dcrat | d77d7121814bbdf950729fe1eac4c3f12e65c249e1efd7b2740fa65991ad2718

Analysis

max time kernel
145s
max time network
140s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22-12-2024 18:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_d77d7121814bbdf950729fe1eac4c3f12e65c249e1efd7b2740fa65991ad2718.exe
Size

1.3MB
MD5

d5c253ca85c40b10293b0a4fa138daa7
SHA1

c2ed364b0b896a2e899605d85d058965ea03658d
SHA256

d77d7121814bbdf950729fe1eac4c3f12e65c249e1efd7b2740fa65991ad2718
SHA512

7c14869fcb32a6ab0076a00c1fdc6eeacb7fed6741a3e38e25a760c3f36a14373865010a1d404b6d55e7371d769902bcea4eea2b691c75a6f3fd31243f3553a1
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 45 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1752	2620	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1552	2620	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2444	2620	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1296	2620	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	404	2620	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2504	2620	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	480	2620	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2960	2620	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2164	2620	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2088	2620	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2372	2620	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2872	2620	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2584	2620	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2324	2620	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1676	2620	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2616	2620	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1656	2620	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2096	2620	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1964	2620	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1300	2620	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	796	2620	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	596	2620	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1148	2620	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1772	2620	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2192	2620	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2980	2620	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2360	2620	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1744	2620	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1924	2620	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	676	2620	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2060	2620	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	904	2620	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1700	2620	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2064	2620	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	968	2620	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2392	2620	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1872	2620	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	340	2620	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2268	2620	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1868	2620	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1580	2620	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2308	2620	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2464	2620	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3056	2620	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	704	2620	schtasks.exe	34

DCRat payload 9 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0008000000016b86-12.dat	dcrat
behavioral1/memory/2296-13-0x0000000000940000-0x0000000000A50000-memory.dmp	dcrat
behavioral1/memory/2828-136-0x0000000000070000-0x0000000000180000-memory.dmp	dcrat
behavioral1/memory/2568-196-0x0000000000DF0000-0x0000000000F00000-memory.dmp	dcrat
behavioral1/memory/2712-374-0x00000000001F0000-0x0000000000300000-memory.dmp	dcrat
behavioral1/memory/872-435-0x0000000001260000-0x0000000001370000-memory.dmp	dcrat
behavioral1/memory/2260-554-0x00000000012A0000-0x00000000013B0000-memory.dmp	dcrat
behavioral1/memory/2904-614-0x0000000000360000-0x0000000000470000-memory.dmp	dcrat
behavioral1/memory/704-674-0x00000000011C0000-0x00000000012D0000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 16 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1808	powershell.exe
1420	powershell.exe
2992	powershell.exe
2688	powershell.exe
3052	powershell.exe
1816	powershell.exe
2468	powershell.exe
2696	powershell.exe
3004	powershell.exe
1820	powershell.exe
3060	powershell.exe
2788	powershell.exe
3068	powershell.exe
2272	powershell.exe
2988	powershell.exe
2456	powershell.exe

Executes dropped EXE 11 IoCs

pid	Process
2296	DllCommonsvc.exe
2828	winlogon.exe
2568	winlogon.exe
2880	winlogon.exe
2156	winlogon.exe
2712	winlogon.exe
872	winlogon.exe
592	winlogon.exe
2260	winlogon.exe
2904	winlogon.exe
704	winlogon.exe

Loads dropped DLL 2 IoCs

pid	Process
2664	cmd.exe
2664	cmd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 10 IoCs

Web Service

T1102

flow	ioc
5	raw.githubusercontent.com
12	raw.githubusercontent.com
16	raw.githubusercontent.com
26	raw.githubusercontent.com
29	raw.githubusercontent.com
32	raw.githubusercontent.com
4	raw.githubusercontent.com
9	raw.githubusercontent.com
19	raw.githubusercontent.com
22	raw.githubusercontent.com

Drops file in Program Files directory 13 IoCs

description	ioc	Process
File created	C:\Program Files\MSBuild\Microsoft\audiodg.exe	DllCommonsvc.exe
File created	C:\Program Files\MSBuild\Microsoft\42af1c969fbb7b	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft Office\27d1bcfc3c54e0	DllCommonsvc.exe
File created	C:\Program Files\Internet Explorer\en-US\886983d96e3d3e	DllCommonsvc.exe
File created	C:\Program Files\Internet Explorer\1610b97d3ab4a7	DllCommonsvc.exe
File created	C:\Program Files\Windows Photo Viewer\es-ES\winlogon.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Photo Viewer\es-ES\cc11b995f2a76d	DllCommonsvc.exe
File created	C:\Program Files\Internet Explorer\OSPPSVC.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft Office\System.exe	DllCommonsvc.exe
File created	C:\Program Files\Internet Explorer\en-US\csrss.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Journal\Templates\DllCommonsvc.exe	DllCommonsvc.exe
File opened for modification	C:\Program Files\Windows Journal\Templates\DllCommonsvc.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Journal\Templates\a76d7bf15d8370	DllCommonsvc.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\CSC\v2.0.6\dwm.exe	DllCommonsvc.exe
File created	C:\Windows\servicing\csrss.exe	DllCommonsvc.exe
File created	C:\Windows\security\logs\spoolsv.exe	DllCommonsvc.exe
File created	C:\Windows\security\logs\f3b6ecef712a24	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_d77d7121814bbdf950729fe1eac4c3f12e65c249e1efd7b2740fa65991ad2718.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 45 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2980	schtasks.exe
676	schtasks.exe
596	schtasks.exe
2584	schtasks.exe
1580	schtasks.exe
2464	schtasks.exe
704	schtasks.exe
2960	schtasks.exe
796	schtasks.exe
1148	schtasks.exe
1772	schtasks.exe
2192	schtasks.exe
2360	schtasks.exe
1924	schtasks.exe
1676	schtasks.exe
1744	schtasks.exe
2060	schtasks.exe
904	schtasks.exe
2392	schtasks.exe
1872	schtasks.exe
340	schtasks.exe
3056	schtasks.exe
2444	schtasks.exe
1552	schtasks.exe
2164	schtasks.exe
2088	schtasks.exe
1964	schtasks.exe
1700	schtasks.exe
968	schtasks.exe
2268	schtasks.exe
1752	schtasks.exe
1868	schtasks.exe
2324	schtasks.exe
2096	schtasks.exe
2064	schtasks.exe
2372	schtasks.exe
404	schtasks.exe
2504	schtasks.exe
480	schtasks.exe
2872	schtasks.exe
2616	schtasks.exe
1656	schtasks.exe
1300	schtasks.exe
1296	schtasks.exe
2308	schtasks.exe

Suspicious behavior: EnumeratesProcesses 33 IoCs

pid	Process
2296	DllCommonsvc.exe
2296	DllCommonsvc.exe
2296	DllCommonsvc.exe
2296	DllCommonsvc.exe
2296	DllCommonsvc.exe
2296	DllCommonsvc.exe
2296	DllCommonsvc.exe
1420	powershell.exe
3060	powershell.exe
1820	powershell.exe
2992	powershell.exe
2272	powershell.exe
3052	powershell.exe
2696	powershell.exe
3068	powershell.exe
1816	powershell.exe
1808	powershell.exe
2988	powershell.exe
2688	powershell.exe
3004	powershell.exe
2788	powershell.exe
2456	powershell.exe
2468	powershell.exe
2828	winlogon.exe
2568	winlogon.exe
2880	winlogon.exe
2156	winlogon.exe
2712	winlogon.exe
872	winlogon.exe
592	winlogon.exe
2260	winlogon.exe
2904	winlogon.exe
704	winlogon.exe

Suspicious use of AdjustPrivilegeToken 27 IoCs

description	pid	Process
Token: SeDebugPrivilege	2296	DllCommonsvc.exe
Token: SeDebugPrivilege	1420	powershell.exe
Token: SeDebugPrivilege	3060	powershell.exe
Token: SeDebugPrivilege	1820	powershell.exe
Token: SeDebugPrivilege	2992	powershell.exe
Token: SeDebugPrivilege	2272	powershell.exe
Token: SeDebugPrivilege	3052	powershell.exe
Token: SeDebugPrivilege	2696	powershell.exe
Token: SeDebugPrivilege	3068	powershell.exe
Token: SeDebugPrivilege	1816	powershell.exe
Token: SeDebugPrivilege	1808	powershell.exe
Token: SeDebugPrivilege	2988	powershell.exe
Token: SeDebugPrivilege	2688	powershell.exe
Token: SeDebugPrivilege	3004	powershell.exe
Token: SeDebugPrivilege	2788	powershell.exe
Token: SeDebugPrivilege	2456	powershell.exe
Token: SeDebugPrivilege	2468	powershell.exe
Token: SeDebugPrivilege	2828	winlogon.exe
Token: SeDebugPrivilege	2568	winlogon.exe
Token: SeDebugPrivilege	2880	winlogon.exe
Token: SeDebugPrivilege	2156	winlogon.exe
Token: SeDebugPrivilege	2712	winlogon.exe
Token: SeDebugPrivilege	872	winlogon.exe
Token: SeDebugPrivilege	592	winlogon.exe
Token: SeDebugPrivilege	2260	winlogon.exe
Token: SeDebugPrivilege	2904	winlogon.exe
Token: SeDebugPrivilege	704	winlogon.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2640 wrote to memory of 2820	2640	JaffaCakes118_d77d7121814bbdf950729fe1eac4c3f12e65c249e1efd7b2740fa65991ad2718.exe	30
PID 2640 wrote to memory of 2820	2640	JaffaCakes118_d77d7121814bbdf950729fe1eac4c3f12e65c249e1efd7b2740fa65991ad2718.exe	30
PID 2640 wrote to memory of 2820	2640	JaffaCakes118_d77d7121814bbdf950729fe1eac4c3f12e65c249e1efd7b2740fa65991ad2718.exe	30
PID 2640 wrote to memory of 2820	2640	JaffaCakes118_d77d7121814bbdf950729fe1eac4c3f12e65c249e1efd7b2740fa65991ad2718.exe	30
PID 2820 wrote to memory of 2664	2820	WScript.exe	31
PID 2820 wrote to memory of 2664	2820	WScript.exe	31
PID 2820 wrote to memory of 2664	2820	WScript.exe	31
PID 2820 wrote to memory of 2664	2820	WScript.exe	31
PID 2664 wrote to memory of 2296	2664	cmd.exe	33
PID 2664 wrote to memory of 2296	2664	cmd.exe	33
PID 2664 wrote to memory of 2296	2664	cmd.exe	33
PID 2664 wrote to memory of 2296	2664	cmd.exe	33
PID 2296 wrote to memory of 2272	2296	DllCommonsvc.exe	80
PID 2296 wrote to memory of 2272	2296	DllCommonsvc.exe	80
PID 2296 wrote to memory of 2272	2296	DllCommonsvc.exe	80
PID 2296 wrote to memory of 1808	2296	DllCommonsvc.exe	81
PID 2296 wrote to memory of 1808	2296	DllCommonsvc.exe	81
PID 2296 wrote to memory of 1808	2296	DllCommonsvc.exe	81
PID 2296 wrote to memory of 3004	2296	DllCommonsvc.exe	82
PID 2296 wrote to memory of 3004	2296	DllCommonsvc.exe	82
PID 2296 wrote to memory of 3004	2296	DllCommonsvc.exe	82
PID 2296 wrote to memory of 3052	2296	DllCommonsvc.exe	83
PID 2296 wrote to memory of 3052	2296	DllCommonsvc.exe	83
PID 2296 wrote to memory of 3052	2296	DllCommonsvc.exe	83
PID 2296 wrote to memory of 1820	2296	DllCommonsvc.exe	84
PID 2296 wrote to memory of 1820	2296	DllCommonsvc.exe	84
PID 2296 wrote to memory of 1820	2296	DllCommonsvc.exe	84
PID 2296 wrote to memory of 1816	2296	DllCommonsvc.exe	85
PID 2296 wrote to memory of 1816	2296	DllCommonsvc.exe	85
PID 2296 wrote to memory of 1816	2296	DllCommonsvc.exe	85
PID 2296 wrote to memory of 2468	2296	DllCommonsvc.exe	86
PID 2296 wrote to memory of 2468	2296	DllCommonsvc.exe	86
PID 2296 wrote to memory of 2468	2296	DllCommonsvc.exe	86
PID 2296 wrote to memory of 1420	2296	DllCommonsvc.exe	87
PID 2296 wrote to memory of 1420	2296	DllCommonsvc.exe	87
PID 2296 wrote to memory of 1420	2296	DllCommonsvc.exe	87
PID 2296 wrote to memory of 3060	2296	DllCommonsvc.exe	88
PID 2296 wrote to memory of 3060	2296	DllCommonsvc.exe	88
PID 2296 wrote to memory of 3060	2296	DllCommonsvc.exe	88
PID 2296 wrote to memory of 2988	2296	DllCommonsvc.exe	89
PID 2296 wrote to memory of 2988	2296	DllCommonsvc.exe	89
PID 2296 wrote to memory of 2988	2296	DllCommonsvc.exe	89
PID 2296 wrote to memory of 2456	2296	DllCommonsvc.exe	90
PID 2296 wrote to memory of 2456	2296	DllCommonsvc.exe	90
PID 2296 wrote to memory of 2456	2296	DllCommonsvc.exe	90
PID 2296 wrote to memory of 2992	2296	DllCommonsvc.exe	91
PID 2296 wrote to memory of 2992	2296	DllCommonsvc.exe	91
PID 2296 wrote to memory of 2992	2296	DllCommonsvc.exe	91
PID 2296 wrote to memory of 2696	2296	DllCommonsvc.exe	92
PID 2296 wrote to memory of 2696	2296	DllCommonsvc.exe	92
PID 2296 wrote to memory of 2696	2296	DllCommonsvc.exe	92
PID 2296 wrote to memory of 2688	2296	DllCommonsvc.exe	93
PID 2296 wrote to memory of 2688	2296	DllCommonsvc.exe	93
PID 2296 wrote to memory of 2688	2296	DllCommonsvc.exe	93
PID 2296 wrote to memory of 2788	2296	DllCommonsvc.exe	94
PID 2296 wrote to memory of 2788	2296	DllCommonsvc.exe	94
PID 2296 wrote to memory of 2788	2296	DllCommonsvc.exe	94
PID 2296 wrote to memory of 3068	2296	DllCommonsvc.exe	95
PID 2296 wrote to memory of 3068	2296	DllCommonsvc.exe	95
PID 2296 wrote to memory of 3068	2296	DllCommonsvc.exe	95
PID 2296 wrote to memory of 2140	2296	DllCommonsvc.exe	104
PID 2296 wrote to memory of 2140	2296	DllCommonsvc.exe	104
PID 2296 wrote to memory of 2140	2296	DllCommonsvc.exe	104
PID 2140 wrote to memory of 2192	2140	cmd.exe	114

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d77d7121814bbdf950729fe1eac4c3f12e65c249e1efd7b2740fa65991ad2718.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d77d7121814bbdf950729fe1eac4c3f12e65c249e1efd7b2740fa65991ad2718.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2640
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2820
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2664
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2296
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2272
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Journal\Templates\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1808
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Internet Explorer\OSPPSVC.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3004
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\dllhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3052
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\spoolsv.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1820
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Photo Viewer\es-ES\winlogon.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1816
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\sppsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2468
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\services.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1420
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\dwm.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3060
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\smss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2988
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\lsm.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2456
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2992
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\MSBuild\Microsoft\audiodg.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2696
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft Office\System.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2688
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Internet Explorer\en-US\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2788
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\security\logs\spoolsv.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3068
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\LHTDh4RDH7.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2140
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:2192
      - C:\Program Files\Windows Photo Viewer\es-ES\winlogon.exe
        
        "C:\Program Files\Windows Photo Viewer\es-ES\winlogon.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2828
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\GzuRWOxc20.bat"
        7⤵
        
        PID:968
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:2268
        
        C:\Program Files\Windows Photo Viewer\es-ES\winlogon.exe
        
        "C:\Program Files\Windows Photo Viewer\es-ES\winlogon.exe"
        8⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2568
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\BHs9KC1JDp.bat"
        9⤵
        
        PID:1820
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:348
        
        C:\Program Files\Windows Photo Viewer\es-ES\winlogon.exe
        
        "C:\Program Files\Windows Photo Viewer\es-ES\winlogon.exe"
        10⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2880
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\BcPyovVCSH.bat"
        11⤵
        
        PID:2052
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:572
        
        C:\Program Files\Windows Photo Viewer\es-ES\winlogon.exe
        
        "C:\Program Files\Windows Photo Viewer\es-ES\winlogon.exe"
        12⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2156
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\TZCyxGcg3L.bat"
        13⤵
        
        PID:2004
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        14⤵
        
        PID:2532
        
        C:\Program Files\Windows Photo Viewer\es-ES\winlogon.exe
        
        "C:\Program Files\Windows Photo Viewer\es-ES\winlogon.exe"
        14⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2712
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\IPU7rAfrPc.bat"
        15⤵
        
        PID:2324
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        16⤵
        
        PID:2500
        
        C:\Program Files\Windows Photo Viewer\es-ES\winlogon.exe
        
        "C:\Program Files\Windows Photo Viewer\es-ES\winlogon.exe"
        16⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:872
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Q3ZRkRg4YZ.bat"
        17⤵
        
        PID:2116
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        18⤵
        
        PID:1796
        
        C:\Program Files\Windows Photo Viewer\es-ES\winlogon.exe
        
        "C:\Program Files\Windows Photo Viewer\es-ES\winlogon.exe"
        18⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:592
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\QSfwyRFOJU.bat"
        19⤵
        
        PID:868
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        20⤵
        
        PID:2836
        
        C:\Program Files\Windows Photo Viewer\es-ES\winlogon.exe
        
        "C:\Program Files\Windows Photo Viewer\es-ES\winlogon.exe"
        20⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2260
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\XErLL4imMU.bat"
        21⤵
        
        PID:3060
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        22⤵
        
        PID:2820
        
        C:\Program Files\Windows Photo Viewer\es-ES\winlogon.exe
        
        "C:\Program Files\Windows Photo Viewer\es-ES\winlogon.exe"
        22⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2904
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\hJP5Gj8VmP.bat"
        23⤵
        
        PID:2804
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        24⤵
        
        PID:1408
        
        C:\Program Files\Windows Photo Viewer\es-ES\winlogon.exe
        
        "C:\Program Files\Windows Photo Viewer\es-ES\winlogon.exe"
        24⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Journal\Templates\DllCommonsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\Program Files\Windows Journal\Templates\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Journal\Templates\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 8 /tr "'C:\Program Files\Internet Explorer\OSPPSVC.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1296

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 12 /tr "'C:\Program Files\Internet Explorer\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2164

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Photo Viewer\es-ES\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\es-ES\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Photo Viewer\es-ES\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 11 /tr "'C:\Users\Default User\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Users\Default User\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2096

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 9 /tr "'C:\providercommon\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\providercommon\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 10 /tr "'C:\providercommon\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 12 /tr "'C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1148

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 12 /tr "'C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\providercommon\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2192

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\providercommon\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 8 /tr "'C:\providercommon\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 8 /tr "'C:\Users\Default User\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Users\Default User\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 10 /tr "'C:\Users\Default User\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 9 /tr "'C:\Program Files\MSBuild\Microsoft\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Program Files\MSBuild\Microsoft\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 8 /tr "'C:\Program Files\MSBuild\Microsoft\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Microsoft Office\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Office\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Microsoft Office\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Program Files\Internet Explorer\en-US\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\en-US\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Program Files\Internet Explorer\en-US\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 7 /tr "'C:\Windows\security\logs\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\security\logs\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 13 /tr "'C:\Windows\security\logs\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8f0cf281f3d2631b02251921d14475c7

SHA1
6bfdfd0858244548f3d9f8a6df4321689ce24fed

SHA256
8a9631636b28d109d1dd6bd7dc3aa580d5318bb1f3dd06e5b8bf5225aef63b71

SHA512
d98e410a0d7291199e66a4e3a5ecd5c4a17cc5db5ccd8aa4fead7e4065740524997fc1d99b014d40c7b42a7e3c041f95bd5ccd76a958f566dfd8088e81b8b2b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ccc665f80adc7bbcd6df01404eb51db8

SHA1
7062a20855d8bbb9671299856f42b9f0cdc72d13

SHA256
2dd20f433b8e4dba1d868119a3c910bafcccda2a66ee2fb42b48ef3cc237d688

SHA512
7f59c1502e7759ddd33d6b8c444e2faba356662336dff91c637a108e1ae8aab4cc5af6920bbea8aeddb3a7dde5002448c8e2d9b9eaf44a9f4c8b6e013f86c1da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fc951e8668254c728161600feb50b98c

SHA1
4933fd6ef99040f6080e03e36faf9ea9550c0dd2

SHA256
20e1995f63a6d383031122fa450c86e6b3b6a281ce44da2dacec780142f8867a

SHA512
7fcf800a52750ca7e4de31fbf7f5477f37a2504f4711a90d77830b4bbb45efd27ff30914e34383d702a877861a9fc0151ce5937c9903164c85886ab3b0b8588f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ade3c0cc4f38d2be5d70b3df59942c15

SHA1
fc1dea4e3a14dc3e22af9c64d01f29122a9a0656

SHA256
56986d58c9372a050e835ad61f702722ab3e29c178c8db492b0250f46ff1538f

SHA512
b9b12b93e9a528a5c65fbe934c4f502325ae6ff3cddec7258b853d87f255bf5af4cb58613676d2b352e5899cfaaad38d1d74ca9abdea95fda3e4bd5e58e598b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4b1db3e5da140c272e2038ce3201305a

SHA1
407b5beff5f61f915320ffc514e3c94cfbe9f22d

SHA256
85178c52c136707ee7677a3a8184a217c596d1d2c421929811280a1b52d15328

SHA512
1b6188c0d2f403aaeba542a7980f5ae56960462ce33517d4e9ce1880eb452c6416a8121ff09c8d0cd7b15d0fa79b8f2536a49300f90c679adc8e3e8f2e0737e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9858955e5f8bb1ef73a865a9696179ef

SHA1
197eaa624266ec576179c09375fcfa96daf45d01

SHA256
9bf5b4551a8fbe8797e49c265ea2c39a4dc449bbeea07c045c3f70b2ec35e567

SHA512
f0d760c1adfd69c9b58b7442a84ce36b4b3af5bb88331dbd7cb46079f902ab4c7a78f466dc6d47489f241a87b65cad88b78ab19090a39998fff0583a5d78bf02

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e0578f6b63f865d86cacfc7e810ac812

SHA1
3a7990156138d6b3161f5906358b284e497e0c9b

SHA256
897bbf9e39ece65b32b279efb40679513dfd7c5fe36b4d5cc10f4424419f5b4c

SHA512
23326bb516a63d2728c4c959fbf407a929913303b3a54296186d7f9c2dbd8aa3ac87d9590bcea0151f46daec1b35066d3b0d719ffea515ae7ef948024c601760

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4c29a0310e4a7d143c4daa6f58fa5edf

SHA1
57ca8e051a3b0d1a4a62145b18189a851808b57f

SHA256
a1f59b084a2e74baac9d5c14e7244af7c461538a65fbd93871539a9f5613a1de

SHA512
607051207515348bc1b4beba9f9dfba26566f7b767d465d4c990224c4420028499bcc4d6f1757ba9821b4527cb0cbf805ed45d0467be64197c65c1858cf67732

Download Submit
C:\Users\Admin\AppData\Local\Temp\BHs9KC1JDp.bat

Filesize
221B

MD5
bcc06ccaf3de1f1394cc546621998675

SHA1
92e8539c077869754dfd29b059b007e99b1b3b44

SHA256
0c4b3204657e13aef27091c59f7fb4e0ff512d2562887335c8c9337f2b08e8d0

SHA512
85a1f038e0fc52da035d4d91340e174cf13c76b51bb6858fd11021e3d2d526776e2302de3f736dd386edeb335a6add7d5d8a4200341be7574ac98e726e69f164

Download Submit
C:\Users\Admin\AppData\Local\Temp\BcPyovVCSH.bat

Filesize
221B

MD5
c4d78ed8ce94d85b799037d8deab42c9

SHA1
52fb8da84ff1a4909293efde7b3e95b3d4553070

SHA256
300875ce739601aa4f96cbb651216d26749f9ec17e702e3fe7a7baeb32a1f05c

SHA512
5520b39257bd603c4988c8a36c9ff136a4cecfb4e5b01c98f85721a79b958e32b416579572566bddaa9fe532d395d682ff8653a300e2b0c4940091cb49d8c03c

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA0C4.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\GzuRWOxc20.bat

Filesize
221B

MD5
072efc767be7193b99c5188902512d8d

SHA1
e6628f384e4be6b98ec08eb8f1b4797108504592

SHA256
5b0de732bcaa3cd8c729648a655590893c28714032273e2f01cadd011eeb76b5

SHA512
4166e238699b15ba8aec65143c064870edfff6aa1640367ab5672f3792827125eb27cfac6f0ffd8d899c3357b20b080bcec43bec38dc295a419b4430928218f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IPU7rAfrPc.bat

Filesize
221B

MD5
cea063230eea3344f04a476135a3bc39

SHA1
a0ff24284a714b41757b57a1f0679b19869c5689

SHA256
340624c1b79f7b55f130008ebedab608293db28805c5d0387aaea0bbe46020be

SHA512
81067f0cea87da4442c2556cc7fe9c24e973c03a713a2b9ffd313cd96c562b8baa27f9c16ac7292c15faed063c277a8c7383c24f1c37626cb5e008257752344c

Download Submit
C:\Users\Admin\AppData\Local\Temp\LHTDh4RDH7.bat

Filesize
221B

MD5
29b69e8b1310ef0fc960170405704c80

SHA1
7e2d04e5da2c2afc5d26cb6de38aa88fe5a2e089

SHA256
4d24de64af030d62f6ff637d868cc46a7f2a663c402eb8a5814901c02962a07f

SHA512
4d636af512b13357c17d886ede3521b37d0e7e66990fd24424eee89372246a25ef3f031166d7bbd6e5ad4b531960d19b2a2f5f2f2977bf1491051b2e6c41f1dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Q3ZRkRg4YZ.bat

Filesize
221B

MD5
65acb4e756cb5cbd30e2bba43cbe660e

SHA1
4285d43a0fd6299a9d63e668a418582fe81df2b8

SHA256
4de62a012b4d7942d25f77c38fe223b5f3f9384b00620a7b7ebd71f4102018be

SHA512
646276b24cbccbcad42beb1dd1447eba3603b7565926ca679db5e46b300f7de105eadd09566bbcb55a98ea0bc32cec7a109b8521ff961db5bc351d0be00cdf0e

Download Submit
C:\Users\Admin\AppData\Local\Temp\QSfwyRFOJU.bat

Filesize
221B

MD5
0ad2c1cba07b54f63e11f42920ccd9e2

SHA1
7159d185aa2d021103774ca44addcef83f25b38d

SHA256
6ac412251c110340bc6f45851c22b72e51a091376ffdbfa9732d6fb3d7feba00

SHA512
c03ca8861a063b92266f6102d0658dcf9b6f0f09275a2a7937c69df44ff46f24cf70b162dc88b9f44c535c689504a6d45c1941b4aa601d31bd5ab68af37c7eb3

Download Submit
C:\Users\Admin\AppData\Local\Temp\TZCyxGcg3L.bat

Filesize
221B

MD5
d7f03e486a38658abca8f31a39a3e6c2

SHA1
60ace7b724a2c70408e5273bdc55a5c5fccecf35

SHA256
9544682c7710867b8cd50d7c212ca521afabf4dc2a65c8c2c883cca4461998ae

SHA512
4ebb3a201d4bd27e283e1407fded4d4000d60e54bc126324eee5707983b49261802a7a7171061e24c787ce6980959413969fe1d55cba0cbb07bf141d141b6385

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA0D6.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\XErLL4imMU.bat

Filesize
221B

MD5
5d2b29038d79102a1cb841a053546a75

SHA1
8c064aa23cf1aef84fd60e0a886dce6e5fc00d7b

SHA256
d541e0705cac8c9dacc659959a5de62b4dd1f14c329021adc9fde6003ca898fb

SHA512
f8fc60a790af35ca703d191854892ca58f1774a175a77f0661b26bac8cdc9a788d75023d7b0e36b1c1d8b272395254c236c2afd826219fb0552907bcd1a790f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\hJP5Gj8VmP.bat

Filesize
221B

MD5
e7b815b6f556820e80771a95aa614352

SHA1
5a32f9dcb251e030f10e7532c28a6bf0142c9da1

SHA256
e8916fcabf563554cca29f3c7255d518bd0fca1114f81b2b046cc727d18e2c2a

SHA512
0ec3a95abf65c650f83fef60ca176e3f1c109fec2d01201090f762e55f13e35e704a8e5e3bc170e9b35dec872074d587f267b3f70662b6b4f74bd075021ff2a6

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
ded6a435301a86c085c1527cc66f1df6

SHA1
38ff1aff58241b4ddbb0912f24c7ce5471cdd50e

SHA256
08905a7cc2f7eb9d8358c5b012c085b24ce748195f8040e156d937ca02d1934c

SHA512
121c61c40776fae712df44085751ecc585276f09d1f62c43b51722df3792fcb94c6a57d4753ef9e40c128788e80205aa7f7ace307e59f28f39c64dd66c603553

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/704-674-0x00000000011C0000-0x00000000012D0000-memory.dmp

Filesize
1.1MB

Download
memory/872-435-0x0000000001260000-0x0000000001370000-memory.dmp

Filesize
1.1MB

Download
memory/1420-65-0x00000000026E0000-0x00000000026E8000-memory.dmp

Filesize
32KB

Download
memory/1420-64-0x000000001B780000-0x000000001BA62000-memory.dmp

Filesize
2.9MB

Download
memory/2260-554-0x00000000012A0000-0x00000000013B0000-memory.dmp

Filesize
1.1MB

Download
memory/2296-14-0x0000000000140000-0x0000000000152000-memory.dmp

Filesize
72KB

Download
memory/2296-15-0x00000000003D0000-0x00000000003DC000-memory.dmp

Filesize
48KB

Download
memory/2296-13-0x0000000000940000-0x0000000000A50000-memory.dmp

Filesize
1.1MB

Download
memory/2296-16-0x0000000000470000-0x000000000047C000-memory.dmp

Filesize
48KB

Download
memory/2296-17-0x00000000003C0000-0x00000000003CC000-memory.dmp

Filesize
48KB

Download
memory/2568-196-0x0000000000DF0000-0x0000000000F00000-memory.dmp

Filesize
1.1MB

Download
memory/2712-375-0x00000000001E0000-0x00000000001F2000-memory.dmp

Filesize
72KB

Download
memory/2712-374-0x00000000001F0000-0x0000000000300000-memory.dmp

Filesize
1.1MB

Download
memory/2828-136-0x0000000000070000-0x0000000000180000-memory.dmp

Filesize
1.1MB

Download
memory/2828-137-0x00000000005D0000-0x00000000005E2000-memory.dmp

Filesize
72KB

Download
memory/2904-614-0x0000000000360000-0x0000000000470000-memory.dmp

Filesize
1.1MB

Download