHA256
acb969b6edbf71763bd27fa5550b264de85b6f57edd4f3984a6e673b78b7a7ae

SHA512
bbeecda5059a648a9197eb1ebc2e82e32a608daf6f2aab383d603e19e140e03dc5b837fa5aa9f197845ed1bf2fa0ec3bbeb7764993e8ba50fe5b1c665e717f45

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar457E.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\be8zRZs4e0.bat

Filesize
237B

MD5
da9097942eeb438a3a840638799bc0bc

SHA1
f613837661ecc47cfded353dcdde3d54ecd62336

SHA256
728fe98e4dcecc2ca0ee84e35b9d0927170cab0b00b694d121d58300108a8599

SHA512
c02d5563092926c735982c8426c1a6ac03e01d50aa9ba4d0fe0d5a0cffd0e3e6d5e36236baf06473a8c7055696fdd986370500f203f334333435fca2ed5e0266

Download Submit
C:\Users\Admin\AppData\Local\Temp\hJP5Gj8VmP.bat

Filesize
237B

MD5
ae3dc7bf54279bd2daa1359d32d732a1

SHA1
fbf91b7eb3e69ec337d068dc3c996a305a3e8e03

SHA256
1fc168f052e2b282988cefa72244f109553caf6b32efcd49acdd1707f2aeaa06

SHA512
8932ba498cfd3475a25209d511e65c78fcaa039c15a282822ac32b066c8cdf24c8fc364060073aa4e7d23f6b20202b50b66d62010d7c4923e834bd247d797725

Download Submit
C:\Users\Admin\AppData\Local\Temp\mylROGge0S.bat

Filesize
237B

MD5
8d5b002b0335e095c833432bd876bfac

SHA1
ee4f6ccef3e037914c67b20fb696040fe23bf2dd

SHA256
971bfd5dc44f0d173be3de2a7395e2227ed215a04a1823e33805adfdf7c06e76

SHA512
28787ab256c0d51c8f64c8e0fa083f15d424933d8148708d717a4679c577b5a78448faa4a62529674c50802cd429741e671ffbe1c937d41ac93a431174441b0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\oqEnL4f5pl.bat

Filesize
237B

MD5
42a96dbdd49d966b0ac239dcd4ac8554

SHA1
3ca3c266c834a3ec19e5d3cb8169df7add38b739

SHA256
9862916dcaa3f89951108df35e4e7edb055f2276b9307736faefef5d2ab51991

SHA512
fe046516a4b8005785fdc407d4697f3b4a25c80c3afbe6cc5221c2c55bd67441ac5fff1ea0324daaa21fca18954f68405c9aec482e5018f70f3a076d0791c490

Download Submit
C:\Users\Admin\AppData\Local\Temp\rE1HJofSUb.bat

Filesize
237B

MD5
fb7ce62cd224352c3bea4f5e8ce51a36

SHA1
cb26a0d4e9d5a0e3f6688b8b9a5bd63c55a29d8c

SHA256
09f5f17b8d6b9ff90852245526fe3caf4b134d570ec0aa86796cc86e48dfda9e

SHA512
04d27275f8a9b0d98a04c0622071aee23978af75cf48d68d64a42f87e27ba4b7b5b78273375614b18ecf716cd5d33832b1e708a0dccb642685e0ed4cc6695f1b

Download Submit
C:\Users\Admin\AppData\Local\Temp\ww4YVzclJm.bat

Filesize
237B

MD5
f19fa4e4b8308e6aa679d6ab878df1d4

SHA1
b58e9ef35dd049563658004bb5f895c45c62cfab

SHA256
25127a5ba0c1c6b34ee304a5d5e14c35d70bf64fac8c2a4c04179267c64245e8

SHA512
6a1030751dfb23d8e2c2593413012cc1541ce838d89b1f98619d82bfd3518c3de28fcbc06d2faf95ca62f475e229d57b6388023510355dc8b0bb13d9a889a225

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\J8Y4WKTFPO5NKDHTJ597.temp

Filesize
7KB

MD5
10348ef473d295a264ed3abe129af3f6

SHA1
dc3538a5c19c8948c9b54901d021225ba8dda992

SHA256
cff2878cc2a32552dba9d2d5dbde90a43c2434c2c174642c48e9fabc360450be

SHA512
d7b173190f8c28c4c8b64f22c595de9712f7e6dd426785dd7a25e956b74d2c00cdb2fc2f61b692e7dcf3f4cb89b7e505ef3b30291b0a7faf69a410bbf9611fde

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/700-64-0x0000000001DE0000-0x0000000001DE8000-memory.dmp

Filesize
32KB

Download
memory/700-62-0x000000001B600000-0x000000001B8E2000-memory.dmp

Filesize
2.9MB

Download
memory/784-52-0x00000000000B0000-0x00000000001C0000-memory.dmp

Filesize
1.1MB

Download
memory/784-124-0x00000000002D0000-0x00000000002E2000-memory.dmp

Filesize
72KB

Download
memory/892-188-0x0000000000CE0000-0x0000000000DF0000-memory.dmp

Filesize
1.1MB

Download
memory/1268-308-0x0000000000B90000-0x0000000000CA0000-memory.dmp

Filesize
1.1MB

Download
memory/1500-16-0x00000000009F0000-0x00000000009FC000-memory.dmp

Filesize
48KB

Download
memory/1500-15-0x0000000000530000-0x000000000053C000-memory.dmp

Filesize
48KB

Download
memory/1500-17-0x0000000000A00000-0x0000000000A0C000-memory.dmp

Filesize
48KB

Download
memory/1500-13-0x0000000000A60000-0x0000000000B70000-memory.dmp

Filesize
1.1MB

Download
memory/1500-14-0x00000000003C0000-0x00000000003D2000-memory.dmp

Filesize
72KB

Download
memory/1620-671-0x00000000009F0000-0x0000000000B00000-memory.dmp

Filesize
1.1MB

Download
memory/1680-491-0x0000000000240000-0x0000000000252000-memory.dmp

Filesize
72KB

Download
memory/1680-490-0x0000000001040000-0x0000000001150000-memory.dmp

Filesize
1.1MB

Download
memory/1760-731-0x00000000000D0000-0x00000000001E0000-memory.dmp

Filesize
1.1MB

Download
memory/2044-430-0x0000000000260000-0x0000000000272000-memory.dmp

Filesize
72KB

Download
memory/2044-429-0x0000000000270000-0x0000000000380000-memory.dmp

Filesize
1.1MB

Download
memory/2208-248-0x0000000000080000-0x0000000000190000-memory.dmp

Filesize
1.1MB

Download
memory/2436-611-0x0000000000830000-0x0000000000940000-memory.dmp

Filesize
1.1MB

Download
memory/2676-551-0x0000000000320000-0x0000000000430000-memory.dmp

Filesize
1.1MB

Download
memory/2988-369-0x0000000000180000-0x0000000000192000-memory.dmp

Filesize
72KB

Download
memory/2988-368-0x0000000000230000-0x0000000000340000-memory.dmp

Filesize
1.1MB

Download