dcrat | aac02c9dfadc6ed9f7431ead74d36c60110a0b24de36865406d772023c8c4fe1

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2024 12:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_aac02c9dfadc6ed9f7431ead74d36c60110a0b24de36865406d772023c8c4fe1.exe
Size

1.3MB
MD5

12f338e54a19a37dfcf60b9271e8dcb1
SHA1

b9e07ec838ed1b1454cdcf2f0493ce3a7a633085
SHA256

aac02c9dfadc6ed9f7431ead74d36c60110a0b24de36865406d772023c8c4fe1
SHA512

969c43e5ef4e073f0ffc07524bfc292ab1a36ee012d0df92c89867d50be0c51234299470f86adc1687267728e0f6c579c1228523d23b2b192c746db460aab4ab
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 30 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4296	3916	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4996	3916	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3668	3916	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	872	3916	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3804	3916	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4960	3916	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3088	3916	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1844	3916	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3488	3916	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	748	3916	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1960	3916	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	900	3916	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3596	3916	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	556	3916	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1708	3916	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1664	3916	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5024	3916	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2436	3916	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4436	3916	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5068	3916	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2440	3916	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4552	3916	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1432	3916	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3832	3916	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1480	3916	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4544	3916	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2608	3916	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	640	3916	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1644	3916	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2320	3916	schtasks.exe	86

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x000a000000023b81-9.dat	dcrat
behavioral2/memory/2184-13-0x00000000007F0000-0x0000000000900000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1676	powershell.exe
784	powershell.exe
4932	powershell.exe
3084	powershell.exe
3688	powershell.exe
2548	powershell.exe
2224	powershell.exe
3732	powershell.exe
4712	powershell.exe
1532	powershell.exe
4796	powershell.exe
4852	powershell.exe

Checks computer location settings 2 TTPs 16 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	JaffaCakes118_aac02c9dfadc6ed9f7431ead74d36c60110a0b24de36865406d772023c8c4fe1.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe

Executes dropped EXE 14 IoCs

pid	Process
2184	DllCommonsvc.exe
2032	DllCommonsvc.exe
4560	fontdrvhost.exe
2520	fontdrvhost.exe
1220	fontdrvhost.exe
920	fontdrvhost.exe
4980	fontdrvhost.exe
4412	fontdrvhost.exe
2144	fontdrvhost.exe
3012	fontdrvhost.exe
2480	fontdrvhost.exe
4380	fontdrvhost.exe
4868	fontdrvhost.exe
748	fontdrvhost.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 13 IoCs

Web Service

T1102

flow	ioc
40	raw.githubusercontent.com
42	raw.githubusercontent.com
48	raw.githubusercontent.com
51	raw.githubusercontent.com
49	raw.githubusercontent.com
19	raw.githubusercontent.com
20	raw.githubusercontent.com
22	raw.githubusercontent.com
36	raw.githubusercontent.com
37	raw.githubusercontent.com
41	raw.githubusercontent.com
47	raw.githubusercontent.com
50	raw.githubusercontent.com

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Internet Explorer\es-ES\wininit.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Internet Explorer\es-ES\56085415360792	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Portable Devices\fontdrvhost.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Portable Devices\5b884080fd4f94	DllCommonsvc.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\PrintDialog\pris\c5b4cb5e9653cc	DllCommonsvc.exe
File created	C:\Windows\PrintDialog\pris\services.exe	DllCommonsvc.exe
File opened for modification	C:\Windows\PrintDialog\pris\services.exe	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_aac02c9dfadc6ed9f7431ead74d36c60110a0b24de36865406d772023c8c4fe1.exe

Modifies registry class 14 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	JaffaCakes118_aac02c9dfadc6ed9f7431ead74d36c60110a0b24de36865406d772023c8c4fe1.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	fontdrvhost.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 30 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2608	schtasks.exe
4552	schtasks.exe
1960	schtasks.exe
1480	schtasks.exe
4996	schtasks.exe
900	schtasks.exe
3596	schtasks.exe
1432	schtasks.exe
3088	schtasks.exe
5024	schtasks.exe
3832	schtasks.exe
3804	schtasks.exe
872	schtasks.exe
4960	schtasks.exe
4436	schtasks.exe
4544	schtasks.exe
4296	schtasks.exe
1644	schtasks.exe
2320	schtasks.exe
3668	schtasks.exe
2436	schtasks.exe
3488	schtasks.exe
748	schtasks.exe
556	schtasks.exe
1708	schtasks.exe
1664	schtasks.exe
5068	schtasks.exe
2440	schtasks.exe
640	schtasks.exe
1844	schtasks.exe

Suspicious behavior: EnumeratesProcesses 47 IoCs

pid	Process
2184	DllCommonsvc.exe
3732	powershell.exe
4712	powershell.exe
1676	powershell.exe
784	powershell.exe
4712	powershell.exe
3732	powershell.exe
1676	powershell.exe
784	powershell.exe
2032	DllCommonsvc.exe
4796	powershell.exe
4796	powershell.exe
2548	powershell.exe
2548	powershell.exe
3688	powershell.exe
3688	powershell.exe
2224	powershell.exe
2224	powershell.exe
4932	powershell.exe
4932	powershell.exe
1532	powershell.exe
4932	powershell.exe
1532	powershell.exe
3084	powershell.exe
3084	powershell.exe
4852	powershell.exe
4852	powershell.exe
4796	powershell.exe
4560	fontdrvhost.exe
4560	fontdrvhost.exe
2548	powershell.exe
2224	powershell.exe
3688	powershell.exe
3084	powershell.exe
1532	powershell.exe
4852	powershell.exe
2520	fontdrvhost.exe
1220	fontdrvhost.exe
920	fontdrvhost.exe
4980	fontdrvhost.exe
4412	fontdrvhost.exe
2144	fontdrvhost.exe
3012	fontdrvhost.exe
2480	fontdrvhost.exe
4380	fontdrvhost.exe
4868	fontdrvhost.exe
748	fontdrvhost.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: SeDebugPrivilege	2184	DllCommonsvc.exe
Token: SeDebugPrivilege	3732	powershell.exe
Token: SeDebugPrivilege	4712	powershell.exe
Token: SeDebugPrivilege	1676	powershell.exe
Token: SeDebugPrivilege	784	powershell.exe
Token: SeDebugPrivilege	2032	DllCommonsvc.exe
Token: SeDebugPrivilege	4796	powershell.exe
Token: SeDebugPrivilege	2548	powershell.exe
Token: SeDebugPrivilege	4932	powershell.exe
Token: SeDebugPrivilege	3688	powershell.exe
Token: SeDebugPrivilege	2224	powershell.exe
Token: SeDebugPrivilege	3084	powershell.exe
Token: SeDebugPrivilege	1532	powershell.exe
Token: SeDebugPrivilege	4852	powershell.exe
Token: SeDebugPrivilege	4560	fontdrvhost.exe
Token: SeDebugPrivilege	2520	fontdrvhost.exe
Token: SeDebugPrivilege	1220	fontdrvhost.exe
Token: SeDebugPrivilege	920	fontdrvhost.exe
Token: SeDebugPrivilege	4980	fontdrvhost.exe
Token: SeDebugPrivilege	4412	fontdrvhost.exe
Token: SeDebugPrivilege	2144	fontdrvhost.exe
Token: SeDebugPrivilege	3012	fontdrvhost.exe
Token: SeDebugPrivilege	2480	fontdrvhost.exe
Token: SeDebugPrivilege	4380	fontdrvhost.exe
Token: SeDebugPrivilege	4868	fontdrvhost.exe
Token: SeDebugPrivilege	748	fontdrvhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 1152	2872	JaffaCakes118_aac02c9dfadc6ed9f7431ead74d36c60110a0b24de36865406d772023c8c4fe1.exe	82
PID 2872 wrote to memory of 1152	2872	JaffaCakes118_aac02c9dfadc6ed9f7431ead74d36c60110a0b24de36865406d772023c8c4fe1.exe	82
PID 2872 wrote to memory of 1152	2872	JaffaCakes118_aac02c9dfadc6ed9f7431ead74d36c60110a0b24de36865406d772023c8c4fe1.exe	82
PID 1152 wrote to memory of 3108	1152	WScript.exe	87
PID 1152 wrote to memory of 3108	1152	WScript.exe	87
PID 1152 wrote to memory of 3108	1152	WScript.exe	87
PID 3108 wrote to memory of 2184	3108	cmd.exe	89
PID 3108 wrote to memory of 2184	3108	cmd.exe	89
PID 2184 wrote to memory of 784	2184	DllCommonsvc.exe	99
PID 2184 wrote to memory of 784	2184	DllCommonsvc.exe	99
PID 2184 wrote to memory of 4712	2184	DllCommonsvc.exe	100
PID 2184 wrote to memory of 4712	2184	DllCommonsvc.exe	100
PID 2184 wrote to memory of 3732	2184	DllCommonsvc.exe	101
PID 2184 wrote to memory of 3732	2184	DllCommonsvc.exe	101
PID 2184 wrote to memory of 1676	2184	DllCommonsvc.exe	102
PID 2184 wrote to memory of 1676	2184	DllCommonsvc.exe	102
PID 2184 wrote to memory of 3960	2184	DllCommonsvc.exe	107
PID 2184 wrote to memory of 3960	2184	DllCommonsvc.exe	107
PID 3960 wrote to memory of 3268	3960	cmd.exe	109
PID 3960 wrote to memory of 3268	3960	cmd.exe	109
PID 3960 wrote to memory of 2032	3960	cmd.exe	113
PID 3960 wrote to memory of 2032	3960	cmd.exe	113
PID 2032 wrote to memory of 4932	2032	DllCommonsvc.exe	135
PID 2032 wrote to memory of 4932	2032	DllCommonsvc.exe	135
PID 2032 wrote to memory of 3084	2032	DllCommonsvc.exe	136
PID 2032 wrote to memory of 3084	2032	DllCommonsvc.exe	136
PID 2032 wrote to memory of 1532	2032	DllCommonsvc.exe	137
PID 2032 wrote to memory of 1532	2032	DllCommonsvc.exe	137
PID 2032 wrote to memory of 3688	2032	DllCommonsvc.exe	138
PID 2032 wrote to memory of 3688	2032	DllCommonsvc.exe	138
PID 2032 wrote to memory of 2548	2032	DllCommonsvc.exe	139
PID 2032 wrote to memory of 2548	2032	DllCommonsvc.exe	139
PID 2032 wrote to memory of 4796	2032	DllCommonsvc.exe	140
PID 2032 wrote to memory of 4796	2032	DllCommonsvc.exe	140
PID 2032 wrote to memory of 4852	2032	DllCommonsvc.exe	141
PID 2032 wrote to memory of 4852	2032	DllCommonsvc.exe	141
PID 2032 wrote to memory of 2224	2032	DllCommonsvc.exe	142
PID 2032 wrote to memory of 2224	2032	DllCommonsvc.exe	142
PID 2032 wrote to memory of 4560	2032	DllCommonsvc.exe	151
PID 2032 wrote to memory of 4560	2032	DllCommonsvc.exe	151
PID 4560 wrote to memory of 4728	4560	fontdrvhost.exe	152
PID 4560 wrote to memory of 4728	4560	fontdrvhost.exe	152
PID 4728 wrote to memory of 1372	4728	cmd.exe	154
PID 4728 wrote to memory of 1372	4728	cmd.exe	154
PID 4728 wrote to memory of 2520	4728	cmd.exe	155
PID 4728 wrote to memory of 2520	4728	cmd.exe	155
PID 2520 wrote to memory of 320	2520	fontdrvhost.exe	156
PID 2520 wrote to memory of 320	2520	fontdrvhost.exe	156
PID 320 wrote to memory of 2016	320	cmd.exe	158
PID 320 wrote to memory of 2016	320	cmd.exe	158
PID 320 wrote to memory of 1220	320	cmd.exe	161
PID 320 wrote to memory of 1220	320	cmd.exe	161
PID 1220 wrote to memory of 5080	1220	fontdrvhost.exe	162
PID 1220 wrote to memory of 5080	1220	fontdrvhost.exe	162
PID 5080 wrote to memory of 3504	5080	cmd.exe	164
PID 5080 wrote to memory of 3504	5080	cmd.exe	164
PID 5080 wrote to memory of 920	5080	cmd.exe	165
PID 5080 wrote to memory of 920	5080	cmd.exe	165
PID 920 wrote to memory of 5008	920	fontdrvhost.exe	166
PID 920 wrote to memory of 5008	920	fontdrvhost.exe	166
PID 5008 wrote to memory of 1232	5008	cmd.exe	168
PID 5008 wrote to memory of 1232	5008	cmd.exe	168
PID 5008 wrote to memory of 4980	5008	cmd.exe	169
PID 5008 wrote to memory of 4980	5008	cmd.exe	169

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_aac02c9dfadc6ed9f7431ead74d36c60110a0b24de36865406d772023c8c4fe1.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_aac02c9dfadc6ed9f7431ead74d36c60110a0b24de36865406d772023c8c4fe1.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1152
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3108
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2184
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:784
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\wininit.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4712
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\fontdrvhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3732
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\dwm.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1676
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\XypAbUx20n.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3960
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:3268
      - C:\providercommon\DllCommonsvc.exe
        
        "C:\providercommon\DllCommonsvc.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Program Files directory
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2032
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4932
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\PrintDialog\pris\services.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3084
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Internet Explorer\es-ES\wininit.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1532
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Cookies\RuntimeBroker.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3688
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\wininit.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2548
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Registry.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4796
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\spoolsv.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4852
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Portable Devices\fontdrvhost.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2224
        
        C:\Program Files (x86)\Windows Portable Devices\fontdrvhost.exe
        
        "C:\Program Files (x86)\Windows Portable Devices\fontdrvhost.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4560
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\5pDZQI1oOH.bat"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:4728
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:1372
        
        C:\Program Files (x86)\Windows Portable Devices\fontdrvhost.exe
        
        "C:\Program Files (x86)\Windows Portable Devices\fontdrvhost.exe"
        9⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2520
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\nGcIoKmMem.bat"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:320
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:2016
        
        C:\Program Files (x86)\Windows Portable Devices\fontdrvhost.exe
        
        "C:\Program Files (x86)\Windows Portable Devices\fontdrvhost.exe"
        11⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1220
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\HfroAScfQF.bat"
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:5080
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:3504
        
        C:\Program Files (x86)\Windows Portable Devices\fontdrvhost.exe
        
        "C:\Program Files (x86)\Windows Portable Devices\fontdrvhost.exe"
        13⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:920
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\eQ9EwglUAP.bat"
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:5008
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        15⤵
        
        PID:1232
        
        C:\Program Files (x86)\Windows Portable Devices\fontdrvhost.exe
        
        "C:\Program Files (x86)\Windows Portable Devices\fontdrvhost.exe"
        15⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4980
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\yvlYFj4oEg.bat"
        16⤵
        
        PID:4080
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        17⤵
        
        PID:4036
        
        C:\Program Files (x86)\Windows Portable Devices\fontdrvhost.exe
        
        "C:\Program Files (x86)\Windows Portable Devices\fontdrvhost.exe"
        17⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4412
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\MXvuXcjR4o.bat"
        18⤵
        
        PID:404
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        19⤵
        
        PID:2244
        
        C:\Program Files (x86)\Windows Portable Devices\fontdrvhost.exe
        
        "C:\Program Files (x86)\Windows Portable Devices\fontdrvhost.exe"
        19⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2144
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\UWW2tbEWSD.bat"
        20⤵
        
        PID:4544
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        21⤵
        
        PID:1652
        
        C:\Program Files (x86)\Windows Portable Devices\fontdrvhost.exe
        
        "C:\Program Files (x86)\Windows Portable Devices\fontdrvhost.exe"
        21⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3012
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\uuaNNDTqg5.bat"
        22⤵
        
        PID:60
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        23⤵
        
        PID:4688
        
        C:\Program Files (x86)\Windows Portable Devices\fontdrvhost.exe
        
        "C:\Program Files (x86)\Windows Portable Devices\fontdrvhost.exe"
        23⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2480
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\vFDRBKGR2C.bat"
        24⤵
        
        PID:1368
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        25⤵
        
        PID:1000
        
        C:\Program Files (x86)\Windows Portable Devices\fontdrvhost.exe
        
        "C:\Program Files (x86)\Windows Portable Devices\fontdrvhost.exe"
        25⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4380
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\QVLs15dYuc.bat"
        26⤵
        
        PID:2372
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        27⤵
        
        PID:4248
        
        C:\Program Files (x86)\Windows Portable Devices\fontdrvhost.exe
        
        "C:\Program Files (x86)\Windows Portable Devices\fontdrvhost.exe"
        27⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4868
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\FjqlTNZm6T.bat"
        28⤵
        
        PID:744
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        29⤵
        
        PID:1292
        
        C:\Program Files (x86)\Windows Portable Devices\fontdrvhost.exe
        
        "C:\Program Files (x86)\Windows Portable Devices\fontdrvhost.exe"
        29⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:748
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Lg3y2yDdyq.bat"
        30⤵
        
        PID:3936
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        31⤵
        
        PID:1360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 9 /tr "'C:\providercommon\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4296

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\providercommon\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\providercommon\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\providercommon\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\providercommon\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\providercommon\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 10 /tr "'C:\providercommon\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\providercommon\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 10 /tr "'C:\providercommon\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 12 /tr "'C:\Windows\PrintDialog\pris\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Windows\PrintDialog\pris\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\Windows\PrintDialog\pris\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Internet Explorer\es-ES\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\es-ES\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Internet Explorer\es-ES\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Users\Default\Cookies\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Default\Cookies\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Users\Default\Cookies\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Users\All Users\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2440

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 13 /tr "'C:\Users\Default\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Users\Default\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 8 /tr "'C:\Users\Default\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Users\Default User\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\Users\Default User\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Portable Devices\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Portable Devices\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\DllCommonsvc.exe.log

Filesize
1KB

MD5
7f3c0ae41f0d9ae10a8985a2c327b8fb

SHA1
d58622bf6b5071beacf3b35bb505bde2000983e3

SHA256
519fceae4d0dd4d09edd1b81bcdfa8aeab4b59eee77a4cd4b6295ce8e591a900

SHA512
8a8fd17eef071f86e672cba0d8fc2cfed6118aff816100b9d7c06eb96443c04c04bc5692259c8d7ecb1563e877921939c61726605af4f969e3f586f0913ed125

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\fontdrvhost.exe.log

Filesize
1KB

MD5
baf55b95da4a601229647f25dad12878

SHA1
abc16954ebfd213733c4493fc1910164d825cac8

SHA256
ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

SHA512
24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
12557b23d88ded7877cd1af4ddcad2ea

SHA1
05644a8b5685bf4381d5a1c31da7dfe52f7e24d6

SHA256
731aa08032ad54ae737a6c86dd75b4d778837dd29c0c7ac9c2e781c07e9418c5

SHA512
bf2526d5b67c98fc44f58acc25f7495e82a0b7fca90bd8ee27a908b43aa95bf8eabc74ddb594d9d1669fd4214d0ec2eed36517dd84b8193ae01eabbd1d1d81a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e58749a7a1826f6ea62df1e2ef63a32b

SHA1
c0bca21658b8be4f37b71eec9578bfefa44f862d

SHA256
0e1f0e684adb40a5d0668df5fed007c9046137d7ae16a1f2f343b139d5f9bc93

SHA512
4cf45b2b11ab31e7f67fff286b29d50ed28cd6043091144c5c0f1348b5f5916ed7479cf985595e6f096b586ab93b4b5dce612f688049b8366a2dd91863e98b70

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
a9a7f35c006bbf5da72f9cb250ffbddb

SHA1
458a8cedc38dac109631d9fccb3bf6d2c5c0e89e

SHA256
a1db56d56e35a6c95f98204e40f69f70422969681d408e5edc4afbf732eef86b

SHA512
d341773d30e09214567c65f24cd1854f1e438b8528aa30d35b6baac16e671dde1245edda654f19343b7c160da45985ab53f08453e7f6286e272d544f8741c131

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
60f7ba83c688c80b331e8b979ee3f29d

SHA1
0a7eb61e59c008ff19c4cf235badf7619150c25a

SHA256
859b1842a5ad947f7c2566cd5f12b9becc1e9f110588e99aa492c92064d4041f

SHA512
9a6f0aa453e22d8b46da1ee715a41227ac717cdf15598f6810e2fb6791660058e806a0221508b92bb2daca91e20c5ff60f4df1e9dd1f9086a2e9a1b94d345827

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
9a2c763c5ff40e18e49ad63c7c3b0088

SHA1
4b289ea34755323fa869da6ad6480d8d12385a36

SHA256
517807921c55bd16cd8a8bfae3d5dc19444c66f836b66acd5593e3080acbaf8e

SHA512
3af01926bc7de92076067d158d7250b206d396b3282ee0db43639d04d91bd9ff763acbce12c7822914824984a3c5fdd1b8dbf1ad2ee88233d47f0f808b746bc8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
cadef9abd087803c630df65264a6c81c

SHA1
babbf3636c347c8727c35f3eef2ee643dbcc4bd2

SHA256
cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

SHA512
7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

Download Submit
C:\Users\Admin\AppData\Local\Temp\5pDZQI1oOH.bat

Filesize
228B

MD5
f2bd89858e48fcdf38cae62a906cf834

SHA1
2a51b05945a872256b40698b2a543604a7c91f87

SHA256
a16b42a84e458ef4be3bedc40658159cd226adf531aa6023beb722303ed8388f

SHA512
904c1b76954a2802f0f9fedbbe2d89261e812aed40d7f71ae051023dce148f76584124916deef4305c4b8ee69194fb760f010a4a32259c43c6d1b04916b9559a

Download Submit
C:\Users\Admin\AppData\Local\Temp\FjqlTNZm6T.bat

Filesize
228B

MD5
82312796ee8ea2f5859fac58584e35d1

SHA1
3216100cb798fe1cc794508da9e4a3b1953b381e

SHA256
e13c7b25046aae8a323c0bb515ae8b919adee3b913c91d866df78421b280619d

SHA512
6f41f2b2a604c4554d1b5c0e27b0601807d16d8e049a7cbd344bc38748fa00fe957c5399626d544084434a5e9c5e06d10d42762575a7f01af48c2dfa07dd7a39

Download Submit
C:\Users\Admin\AppData\Local\Temp\HfroAScfQF.bat

Filesize
228B

MD5
0cf907d177e4b5076275c2f3f760577a

SHA1
5c52f2a333579bf112d36036df93d303190f0012

SHA256
3ca12fa48acfdfa0b76527b878608280323bac169d1e7cfc4fef55ac85a12ce2

SHA512
8695d2b2af67a460c806d25355b6c7e98f5de8d46e63ec59380878a937879b7208211a4272f349e6d05d038c2219db5de5b81b0097c9029c33a7cfcdc9d409aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Lg3y2yDdyq.bat

Filesize
228B

MD5
82c1021802cc20144a45a5befd4f4167

SHA1
7cabcebd896bf9c221a1ad20bbd13d4f44c131f7

SHA256
2dc855cc82d0138be20036149e6edbcfe7e112c20143ef0ac87d8e50cc1c3e90

SHA512
2174e043367c863db862d45de3c557e45911c5efcfe83799fda5fa7797fc63406760a605197544fec36a02605a1abb368c5b44f96cef7c3cb5997bc0e4b274a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\MXvuXcjR4o.bat

Filesize
228B

MD5
928946ff6048cd77ea344c8fd4c88299

SHA1
e7f30543cf941261345460fbecc44da065d67d66

SHA256
b91b88590e8939220e3efb154d042ae6b4192eec05efd1be5f6e4ed821935100

SHA512
b31534b7285ccdbce1b7ac89dd4f9e2e12d313cd20e8b339e57d5667823f9140b317ad4dea278bd521b4a82fe9191bca4f883f764650b0379dbc88c0e0f345f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\QVLs15dYuc.bat

Filesize
228B

MD5
f360a05e027a251a12ba4b7ac14e478c

SHA1
3a4a1cd20f4979c516d6055e4a739eab1896522c

SHA256
8c627be0ae10684648a854655118ecc19913e3c2ea80cbd371692863cfcc41c6

SHA512
2ffd5de28d60d9be31aa552542d55a0366886668222d2d7c976323626d6595a3210d84940390a621d2cc7619eba14cea09d8af3cc08b0e7d2466159887b57fe4

Download Submit
C:\Users\Admin\AppData\Local\Temp\UWW2tbEWSD.bat

Filesize
228B

MD5
ac88665275621e0ca925f645bf247ebe

SHA1
0625272f0edd91d0a6e8a547e62323cc5e3f0b8a

SHA256
7624627c6c49503fde7ec48c72c1170898b53eeab3dec355e4207cb1acd93f3f

SHA512
6602f354e1285c856782fdbb4945847210eba5b59c227695666d13f620cfa250edd489f954fc2de9a52b973704770457a05a4e9d21153eb6b176c031e5b6b5ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\XypAbUx20n.bat

Filesize
199B

MD5
140717c2ac8fc40b27ffe980a51395f2

SHA1
58ae4067d40188dd313378a57c5d28d5cfc0ecb8

SHA256
ce0db3d060e070a0fcbc34cc83e6e1d7ac78f97163839aaf7cf00062b6ce8126

SHA512
22daec2f918fbf75a9fbf0351d0381fa1e2fa881a0165e338150e05a1b29e75f9e1f0cc2e35fb4be70b2157f73c0321bca3c9f683fb549fb5650674a904be32f

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_el2xpvd4.fhp.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\eQ9EwglUAP.bat

Filesize
228B

MD5
bcccddec398db484991ee64a72cb4d07

SHA1
0bd33f88d94ee476b8b93b0f91690d4fbeae2119

SHA256
4d45c0206ee6720a5c81891bfbb314ac651aa0dbbd74e86e4bba98856fa7291e

SHA512
087f3a4d123079ca5b48649f95b24cc7951229903d06b39a6a439b24ec1c16dbec80bc240825d68412730ea955bf87fc8c2672d57c3f2259b61d75a09d3ee5ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\nGcIoKmMem.bat

Filesize
228B

MD5
4832cd65fa286de4bdf47e9d354c2ce4

SHA1
02365d360d0ad48ea5ce2e639a61a1d17f6da8b8

SHA256
fc7b8933b7f6b9a1f7424c25b848f689372a3fd85cc5d941c6fc66ca30000729

SHA512
f8b241500e87fa7e5a1bda41346c4a90c881bc2d654115c8c3274f1cb1f7c5bd247d17ead92714d072db81a0b3eb7955714f7288e66f049e26848cde4376f485

Download Submit
C:\Users\Admin\AppData\Local\Temp\uuaNNDTqg5.bat

Filesize
228B

MD5
be0d10d51c501e12724e004c676ceab2

SHA1
6bb5cd17478c6fab9a36d340c05a3da426a1be99

SHA256
d029f9a5d6932b4b7a321f0b1dc2f44ba50ba36b15e9006aa9003bf5264486e5

SHA512
35741f17084fbf638bb0666dbb01456896f9417da420a511d94599a986ca67185939e7e5e3d725ce0dd08722ac706ee6ecc73fe565a76ca254e7f6ecdc3686f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\vFDRBKGR2C.bat

Filesize
228B

MD5
6994f77653b05e58a2b9b86b7890e481

SHA1
4bc9bfe26ce8699b3eb4d5faecae0d7ed3ae0aa1

SHA256
a94d0c57a95f607c34572c91768f0d0774ebd32a8f8a70f57512703ec06551ac

SHA512
ba8958015ed2956c59897eedefc2512418db1e6239e38e541b9c099e2652a605ed24e37e0f7d435af69e9b3721d2a9ff504a530d549ce9ca56443254bf00f867

Download Submit
C:\Users\Admin\AppData\Local\Temp\yvlYFj4oEg.bat

Filesize
228B

MD5
d8bbb06e96917412036925001e9dc867

SHA1
37f28f49ae6d189d004b1c34a30656c1f5f707f2

SHA256
f8cfe9467a79f198bedfd5860742cf32f41f7f5d9be48637f050b06b391808b6

SHA512
709f6b2411f0984fe9744ced4a8eaf06176810851803c220fbdddc965faf0a4b48f4469e61bc0c4c3f1c2f8aa86a7256e009d77533ba89aa24e209c402737749

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/1220-203-0x0000000002B50000-0x0000000002B62000-memory.dmp

Filesize
72KB

Download
memory/2032-78-0x00000000011A0000-0x00000000011B2000-memory.dmp

Filesize
72KB

Download
memory/2184-16-0x0000000001160000-0x000000000116C000-memory.dmp

Filesize
48KB

Download
memory/2184-12-0x00007FFD55753000-0x00007FFD55755000-memory.dmp

Filesize
8KB

Download
memory/2184-13-0x00000000007F0000-0x0000000000900000-memory.dmp

Filesize
1.1MB

Download
memory/2184-14-0x00000000010B0000-0x00000000010C2000-memory.dmp

Filesize
72KB

Download
memory/2184-15-0x0000000001180000-0x000000000118C000-memory.dmp

Filesize
48KB

Download
memory/2184-17-0x0000000001190000-0x000000000119C000-memory.dmp

Filesize
48KB

Download
memory/3012-234-0x0000000001170000-0x0000000001182000-memory.dmp

Filesize
72KB

Download
memory/3732-33-0x000001C0B8E90000-0x000001C0B8EB2000-memory.dmp

Filesize
136KB

Download
memory/4868-253-0x0000000002620000-0x0000000002632000-memory.dmp

Filesize
72KB

Download