dcrat | a6ac7634f12bb24944f34b59a2834a522ccaaa8f4b86e615e437231cbd94a4cc

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22-12-2024 20:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_a6ac7634f12bb24944f34b59a2834a522ccaaa8f4b86e615e437231cbd94a4cc.exe
Size

1.3MB
MD5

5a7cd8e09f42f5f81a54efcb1a671e62
SHA1

8fc6740075c40049ef334278de17c1abe2f0e3e3
SHA256

a6ac7634f12bb24944f34b59a2834a522ccaaa8f4b86e615e437231cbd94a4cc
SHA512

8edbcbe9b9ceafd3c85f33387ca790dd819a6bc6be7011909ad54d7b02b5cebab1277b8ce73bf8c22a301bb398823d634e2452427ef8c6df37f374fcaa85430f
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 45 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2520	1948	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2936	1948	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2548	1948	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2780	1948	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2768	1948	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2524	1948	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1672	1948	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2564	1948	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2068	1948	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1148	1948	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2816	1948	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1900	1948	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1944	1948	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1192	1948	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2420	1948	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1432	1948	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2008	1948	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2828	1948	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1440	1948	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	900	1948	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2980	1948	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2264	1948	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2100	1948	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2464	1948	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1916	1948	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2808	1948	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2296	1948	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2772	1948	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2624	1948	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2248	1948	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2628	1948	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2796	1948	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2528	1948	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2540	1948	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2572	1948	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2064	1948	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2268	1948	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3028	1948	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2040	1948	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1884	1948	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2336	1948	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2604	1948	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1840	1948	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1900	1948	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3060	1948	schtasks.exe	34

DCRat payload 5 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0008000000017492-12.dat	dcrat
behavioral1/memory/2812-13-0x0000000000910000-0x0000000000A20000-memory.dmp	dcrat
behavioral1/memory/2612-96-0x00000000003E0000-0x00000000004F0000-memory.dmp	dcrat
behavioral1/memory/1552-206-0x00000000011C0000-0x00000000012D0000-memory.dmp	dcrat
behavioral1/memory/1016-682-0x0000000001300000-0x0000000001410000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 17 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2160	powershell.exe
2880	powershell.exe
3016	powershell.exe
1972	powershell.exe
2192	powershell.exe
2492	powershell.exe
2580	powershell.exe
1708	powershell.exe
2856	powershell.exe
2876	powershell.exe
1108	powershell.exe
2960	powershell.exe
1460	powershell.exe
1744	powershell.exe
2836	powershell.exe
2128	powershell.exe
2404	powershell.exe

Executes dropped EXE 13 IoCs

pid	Process
2812	DllCommonsvc.exe
2408	DllCommonsvc.exe
2612	dllhost.exe
1552	dllhost.exe
2712	dllhost.exe
2208	dllhost.exe
976	dllhost.exe
968	dllhost.exe
2984	dllhost.exe
2100	dllhost.exe
2904	dllhost.exe
1016	dllhost.exe
1152	dllhost.exe

Loads dropped DLL 2 IoCs

pid	Process
1540	cmd.exe
1540	cmd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 11 IoCs

Web Service

T1102

flow	ioc
37	raw.githubusercontent.com
4	raw.githubusercontent.com
9	raw.githubusercontent.com
12	raw.githubusercontent.com
20	raw.githubusercontent.com
23	raw.githubusercontent.com
34	raw.githubusercontent.com
5	raw.githubusercontent.com
16	raw.githubusercontent.com
27	raw.githubusercontent.com
30	raw.githubusercontent.com

Drops file in Program Files directory 17 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Games\75a57c1bdf437c	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Portable Devices\conhost.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Portable Devices\6ccacd8608530f	DllCommonsvc.exe
File opened for modification	C:\Program Files\Microsoft Games\75a57c1bdf437c	DllCommonsvc.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\lsm.exe	DllCommonsvc.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\6203df4a6bafc7	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft Office\a76d7bf15d8370	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Portable Devices\088424020bedd6	DllCommonsvc.exe
File created	C:\Program Files\Microsoft Games\WMIADAP.exe	DllCommonsvc.exe
File opened for modification	C:\Program Files\Microsoft Games\WMIADAP.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Defender\fr-FR\dllhost.exe	DllCommonsvc.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\lsass.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\101b941d020240	DllCommonsvc.exe
File created	C:\Program Files\Windows Defender\fr-FR\5940a34987c991	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Portable Devices\Idle.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft Office\DllCommonsvc.exe	DllCommonsvc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\lsm.exe	DllCommonsvc.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\winsxs\x86_microsoft-windows-d..rectplay8.resources_31bf3856ad364e35_6.1.7600.16385_en-us_38b5a1fc830bbf8b\smss.exe	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_a6ac7634f12bb24944f34b59a2834a522ccaaa8f4b86e615e437231cbd94a4cc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 45 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2796	schtasks.exe
2540	schtasks.exe
1840	schtasks.exe
1672	schtasks.exe
2248	schtasks.exe
2628	schtasks.exe
2604	schtasks.exe
3060	schtasks.exe
1192	schtasks.exe
1432	schtasks.exe
2268	schtasks.exe
2264	schtasks.exe
1884	schtasks.exe
1148	schtasks.exe
1944	schtasks.exe
2980	schtasks.exe
3028	schtasks.exe
2336	schtasks.exe
2524	schtasks.exe
2816	schtasks.exe
900	schtasks.exe
2296	schtasks.exe
2528	schtasks.exe
2068	schtasks.exe
2100	schtasks.exe
2808	schtasks.exe
2008	schtasks.exe
2828	schtasks.exe
1440	schtasks.exe
2572	schtasks.exe
2064	schtasks.exe
2520	schtasks.exe
2768	schtasks.exe
2564	schtasks.exe
2040	schtasks.exe
1900	schtasks.exe
2548	schtasks.exe
2780	schtasks.exe
2464	schtasks.exe
1916	schtasks.exe
2772	schtasks.exe
2624	schtasks.exe
2936	schtasks.exe
1900	schtasks.exe
2420	schtasks.exe

Suspicious behavior: EnumeratesProcesses 36 IoCs

pid	Process
2812	DllCommonsvc.exe
3016	powershell.exe
2856	powershell.exe
2880	powershell.exe
1972	powershell.exe
2408	DllCommonsvc.exe
2836	powershell.exe
2876	powershell.exe
1708	powershell.exe
2408	DllCommonsvc.exe
2408	DllCommonsvc.exe
2408	DllCommonsvc.exe
2408	DllCommonsvc.exe
2408	DllCommonsvc.exe
2408	DllCommonsvc.exe
2404	powershell.exe
2160	powershell.exe
2492	powershell.exe
2960	powershell.exe
1744	powershell.exe
1108	powershell.exe
2580	powershell.exe
2128	powershell.exe
1460	powershell.exe
2192	powershell.exe
2612	dllhost.exe
1552	dllhost.exe
2712	dllhost.exe
2208	dllhost.exe
976	dllhost.exe
968	dllhost.exe
2984	dllhost.exe
2100	dllhost.exe
2904	dllhost.exe
1016	dllhost.exe
1152	dllhost.exe

Suspicious use of AdjustPrivilegeToken 30 IoCs

description	pid	Process
Token: SeDebugPrivilege	2812	DllCommonsvc.exe
Token: SeDebugPrivilege	3016	powershell.exe
Token: SeDebugPrivilege	2856	powershell.exe
Token: SeDebugPrivilege	2880	powershell.exe
Token: SeDebugPrivilege	1972	powershell.exe
Token: SeDebugPrivilege	2408	DllCommonsvc.exe
Token: SeDebugPrivilege	2836	powershell.exe
Token: SeDebugPrivilege	2876	powershell.exe
Token: SeDebugPrivilege	1708	powershell.exe
Token: SeDebugPrivilege	2404	powershell.exe
Token: SeDebugPrivilege	2160	powershell.exe
Token: SeDebugPrivilege	2612	dllhost.exe
Token: SeDebugPrivilege	2492	powershell.exe
Token: SeDebugPrivilege	2960	powershell.exe
Token: SeDebugPrivilege	1744	powershell.exe
Token: SeDebugPrivilege	1108	powershell.exe
Token: SeDebugPrivilege	2580	powershell.exe
Token: SeDebugPrivilege	2128	powershell.exe
Token: SeDebugPrivilege	1460	powershell.exe
Token: SeDebugPrivilege	2192	powershell.exe
Token: SeDebugPrivilege	1552	dllhost.exe
Token: SeDebugPrivilege	2712	dllhost.exe
Token: SeDebugPrivilege	2208	dllhost.exe
Token: SeDebugPrivilege	976	dllhost.exe
Token: SeDebugPrivilege	968	dllhost.exe
Token: SeDebugPrivilege	2984	dllhost.exe
Token: SeDebugPrivilege	2100	dllhost.exe
Token: SeDebugPrivilege	2904	dllhost.exe
Token: SeDebugPrivilege	1016	dllhost.exe
Token: SeDebugPrivilege	1152	dllhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2596 wrote to memory of 2296	2596	JaffaCakes118_a6ac7634f12bb24944f34b59a2834a522ccaaa8f4b86e615e437231cbd94a4cc.exe	30
PID 2596 wrote to memory of 2296	2596	JaffaCakes118_a6ac7634f12bb24944f34b59a2834a522ccaaa8f4b86e615e437231cbd94a4cc.exe	30
PID 2596 wrote to memory of 2296	2596	JaffaCakes118_a6ac7634f12bb24944f34b59a2834a522ccaaa8f4b86e615e437231cbd94a4cc.exe	30
PID 2596 wrote to memory of 2296	2596	JaffaCakes118_a6ac7634f12bb24944f34b59a2834a522ccaaa8f4b86e615e437231cbd94a4cc.exe	30
PID 2296 wrote to memory of 1540	2296	WScript.exe	31
PID 2296 wrote to memory of 1540	2296	WScript.exe	31
PID 2296 wrote to memory of 1540	2296	WScript.exe	31
PID 2296 wrote to memory of 1540	2296	WScript.exe	31
PID 1540 wrote to memory of 2812	1540	cmd.exe	33
PID 1540 wrote to memory of 2812	1540	cmd.exe	33
PID 1540 wrote to memory of 2812	1540	cmd.exe	33
PID 1540 wrote to memory of 2812	1540	cmd.exe	33
PID 2812 wrote to memory of 1972	2812	DllCommonsvc.exe	54
PID 2812 wrote to memory of 1972	2812	DllCommonsvc.exe	54
PID 2812 wrote to memory of 1972	2812	DllCommonsvc.exe	54
PID 2812 wrote to memory of 1708	2812	DllCommonsvc.exe	55
PID 2812 wrote to memory of 1708	2812	DllCommonsvc.exe	55
PID 2812 wrote to memory of 1708	2812	DllCommonsvc.exe	55
PID 2812 wrote to memory of 2880	2812	DllCommonsvc.exe	56
PID 2812 wrote to memory of 2880	2812	DllCommonsvc.exe	56
PID 2812 wrote to memory of 2880	2812	DllCommonsvc.exe	56
PID 2812 wrote to memory of 2876	2812	DllCommonsvc.exe	57
PID 2812 wrote to memory of 2876	2812	DllCommonsvc.exe	57
PID 2812 wrote to memory of 2876	2812	DllCommonsvc.exe	57
PID 2812 wrote to memory of 2856	2812	DllCommonsvc.exe	60
PID 2812 wrote to memory of 2856	2812	DllCommonsvc.exe	60
PID 2812 wrote to memory of 2856	2812	DllCommonsvc.exe	60
PID 2812 wrote to memory of 2836	2812	DllCommonsvc.exe	61
PID 2812 wrote to memory of 2836	2812	DllCommonsvc.exe	61
PID 2812 wrote to memory of 2836	2812	DllCommonsvc.exe	61
PID 2812 wrote to memory of 3016	2812	DllCommonsvc.exe	62
PID 2812 wrote to memory of 3016	2812	DllCommonsvc.exe	62
PID 2812 wrote to memory of 3016	2812	DllCommonsvc.exe	62
PID 2812 wrote to memory of 2408	2812	DllCommonsvc.exe	68
PID 2812 wrote to memory of 2408	2812	DllCommonsvc.exe	68
PID 2812 wrote to memory of 2408	2812	DllCommonsvc.exe	68
PID 2408 wrote to memory of 1744	2408	DllCommonsvc.exe	96
PID 2408 wrote to memory of 1744	2408	DllCommonsvc.exe	96
PID 2408 wrote to memory of 1744	2408	DllCommonsvc.exe	96
PID 2408 wrote to memory of 1460	2408	DllCommonsvc.exe	97
PID 2408 wrote to memory of 1460	2408	DllCommonsvc.exe	97
PID 2408 wrote to memory of 1460	2408	DllCommonsvc.exe	97
PID 2408 wrote to memory of 2404	2408	DllCommonsvc.exe	98
PID 2408 wrote to memory of 2404	2408	DllCommonsvc.exe	98
PID 2408 wrote to memory of 2404	2408	DllCommonsvc.exe	98
PID 2408 wrote to memory of 2960	2408	DllCommonsvc.exe	99
PID 2408 wrote to memory of 2960	2408	DllCommonsvc.exe	99
PID 2408 wrote to memory of 2960	2408	DllCommonsvc.exe	99
PID 2408 wrote to memory of 1108	2408	DllCommonsvc.exe	101
PID 2408 wrote to memory of 1108	2408	DllCommonsvc.exe	101
PID 2408 wrote to memory of 1108	2408	DllCommonsvc.exe	101
PID 2408 wrote to memory of 2128	2408	DllCommonsvc.exe	103
PID 2408 wrote to memory of 2128	2408	DllCommonsvc.exe	103
PID 2408 wrote to memory of 2128	2408	DllCommonsvc.exe	103
PID 2408 wrote to memory of 2580	2408	DllCommonsvc.exe	104
PID 2408 wrote to memory of 2580	2408	DllCommonsvc.exe	104
PID 2408 wrote to memory of 2580	2408	DllCommonsvc.exe	104
PID 2408 wrote to memory of 2492	2408	DllCommonsvc.exe	105
PID 2408 wrote to memory of 2492	2408	DllCommonsvc.exe	105
PID 2408 wrote to memory of 2492	2408	DllCommonsvc.exe	105
PID 2408 wrote to memory of 2160	2408	DllCommonsvc.exe	106
PID 2408 wrote to memory of 2160	2408	DllCommonsvc.exe	106
PID 2408 wrote to memory of 2160	2408	DllCommonsvc.exe	106
PID 2408 wrote to memory of 2192	2408	DllCommonsvc.exe	107

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a6ac7634f12bb24944f34b59a2834a522ccaaa8f4b86e615e437231cbd94a4cc.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a6ac7634f12bb24944f34b59a2834a522ccaaa8f4b86e615e437231cbd94a4cc.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2596
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2296
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1540
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2812
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1972
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Adobe\Reader 9.0\lsm.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1708
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Start Menu\sppsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2880
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\audiodg.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2876
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\explorer.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2856
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\System.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2836
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Templates\WmiPrvSE.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3016
    - - C:\providercommon\DllCommonsvc.exe
        
        "C:\providercommon\DllCommonsvc.exe"
        5⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2408
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1744
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Microsoft Games\WMIADAP.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1460
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Portable Devices\conhost.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2404
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Defender\fr-FR\dllhost.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2960
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\sppsvc.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1108
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\lsass.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2128
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Portable Devices\Idle.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2580
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft Office\DllCommonsvc.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2492
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Microsoft Games\WMIADAP.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2160
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\WmiPrvSE.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2192
      - C:\Program Files\Windows Defender\fr-FR\dllhost.exe
        
        "C:\Program Files\Windows Defender\fr-FR\dllhost.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2612
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Iu2jWrKESR.bat"
        7⤵
        
        PID:1268
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:1672
        
        C:\Program Files\Windows Defender\fr-FR\dllhost.exe
        
        "C:\Program Files\Windows Defender\fr-FR\dllhost.exe"
        8⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1552
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\kQw8FYVnXF.bat"
        9⤵
        
        PID:684
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:1160
        
        C:\Program Files\Windows Defender\fr-FR\dllhost.exe
        
        "C:\Program Files\Windows Defender\fr-FR\dllhost.exe"
        10⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2712
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\3B2OAH3dio.bat"
        11⤵
        
        PID:2128
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:2432
        
        C:\Program Files\Windows Defender\fr-FR\dllhost.exe
        
        "C:\Program Files\Windows Defender\fr-FR\dllhost.exe"
        12⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2208
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\XaHtVPtwVH.bat"
        13⤵
        
        PID:2064
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        14⤵
        
        PID:2500
        
        C:\Program Files\Windows Defender\fr-FR\dllhost.exe
        
        "C:\Program Files\Windows Defender\fr-FR\dllhost.exe"
        14⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:976
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\c38FLB8gIG.bat"
        15⤵
        
        PID:2288
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        16⤵
        
        PID:1736
        
        C:\Program Files\Windows Defender\fr-FR\dllhost.exe
        
        "C:\Program Files\Windows Defender\fr-FR\dllhost.exe"
        16⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:968
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\U4eMIZxK0W.bat"
        17⤵
        
        PID:1108
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        18⤵
        
        PID:2308
        
        C:\Program Files\Windows Defender\fr-FR\dllhost.exe
        
        "C:\Program Files\Windows Defender\fr-FR\dllhost.exe"
        18⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2984
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\18eSMsDQCm.bat"
        19⤵
        
        PID:1720
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        20⤵
        
        PID:2428
        
        C:\Program Files\Windows Defender\fr-FR\dllhost.exe
        
        "C:\Program Files\Windows Defender\fr-FR\dllhost.exe"
        20⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2100
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Gy1gqmGK9f.bat"
        21⤵
        
        PID:916
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        22⤵
        
        PID:2660
        
        C:\Program Files\Windows Defender\fr-FR\dllhost.exe
        
        "C:\Program Files\Windows Defender\fr-FR\dllhost.exe"
        22⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2904
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\mTJ33xL03H.bat"
        23⤵
        
        PID:2924
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        24⤵
        
        PID:2252
        
        C:\Program Files\Windows Defender\fr-FR\dllhost.exe
        
        "C:\Program Files\Windows Defender\fr-FR\dllhost.exe"
        24⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1016
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\vhzsSyDvNE.bat"
        25⤵
        
        PID:2524
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        26⤵
        
        PID:1588
        
        C:\Program Files\Windows Defender\fr-FR\dllhost.exe
        
        "C:\Program Files\Windows Defender\fr-FR\dllhost.exe"
        26⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1152

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Adobe\Reader 9.0\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Reader 9.0\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Adobe\Reader 9.0\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 7 /tr "'C:\Users\Default\Start Menu\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Users\Default\Start Menu\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 14 /tr "'C:\Users\Default\Start Menu\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\Users\Default User\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1148

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Users\Default User\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\Users\Default User\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 8 /tr "'C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1192

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 8 /tr "'C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2420

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\Templates\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Users\All Users\Templates\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 11 /tr "'C:\Users\All Users\Templates\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 6 /tr "'C:\Program Files\Microsoft Games\WMIADAP.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1440

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAP" /sc ONLOGON /tr "'C:\Program Files\Microsoft Games\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 14 /tr "'C:\Program Files\Microsoft Games\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Portable Devices\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2264

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2100

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Portable Devices\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Defender\fr-FR\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\fr-FR\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Defender\fr-FR\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2296

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\MSOCache\All Users\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Portable Devices\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Portable Devices\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Microsoft Office\DllCommonsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Office\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Microsoft Office\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 10 /tr "'C:\Program Files\Microsoft Games\WMIADAP.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAP" /sc ONLOGON /tr "'C:\Program Files\Microsoft Games\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2336

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 6 /tr "'C:\Program Files\Microsoft Games\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\MSOCache\All Users\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4d1b2b8d42e6165371860156c1cf17c9

SHA1
b4527443aa2daa2505e0d1322e66f00d4a058300

SHA256
c82ff1aaf31f5dd483c00e09f09190803588954bb10b444c2bd3bd13449029ac

SHA512
64d5f3d5731f5222c8d7bd49168619ccd9c2c2b8bb67dc571765ce0f3708b4fe3f3315fb1b0637a4edc11aa2f6c248fda381facaed780938170799a6d067b964

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f70c12352bcb55a1cc908424dcfd9b1f

SHA1
e9149b24bed167e93cc06d46ec9086d51f7c37e7

SHA256
68ec2fca84c58b9d7e902961867725f4a1aae9d5f4a5df5de5cd140a0c72eb80

SHA512
b8cdf6e032754fe62db9a70816acb4877f503836cce520627e271d187c20eb3210e4377cb188cceb1d61158a552f987e85c4b64d3c98d267e68382a29bcde00b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4900d1ea4d485c7e055f55ee70915ea3

SHA1
c5568c68bde4c6395083e0a9a2a27e73d91a3843

SHA256
cb498a9e87e2308ea5325e12ae89560b5ca83a1b8d8d1fa8d79b08b34b7c88c2

SHA512
b39232f89348e03326fdd37a55ceb00358c7b63241a0bf1196cbedc529bd8374d8ac5bb720eb8359e7d97d15a58998436d194c3c34e11b21e9391c0576e23f28

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
71e86804391a76fcd101da791cc72633

SHA1
924c9c4eb71b6f916224c391a78b6790aa8c3356

SHA256
699d9e881cf95d4c2ded5bf522dbc5adf9a38daf31682ec46b00dd785d91da02

SHA512
2f4646651c448cf3026f4f06e190a1b0228ec02a44f68ca2780fccfdaa8f219cc5441ae96c86780d6ab7f06ab7ee652d13aabcf53bba76b8a705ebd8e83f13bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
24fbb2bcc4e98a874bd3894a75cc8b9f

SHA1
d214bfcf684e35e51835e0dfa2d775207ad063d5

SHA256
cf71ef74b921c79d2ef857acd533624db793555ed1a4e1a7f1773456f97fac66

SHA512
1d4caac3992470f28f2ca4ec60e59e2e02b4c9a82dc715f64528ffc20e9363e7c4b5eef816f8a1eeb6088d6c2a89f8441bf2b63c0357f316f9197e8312f1d3dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
455d53b329644a743847ffde9ec7f98a

SHA1
a3058cb4b1f48e7a4505909d55f5dbe67b7e121b

SHA256
518953e4199135c5a0dfee56b27a3c4f6b585b399ad38784f4a1d417f7d13e37

SHA512
045fe007f537549bf31be6e74ff22025d82ede6c2a424d5e12c99c36e14feb21c419c3108186f6280d6a8cf1917af9533335a01824fb14bde9a1bb52aa77b389

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0fd0ece096922484003f2ae32d1e5d6d

SHA1
7e9fed429d2719bcbca0327fd12dff5fe82597f4

SHA256
66154628ecd50f96f04742e5cae3dba810b5e39bffbd2706ea08b938dd46774d

SHA512
fab88fd3776915b887cba8b04de296e8f63c1765df18cc75bd99c673d46c671e46b3beed026f49cdb596f69a3ac659c450ac2624d5c1adba70c57aa5b387c09b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
15cca06c83755ea61679420b6e79cd5d

SHA1
d08069117432d29e6d835f5bb302dcd5f3f48b7a

SHA256
e54c7d7a75a6218f911cda2d969aae087e88861d3651410a99e3aa3aa2ac6fd2

SHA512
8ee9f05606809ccc6dc2c34a613d05c66772e5ba5ab77a6905511902b5d9d34a50769b712c0d0a2898032b812406ec3738d1e93220f8735c5e3148abf994d155

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5aead0cc4f7512a442834b12960125f3

SHA1
718d8c7d8f4847d99c1ab7509e9105d28e685f8c

SHA256
dfb192a0236b3c9af7d6b5bdde20099ee79599217ad5cd58a811185750fdd2a8

SHA512
49c127c343eab19521268af063bd45daeae0eb219e606f60dc23d55bc024eb334592540acaebddebba8c70c1ebdfb340919ae312ca07f2ac73f86b1d9aed122d

Download Submit
C:\Users\Admin\AppData\Local\Temp\18eSMsDQCm.bat

Filesize
216B

MD5
9b6d9cac80ebef10b02474c91d0e6651

SHA1
bd048ac039a91dfd150216bd071aa7667029e7d2

SHA256
29ceec7be0c6fc2f7f9bee913d5f20ca7a739e79b40edecebc3681c66dcee5ae

SHA512
f4a9d2b8ae858d40bfbe1a5f4a41777265ebd79eaa7972bf5f50a7c472c484f3c5b17d1babcff56c529a462ed78bd5bf51a9c125c920a128cd0d79f54e278902

Download Submit
C:\Users\Admin\AppData\Local\Temp\3B2OAH3dio.bat

Filesize
216B

MD5
57d7c0f168762a23e44810a9a4134c89

SHA1
ba149a538aa694c8dedb33bee07f6ac9379ba7c9

SHA256
1ad31feab7d8cde0056cfa0b2d6390bbd84f4ceb353e166da53890a0a6e8697d

SHA512
851849bd547c6427e07d3d37579462c31ee6f314ac9128421759a08549bbae5dc73ef5b951501f107cedec427c63dc0633d2871705dd4d78c28ab7fdd9b566d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabFD26.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Gy1gqmGK9f.bat

Filesize
216B

MD5
6486e2aa7e995318e3b8ac8250850b4c

SHA1
dddb658e4dd8b01b2831ea7ba0c2b97f8df066d8

SHA256
bc5cf18fcd14f9f2128e6e738d0b70dd2e509e3297a2ab5d72bd0c2c6f35a91e

SHA512
45af102ccf0dad44234498626bacc612091c4bf932b76e34352e4ab3ea0d13f50313d1cf7cb784ea0680f69ed233d9bccd712a7db39b4e06bc7b8f05e41a943f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Iu2jWrKESR.bat

Filesize
216B

MD5
241417fbad6a6a4981805fa064e61fbc

SHA1
7d9c19c4dcb9e9c4aa900992f2ea91a275e698a6

SHA256
213efd8c86ebeb1fd43d47acbdfd1c59b05dd60b19fce4b70ed825dda72d6885

SHA512
d4fc0d5c9b9b802255e7464af5a3e769c8272ee9d5e8769e5865561f3ab4b1d3c07569aefb21dbd672c70c58a19d402976cdd5dd619bd8831ef0aaafd0b136f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarFD48.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\U4eMIZxK0W.bat

Filesize
216B

MD5
be3c5dae23bf5db2c4830f3b75cd14ad

SHA1
a7d2c4480e2d24bfeff1323e6a164e7e83aa9b32

SHA256
9e7206f731379ca6723e247af0c0d1cba1c00918359ac4a003a275684b9b960d

SHA512
ad25e2d494742c0e7f96646139c45aef845f2a1ccab9e604389a492d10d37f855343c0a167d82c9575cc9f0f9263281b8715e58283f54716595cc3e7f51161c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\XaHtVPtwVH.bat

Filesize
216B

MD5
acd23d58820e64413b3f21c9b8b8677f

SHA1
75084304f1850fa42cd5f1a50de20c5a9371cf43

SHA256
16dd5b1307432f6651f610316e544de2c047c6efe1204a5747f51cd0950634c0

SHA512
e65018a848d36bd1507cab3f6b4db8531b9ece4ec283eb6c427a0c1a7ccfbc8e06d3ada575ecb105fd12ebb052257389358d12db00855e4a52b02df77674e2e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\c38FLB8gIG.bat

Filesize
216B

MD5
a7b2587d409168b62abda1b675863453

SHA1
c8f49b0bd8727af48cd92ae3cb8b4b6685dd8908

SHA256
886634b1c7253b1417bc3caaef751b17adf2ae614a320020975432bc38e3bbbe

SHA512
3723ba465690a8616253e676e87163b9ff3f6a6cc84e91552a167ef9e57eaa72ff74725bebd8efe8a97d3e438107b9ada19ac06b36dc8f5c473e02679380f899

Download Submit
C:\Users\Admin\AppData\Local\Temp\kQw8FYVnXF.bat

Filesize
216B

MD5
80fcea21a2a827bc6648ad9771f97ace

SHA1
8f027bfd4cc5944d15343f1a0da55cb1a7d4ef89

SHA256
b963beacbab842db9aaab650d739d450705fa13216bc73e50154e4e14aa83e72

SHA512
7964f388eece57e2dc436c268bf8a0b5e81f790ce55eedd25100acd8af87510887cb5dce9c6ba4a12e706d274013c3c12ca3ba7f67c407a0cc010c2d52220616

Download Submit
C:\Users\Admin\AppData\Local\Temp\mTJ33xL03H.bat

Filesize
216B

MD5
3ebc847e44492fcb2817fae3c0cac9ad

SHA1
3a503997cb5002e362433ff72ae4961ab1d6aff3

SHA256
fb7c35217b7fd7549f39bfde270c7e77fcfd570375e40f0a8d903c3d8f83eaac

SHA512
6e6606e1bc79e0b2b3d9050f911d480ff09b0e7c6d1a3e3b175d1b8557e448b907705e8d845212b3010b65c56da533e5c6b4c5eb23221e6dbcf3127f25dca105

Download Submit
C:\Users\Admin\AppData\Local\Temp\vhzsSyDvNE.bat

Filesize
216B

MD5
a5ae213d85dcf9a38d95794b68aae36a

SHA1
d4aa24c3fc5e1ac1493dde9466378cacee1e7f5b

SHA256
4048b53fcb37efdd99ab3ad07efb6aeaec9357ba4c7d3d041568de795b216c5b

SHA512
8f7a24b11184cf02a6f3b3bd9882645835f0255147c959c634f2c2069c3bf3157716d79b18eba079e52b354240c37d8aea409a2ea3257de7f60db638ff27dcd2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
3fae1a18675594ce99aaa96ec7a522aa

SHA1
d8de22249025a9bb81aca134aba83926014b8993

SHA256
33605f85982135789bc60c926ee4cdc527ce413398be35025b0d997920f117d4

SHA512
e85f8279f04098aff66a534a47085532a23523d8161c81ee6be47be82754da1d00a6c2435967738e18396bb3154e621b8de69c1507c5d4e0de0a0b122d8dca16

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/976-385-0x0000000000430000-0x0000000000442000-memory.dmp

Filesize
72KB

Download
memory/1016-683-0x0000000000980000-0x0000000000992000-memory.dmp

Filesize
72KB

Download
memory/1016-682-0x0000000001300000-0x0000000001410000-memory.dmp

Filesize
1.1MB

Download
memory/1552-207-0x00000000004A0000-0x00000000004B2000-memory.dmp

Filesize
72KB

Download
memory/1552-206-0x00000000011C0000-0x00000000012D0000-memory.dmp

Filesize
1.1MB

Download
memory/2160-127-0x00000000027E0000-0x00000000027E8000-memory.dmp

Filesize
32KB

Download
memory/2408-52-0x0000000000340000-0x0000000000352000-memory.dmp

Filesize
72KB

Download
memory/2612-96-0x00000000003E0000-0x00000000004F0000-memory.dmp

Filesize
1.1MB

Download
memory/2812-17-0x0000000000580000-0x000000000058C000-memory.dmp

Filesize
48KB

Download
memory/2812-16-0x0000000000560000-0x000000000056C000-memory.dmp

Filesize
48KB

Download
memory/2812-15-0x0000000000570000-0x000000000057C000-memory.dmp

Filesize
48KB

Download
memory/2812-14-0x00000000003D0000-0x00000000003E2000-memory.dmp

Filesize
72KB

Download
memory/2812-13-0x0000000000910000-0x0000000000A20000-memory.dmp

Filesize
1.1MB

Download
memory/2836-71-0x0000000002240000-0x0000000002248000-memory.dmp

Filesize
32KB

Download
memory/2836-70-0x000000001B470000-0x000000001B752000-memory.dmp

Filesize
2.9MB

Download
memory/2904-622-0x0000000000330000-0x0000000000342000-memory.dmp

Filesize
72KB

Download
memory/2960-106-0x000000001B720000-0x000000001BA02000-memory.dmp

Filesize
2.9MB

Download
memory/3016-51-0x0000000001DA0000-0x0000000001DA8000-memory.dmp

Filesize
32KB

Download
memory/3016-50-0x000000001B510000-0x000000001B7F2000-memory.dmp

Filesize
2.9MB

Download