dcrat | 93803a7cdae2d0211164d72f2543726e79c4686de821803be2b4923c13b6275a

Analysis

max time kernel
142s
max time network
138s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22-12-2024 20:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_93803a7cdae2d0211164d72f2543726e79c4686de821803be2b4923c13b6275a.exe
Size

1.3MB
MD5

ea23150ec14bdabd25f96c7c63d86a8e
SHA1

0669b7b9b49bb155d3829cff0ac0a06f0e527507
SHA256

93803a7cdae2d0211164d72f2543726e79c4686de821803be2b4923c13b6275a
SHA512

c06dda6be3bdd11b62a229819f07299bf5b65f58a50b528e87e9bf63f8d7d63c426129ab89a7a0c1a460bf6f55f2f46bd43e6caa76de9ba10eb34cd05646d988
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 51 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1924	3044	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	588	3044	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1020	3044	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2236	3044	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2200	3044	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1804	3044	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2204	3044	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2624	3044	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2880	3044	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2104	3044	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1980	3044	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1792	3044	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1756	3044	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2012	3044	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1984	3044	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2888	3044	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1632	3044	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2052	3044	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1788	3044	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2260	3044	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2940	3044	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3060	3044	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1004	3044	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	888	3044	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1960	3044	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2112	3044	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2412	3044	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1480	3044	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	276	3044	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	404	3044	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1056	3044	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2420	3044	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2168	3044	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1820	3044	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	676	3044	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	236	3044	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1356	3044	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2484	3044	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2544	3044	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	956	3044	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	568	3044	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2512	3044	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3032	3044	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1096	3044	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2436	3044	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2428	3044	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1740	3044	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1084	3044	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2064	3044	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2088	3044	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2788	3044	schtasks.exe	34

DCRat payload 8 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x00080000000156a6-12.dat	dcrat
behavioral1/memory/2732-13-0x0000000000230000-0x0000000000340000-memory.dmp	dcrat
behavioral1/memory/1852-65-0x0000000000B30000-0x0000000000C40000-memory.dmp	dcrat
behavioral1/memory/1340-208-0x00000000013A0000-0x00000000014B0000-memory.dmp	dcrat
behavioral1/memory/2576-387-0x0000000000060000-0x0000000000170000-memory.dmp	dcrat
behavioral1/memory/1004-447-0x0000000001220000-0x0000000001330000-memory.dmp	dcrat
behavioral1/memory/1816-507-0x00000000000C0000-0x00000000001D0000-memory.dmp	dcrat
behavioral1/memory/2116-568-0x0000000001200000-0x0000000001310000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 18 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2600	powershell.exe
2932	powershell.exe
2708	powershell.exe
2820	powershell.exe
2764	powershell.exe
1652	powershell.exe
2704	powershell.exe
2432	powershell.exe
2184	powershell.exe
2664	powershell.exe
2584	powershell.exe
3040	powershell.exe
2632	powershell.exe
1724	powershell.exe
2744	powershell.exe
2592	powershell.exe
3000	powershell.exe
2716	powershell.exe

Executes dropped EXE 11 IoCs

pid	Process
2732	DllCommonsvc.exe
1852	explorer.exe
1340	explorer.exe
532	explorer.exe
2536	explorer.exe
2576	explorer.exe
1004	explorer.exe
1816	explorer.exe
2116	explorer.exe
1084	explorer.exe
2772	explorer.exe

Loads dropped DLL 2 IoCs

pid	Process
2780	cmd.exe
2780	cmd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 10 IoCs

Web Service

T1102

flow	ioc
4	raw.githubusercontent.com
5	raw.githubusercontent.com
9	raw.githubusercontent.com
13	raw.githubusercontent.com
20	raw.githubusercontent.com
33	raw.githubusercontent.com
16	raw.githubusercontent.com
23	raw.githubusercontent.com
26	raw.githubusercontent.com
29	raw.githubusercontent.com

Drops file in Program Files directory 14 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Portable Devices\taskhost.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Mail\it-IT\42af1c969fbb7b	DllCommonsvc.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\7a0fd90576e088	DllCommonsvc.exe
File created	C:\Program Files (x86)\Google\Update\6cb0b6c459d5d3	DllCommonsvc.exe
File created	C:\Program Files\DVD Maker\it-IT\csrss.exe	DllCommonsvc.exe
File created	C:\Program Files\DVD Maker\it-IT\886983d96e3d3e	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\conhost.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\088424020bedd6	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft.NET\RedistList\088424020bedd6	DllCommonsvc.exe
File created	C:\Program Files (x86)\Google\Update\dwm.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Portable Devices\b75386f1303e64	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Mail\it-IT\audiodg.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft.NET\RedistList\conhost.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\explorer.exe	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_93803a7cdae2d0211164d72f2543726e79c4686de821803be2b4923c13b6275a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 51 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2012	schtasks.exe
1788	schtasks.exe
3060	schtasks.exe
1480	schtasks.exe
1820	schtasks.exe
2436	schtasks.exe
2104	schtasks.exe
2544	schtasks.exe
956	schtasks.exe
1096	schtasks.exe
2428	schtasks.exe
1792	schtasks.exe
1980	schtasks.exe
1756	schtasks.exe
1004	schtasks.exe
888	schtasks.exe
1960	schtasks.exe
1924	schtasks.exe
2412	schtasks.exe
1740	schtasks.exe
1084	schtasks.exe
1804	schtasks.exe
2260	schtasks.exe
2112	schtasks.exe
276	schtasks.exe
676	schtasks.exe
3032	schtasks.exe
2880	schtasks.exe
2420	schtasks.exe
2168	schtasks.exe
236	schtasks.exe
2512	schtasks.exe
2088	schtasks.exe
2052	schtasks.exe
2204	schtasks.exe
1984	schtasks.exe
2888	schtasks.exe
404	schtasks.exe
1056	schtasks.exe
1356	schtasks.exe
2788	schtasks.exe
1020	schtasks.exe
2236	schtasks.exe
2200	schtasks.exe
2624	schtasks.exe
1632	schtasks.exe
2940	schtasks.exe
2484	schtasks.exe
568	schtasks.exe
588	schtasks.exe
2064	schtasks.exe

Suspicious behavior: EnumeratesProcesses 31 IoCs

pid	Process
2732	DllCommonsvc.exe
2732	DllCommonsvc.exe
2732	DllCommonsvc.exe
2432	powershell.exe
2664	powershell.exe
3040	powershell.exe
2708	powershell.exe
2184	powershell.exe
2716	powershell.exe
2704	powershell.exe
3000	powershell.exe
1652	powershell.exe
1724	powershell.exe
2932	powershell.exe
2632	powershell.exe
2744	powershell.exe
2764	powershell.exe
2600	powershell.exe
2820	powershell.exe
2584	powershell.exe
2592	powershell.exe
1852	explorer.exe
1340	explorer.exe
532	explorer.exe
2536	explorer.exe
2576	explorer.exe
1004	explorer.exe
1816	explorer.exe
2116	explorer.exe
1084	explorer.exe
2772	explorer.exe

Suspicious use of AdjustPrivilegeToken 29 IoCs

description	pid	Process
Token: SeDebugPrivilege	2732	DllCommonsvc.exe
Token: SeDebugPrivilege	2432	powershell.exe
Token: SeDebugPrivilege	2664	powershell.exe
Token: SeDebugPrivilege	3040	powershell.exe
Token: SeDebugPrivilege	2708	powershell.exe
Token: SeDebugPrivilege	2184	powershell.exe
Token: SeDebugPrivilege	2716	powershell.exe
Token: SeDebugPrivilege	2704	powershell.exe
Token: SeDebugPrivilege	3000	powershell.exe
Token: SeDebugPrivilege	1652	powershell.exe
Token: SeDebugPrivilege	1724	powershell.exe
Token: SeDebugPrivilege	2932	powershell.exe
Token: SeDebugPrivilege	2632	powershell.exe
Token: SeDebugPrivilege	2744	powershell.exe
Token: SeDebugPrivilege	2764	powershell.exe
Token: SeDebugPrivilege	2600	powershell.exe
Token: SeDebugPrivilege	2820	powershell.exe
Token: SeDebugPrivilege	2584	powershell.exe
Token: SeDebugPrivilege	2592	powershell.exe
Token: SeDebugPrivilege	1852	explorer.exe
Token: SeDebugPrivilege	1340	explorer.exe
Token: SeDebugPrivilege	532	explorer.exe
Token: SeDebugPrivilege	2536	explorer.exe
Token: SeDebugPrivilege	2576	explorer.exe
Token: SeDebugPrivilege	1004	explorer.exe
Token: SeDebugPrivilege	1816	explorer.exe
Token: SeDebugPrivilege	2116	explorer.exe
Token: SeDebugPrivilege	1084	explorer.exe
Token: SeDebugPrivilege	2772	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2708 wrote to memory of 2684	2708	JaffaCakes118_93803a7cdae2d0211164d72f2543726e79c4686de821803be2b4923c13b6275a.exe	30
PID 2708 wrote to memory of 2684	2708	JaffaCakes118_93803a7cdae2d0211164d72f2543726e79c4686de821803be2b4923c13b6275a.exe	30
PID 2708 wrote to memory of 2684	2708	JaffaCakes118_93803a7cdae2d0211164d72f2543726e79c4686de821803be2b4923c13b6275a.exe	30
PID 2708 wrote to memory of 2684	2708	JaffaCakes118_93803a7cdae2d0211164d72f2543726e79c4686de821803be2b4923c13b6275a.exe	30
PID 2684 wrote to memory of 2780	2684	WScript.exe	31
PID 2684 wrote to memory of 2780	2684	WScript.exe	31
PID 2684 wrote to memory of 2780	2684	WScript.exe	31
PID 2684 wrote to memory of 2780	2684	WScript.exe	31
PID 2780 wrote to memory of 2732	2780	cmd.exe	33
PID 2780 wrote to memory of 2732	2780	cmd.exe	33
PID 2780 wrote to memory of 2732	2780	cmd.exe	33
PID 2780 wrote to memory of 2732	2780	cmd.exe	33
PID 2732 wrote to memory of 2716	2732	DllCommonsvc.exe	86
PID 2732 wrote to memory of 2716	2732	DllCommonsvc.exe	86
PID 2732 wrote to memory of 2716	2732	DllCommonsvc.exe	86
PID 2732 wrote to memory of 2744	2732	DllCommonsvc.exe	87
PID 2732 wrote to memory of 2744	2732	DllCommonsvc.exe	87
PID 2732 wrote to memory of 2744	2732	DllCommonsvc.exe	87
PID 2732 wrote to memory of 2932	2732	DllCommonsvc.exe	88
PID 2732 wrote to memory of 2932	2732	DllCommonsvc.exe	88
PID 2732 wrote to memory of 2932	2732	DllCommonsvc.exe	88
PID 2732 wrote to memory of 2704	2732	DllCommonsvc.exe	89
PID 2732 wrote to memory of 2704	2732	DllCommonsvc.exe	89
PID 2732 wrote to memory of 2704	2732	DllCommonsvc.exe	89
PID 2732 wrote to memory of 2708	2732	DllCommonsvc.exe	90
PID 2732 wrote to memory of 2708	2732	DllCommonsvc.exe	90
PID 2732 wrote to memory of 2708	2732	DllCommonsvc.exe	90
PID 2732 wrote to memory of 2432	2732	DllCommonsvc.exe	91
PID 2732 wrote to memory of 2432	2732	DllCommonsvc.exe	91
PID 2732 wrote to memory of 2432	2732	DllCommonsvc.exe	91
PID 2732 wrote to memory of 2592	2732	DllCommonsvc.exe	92
PID 2732 wrote to memory of 2592	2732	DllCommonsvc.exe	92
PID 2732 wrote to memory of 2592	2732	DllCommonsvc.exe	92
PID 2732 wrote to memory of 2820	2732	DllCommonsvc.exe	93
PID 2732 wrote to memory of 2820	2732	DllCommonsvc.exe	93
PID 2732 wrote to memory of 2820	2732	DllCommonsvc.exe	93
PID 2732 wrote to memory of 2184	2732	DllCommonsvc.exe	94
PID 2732 wrote to memory of 2184	2732	DllCommonsvc.exe	94
PID 2732 wrote to memory of 2184	2732	DllCommonsvc.exe	94
PID 2732 wrote to memory of 2764	2732	DllCommonsvc.exe	95
PID 2732 wrote to memory of 2764	2732	DllCommonsvc.exe	95
PID 2732 wrote to memory of 2764	2732	DllCommonsvc.exe	95
PID 2732 wrote to memory of 2664	2732	DllCommonsvc.exe	96
PID 2732 wrote to memory of 2664	2732	DllCommonsvc.exe	96
PID 2732 wrote to memory of 2664	2732	DllCommonsvc.exe	96
PID 2732 wrote to memory of 2584	2732	DllCommonsvc.exe	97
PID 2732 wrote to memory of 2584	2732	DllCommonsvc.exe	97
PID 2732 wrote to memory of 2584	2732	DllCommonsvc.exe	97
PID 2732 wrote to memory of 3040	2732	DllCommonsvc.exe	98
PID 2732 wrote to memory of 3040	2732	DllCommonsvc.exe	98
PID 2732 wrote to memory of 3040	2732	DllCommonsvc.exe	98
PID 2732 wrote to memory of 1652	2732	DllCommonsvc.exe	99
PID 2732 wrote to memory of 1652	2732	DllCommonsvc.exe	99
PID 2732 wrote to memory of 1652	2732	DllCommonsvc.exe	99
PID 2732 wrote to memory of 2600	2732	DllCommonsvc.exe	100
PID 2732 wrote to memory of 2600	2732	DllCommonsvc.exe	100
PID 2732 wrote to memory of 2600	2732	DllCommonsvc.exe	100
PID 2732 wrote to memory of 2632	2732	DllCommonsvc.exe	101
PID 2732 wrote to memory of 2632	2732	DllCommonsvc.exe	101
PID 2732 wrote to memory of 2632	2732	DllCommonsvc.exe	101
PID 2732 wrote to memory of 1724	2732	DllCommonsvc.exe	102
PID 2732 wrote to memory of 1724	2732	DllCommonsvc.exe	102
PID 2732 wrote to memory of 1724	2732	DllCommonsvc.exe	102
PID 2732 wrote to memory of 3000	2732	DllCommonsvc.exe	103

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_93803a7cdae2d0211164d72f2543726e79c4686de821803be2b4923c13b6275a.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_93803a7cdae2d0211164d72f2543726e79c4686de821803be2b4923c13b6275a.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2708
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2684
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2780
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2732
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2716
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\winlogon.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2744
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\My Documents\services.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2932
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\OSPPSVC.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2704
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Templates\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2708
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2432
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Documents\audiodg.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2592
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\Idle.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2820
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Portable Devices\taskhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2184
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2764
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Mail\it-IT\audiodg.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2664
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\conhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2584
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft.NET\RedistList\conhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3040
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\explorer.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1652
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Google\Update\dwm.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2600
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\explorer.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2632
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\DVD Maker\it-IT\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1724
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3000
    - - C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\explorer.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\explorer.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1852
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\aJcBxrOCPY.bat"
        6⤵
        
        PID:1412
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:2896
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\explorer.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\explorer.exe"
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1340
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\9EVEWoB6gn.bat"
        8⤵
        
        PID:2608
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:1652
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\explorer.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\explorer.exe"
        9⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:532
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\o4pIGJu18c.bat"
        10⤵
        
        PID:2092
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:2592
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\explorer.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\explorer.exe"
        11⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2536
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\IrGY9odMle.bat"
        12⤵
        
        PID:1776
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:1516
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\explorer.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\explorer.exe"
        13⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2576
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\WtKWrLEt72.bat"
        14⤵
        
        PID:1584
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        15⤵
        
        PID:2288
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\explorer.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\explorer.exe"
        15⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1004
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\AXFqcUy7ES.bat"
        16⤵
        
        PID:1492
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        17⤵
        
        PID:688
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\explorer.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\explorer.exe"
        17⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1816
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\I1IMKnnpZ2.bat"
        18⤵
        
        PID:1152
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        19⤵
        
        PID:2084
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\explorer.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\explorer.exe"
        19⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2116
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\UxOjVeUiuv.bat"
        20⤵
        
        PID:2300
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        21⤵
        
        PID:772
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\explorer.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\explorer.exe"
        21⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1084
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\eUivgxqvfs.bat"
        22⤵
        
        PID:2348
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        23⤵
        
        PID:2280
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\explorer.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\explorer.exe"
        23⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 9 /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 8 /tr "'C:\Users\Default\My Documents\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Users\Default\My Documents\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 10 /tr "'C:\Users\Default\My Documents\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 11 /tr "'C:\providercommon\OSPPSVC.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2204

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\providercommon\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 14 /tr "'C:\providercommon\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Users\Default\Templates\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Default\Templates\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Users\Default\Templates\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\providercommon\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\providercommon\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\providercommon\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 9 /tr "'C:\Users\Default\Documents\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Users\Default\Documents\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 11 /tr "'C:\Users\Default\Documents\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1788

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\MSOCache\All Users\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2260

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Portable Devices\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Portable Devices\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\MSOCache\All Users\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Mail\it-IT\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\it-IT\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:276

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Mail\it-IT\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2420

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2168

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Google\Update\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\Update\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Google\Update\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1096

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Program Files\DVD Maker\it-IT\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\DVD Maker\it-IT\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1740

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Program Files\DVD Maker\it-IT\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\providercommon\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\providercommon\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\providercommon\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5f190f545f555bcf9e2a4a30004a401a

SHA1
caa1f633c4f95d5864cebbddc0d43b884f48a312

SHA256
5f8f5133bc20c75abbeb234a9f8047fe274125d7a4e8f7657b4b5208f1ea86a7

SHA512
7467b34325d46fcd4560334b531747e918d1019004c18c38ef12d4101cec5517d5e52f8142c3e8bbdb5648eae5824111f954f3a94d473d96520fe7d553e715c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
198268ccf3e40147efbbb8df8599f192

SHA1
7e269b4611cf2acd9b672e1e382283f64b577043

SHA256
7491686a496cbf5cce826b9bbadd316800eca439f5de1519e1203f05e84b3473

SHA512
7f07236b55fcd4c3b3a8a2828eceaf49665664e808a2af70602e222f9dc6ca6ecf45b509724086b0e823d71fb60c967d30414c09e14630d0930abde0c649b3e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f164881ddfdf62c81add6803eb766fee

SHA1
d8c15d54962aad21f76af4f18447a4008aa881a2

SHA256
a2f292611da6ed04df074bdb0dc9fb68d1dda19feeb93696525fab5094ef6415

SHA512
0c94f4f8241ca37d93964b534fca8dfd447f0bba714728df540ba0491cc5b17090cb61b4fd73365798fea4ead2ab18c5b1e279a2fe4013e6b0fe1597b4f5b97f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
26fa2c6743c8386eb6efb6470360bfde

SHA1
3dd4a96e43c23b5f9e36e9060e279e8aa4d5350b

SHA256
4bd86887e3e37a4faac691721076ef9a7df0a4591252a7ce8b88f8b179d59d94

SHA512
07cc300d4d75f4dfc542fed15182eeca145a0e2985b551cf641078230c7c5879952c6c2a35735919f4d9ecd95bc839a48e2a9ab891841c1e326e9004dea0ab66

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1058fa92f8f60e2bcef24ace7975d467

SHA1
862058ddb2ba68a40c03fff64702988828c5b6a2

SHA256
7887c57d8ff0794336ef484c5fa2dbeedf8fdb647e921bf997678dd1410eb0c3

SHA512
e1adc7a8438066069917c95e218963c1bef060b0993f0dc5ca3549c40d4bd3f6cf14edd74f728ac1a09766b186a09621cc437ef54ac43c0dda985b0e1ffd51f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
14407287ded4dadd87eace83ee8514c6

SHA1
07399004cc9380d60dbf35d4553823539aa07e68

SHA256
2d1b2faca349639ceac74deeecb67d743f69e396c27ac52385a936329a96c596

SHA512
ac33b9a44842fba86e422c1586cafe8a56a715a4d12fd7a46b6d3222fee602c20c403cc95f26045d99c2cb3ea042bfab65caefef60275122da24fd8bf1bf5519

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a09892768cd92c931efe2322440ff428

SHA1
46d3f612add15472cd02482bed6d3bd590b44e77

SHA256
bfcdf21ab1f62557c5234e13cc59968a7c8cc03bc1bb72484d0c9091792886e5

SHA512
776e98e43a375819462824886aa7dd67e6971a44e06e100ffc2e338a7929f1415eee69a8b187d2a7e3bf65cde6a72d55c724abeecb38356c21608c90d6eb5ef4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
67a567189fb5694daf5b5078b4c3d0ef

SHA1
7ec5e9f54312a571f10868ccd9725c791fd663ba

SHA256
c16ac28a45e72694a46e527291c7f9c103c8c6f0c54db2f55ee14ef13301aa8e

SHA512
be4817a21918a593207160f9d78926b8ca000c0dade02d4622cf8f174e7a54bb4c9bca265f68060bf48cc551326f1d83c8947adab291f33b5ab23456fb4965a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\9EVEWoB6gn.bat

Filesize
235B

MD5
7952267257343ac1a3453f1070e5b36d

SHA1
ea2bc1dac53de85d9c189987a83753a170047591

SHA256
f46678ba3281b5c466ed1dabcb4b6ffca29ade10a1397731578c7efff15b1f5e

SHA512
90959d1f6daae41ebe4da2888e9e1acae8fab23f736c61e4ae1764cad5b8c8c2cc30de327c69e9aee7df5493f48f581309abcc29aec2c614ab5bbfb2bdc426fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\AXFqcUy7ES.bat

Filesize
235B

MD5
66bad1795355b9361598798f1bb0ea1e

SHA1
40b205372848192336398202fe85a8e92e38981e

SHA256
ddac082a2ad60dd75026a57e0e9973f5e4addc0ba4763080d3d03dd8975735dc

SHA512
fe0bfa4df460682041ab9a21efb9c1026bafb0b6c5a27a8b2226946443d625171198d15e243d27de9da6d31bbf5704706aaf1831426ae17b0dd4598606d8ab75

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9E83.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\I1IMKnnpZ2.bat

Filesize
235B

MD5
170b710678401a083e9c914c8ccbaa85

SHA1
36b4368e63a58f8f8e19452aec626c5b0b50eb03

SHA256
ef2577490ae01d9d0eb1e4289aa3ff98df53d545ee22fea42b14b554e8bd9588

SHA512
c04c1639723d422f3e81e405b80292e6bb303e2ccebd666cd480af9e87ecf454ec5ab1f05954ad7e7f8ec5e33f2c43188070d17d23059729260ff7ddb0bd748c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IrGY9odMle.bat

Filesize
235B

MD5
d37a48f2bbfa6b2ceb5a0dead78dd476

SHA1
f861f3b93dde194c2ffa81c52138d4d3332d245c

SHA256
81ea9abd3c013ad19b7548ccee8371cb510da0a607029e3facacf774230b907b

SHA512
aff47d0d07c72a95f02646c9057c7c8c8dcb592101d00ffbf6331a394479f5180d3b1b2c2b7bb9bd5fdc16abd039805aec60b7e2c155e3483e4a315465e30219

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9E95.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\UxOjVeUiuv.bat

Filesize
235B

MD5
a4753fe50174bab66333e22bdcb938a0

SHA1
f412849f397509f93cde06a3c6f4c23062976c8a

SHA256
9642bedaf342183cf8a7166fee72d57c4f553957cfe739cc9699346bf9fba2b4

SHA512
7bd4610196a5c64049a69044bf314bdbf126dd2ec714563c7e411ca2571d950ebd7ffcc588a6a2aa1b1b97b198655c60c9a8f6c4440f4e01778753f0e6019f42

Download Submit
C:\Users\Admin\AppData\Local\Temp\WtKWrLEt72.bat

Filesize
235B

MD5
1b3044f9f1670ab4d2f343041dbfaf92

SHA1
a1a97169476d06883755a23ce53cbdbe4199883f

SHA256
9314407ad02f9c6ed00c3f60e1ea4dbf3348e8ef7b354e8f419687dc246b6f0c

SHA512
83766c773184d1801cd452e35e568f5711692649eff4b3b7154cf202d3324e586141f3347ddbffaee900259331fd6e9069b679d56d64734d55921e4521fc14b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\aJcBxrOCPY.bat

Filesize
235B

MD5
e79c7b9d8535effdc91b44abc58b8845

SHA1
bb4cfeb541302daf4ccf04a19022a9feb75bff9d

SHA256
6d1414c9600b02258b31045d03372bd4f5b2a9a24091aa2ef93339c5d25e7342

SHA512
8ed10b6f8273967c71cbec4fb2462bed686af32b091a965c186f4162b286eb44597a7324ae778faf9def1b3dfd0909b273b814dd2104f384b30974c0ffb6af82

Download Submit
C:\Users\Admin\AppData\Local\Temp\eUivgxqvfs.bat

Filesize
235B

MD5
ac5411bcf3389373c110e6be780186d1

SHA1
9ace34d20d0b274cf02698c854a775046a3079ac

SHA256
8847da2a24a500bd8801b6f3b798dda7185017ba72886cc83195a083ba3d571c

SHA512
8c188fc174398ff33b6a9b3b38a13593348914676dc24ac475d1f98409536697618e0348e5aa14c69f57fc3307839ba494c36f4f9cd0a1baa49656d9940d413f

Download Submit
C:\Users\Admin\AppData\Local\Temp\o4pIGJu18c.bat

Filesize
235B

MD5
d7cd845fc9b84fdf12dd9e1e64cd9eab

SHA1
2639701b3a7e0f7cf7d2f5f8e7ee4821db9a8468

SHA256
0b739572da8543e40956272a0deccc469a224bdf1c897c9929aeb469a6208d86

SHA512
8ed887e7e2b1990c37a7269dc7b455c70aa020607b6c7666069004f81ee9713c25036abeb12ebbd5c4e153ba5447cf481f7085553343234f0cc6175275979833

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
9ef32c7d594af157f9b86b18a2e011db

SHA1
84d24bdac7cba109c1fba79684606372590b6106

SHA256
fed6d7cc8d26ec397c7ad5fafc87cfc914f00e9bd7112e6655c7fd249f16558c

SHA512
48d1b7d680e94c5e544a3b97a78f88216402f92a81eaae19d7cc96f6cb2558fc512b3c98c20cb56ac990d553647b28642f215fd0c78134d9a378e236f54efeb9

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/1004-447-0x0000000001220000-0x0000000001330000-memory.dmp

Filesize
1.1MB

Download
memory/1340-208-0x00000000013A0000-0x00000000014B0000-memory.dmp

Filesize
1.1MB

Download
memory/1816-508-0x00000000003F0000-0x0000000000402000-memory.dmp

Filesize
72KB

Download
memory/1816-507-0x00000000000C0000-0x00000000001D0000-memory.dmp

Filesize
1.1MB

Download
memory/1852-65-0x0000000000B30000-0x0000000000C40000-memory.dmp

Filesize
1.1MB

Download
memory/2116-568-0x0000000001200000-0x0000000001310000-memory.dmp

Filesize
1.1MB

Download
memory/2432-63-0x000000001B6F0000-0x000000001B9D2000-memory.dmp

Filesize
2.9MB

Download
memory/2432-64-0x0000000002760000-0x0000000002768000-memory.dmp

Filesize
32KB

Download
memory/2536-327-0x00000000003D0000-0x00000000003E2000-memory.dmp

Filesize
72KB

Download
memory/2576-387-0x0000000000060000-0x0000000000170000-memory.dmp

Filesize
1.1MB

Download
memory/2732-13-0x0000000000230000-0x0000000000340000-memory.dmp

Filesize
1.1MB

Download
memory/2732-14-0x0000000000360000-0x0000000000372000-memory.dmp

Filesize
72KB

Download
memory/2732-15-0x0000000000470000-0x000000000047C000-memory.dmp

Filesize
48KB

Download
memory/2732-17-0x0000000000490000-0x000000000049C000-memory.dmp

Filesize
48KB

Download
memory/2732-16-0x0000000000480000-0x000000000048C000-memory.dmp

Filesize
48KB

Download