dcrat | 6e9cfcb0f3e0533021bb247e7e567f1693fd685f21d1a5e2d77caf14e769fbdc

Analysis

max time kernel
147s
max time network
154s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
22-12-2024 20:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_6e9cfcb0f3e0533021bb247e7e567f1693fd685f21d1a5e2d77caf14e769fbdc.exe
Size

1.3MB
MD5

cce749eacd4064043cc19ef974e29730
SHA1

e9599abdde767af6ff59f18d0738f8d0653d4116
SHA256

6e9cfcb0f3e0533021bb247e7e567f1693fd685f21d1a5e2d77caf14e769fbdc
SHA512

fea61aa3daf05ace962db08396a0970fa352d2fa5ad365c6592c764e6dd890c7767762a0fadb69cef39b431d5399877ef4c255ae9cd3cffafec31d0c634c28d8
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 48 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2760	2628	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2356	2628	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2784	2628	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	752	2628	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2720	2628	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1600	2628	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2184	2628	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2648	2628	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2352	2628	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3016	2628	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1868	2628	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3056	2628	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3004	2628	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2028	2628	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1872	2628	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2264	2628	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2568	2628	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2296	2628	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1248	2628	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1708	2628	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2472	2628	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2292	2628	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2440	2628	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2492	2628	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1644	2628	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2496	2628	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2456	2628	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2064	2628	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	960	2628	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	708	2628	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2640	2628	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1308	2628	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1224	2628	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1916	2628	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2144	2628	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	932	2628	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2388	2628	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	612	2628	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1616	2628	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2376	2628	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	948	2628	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2824	2628	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2692	2628	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2208	2628	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1004	2628	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1724	2628	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2664	2628	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1584	2628	schtasks.exe	34

DCRat payload 7 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0008000000016fc9-9.dat	dcrat
behavioral1/memory/2952-13-0x0000000000980000-0x0000000000A90000-memory.dmp	dcrat
behavioral1/memory/1704-140-0x0000000000280000-0x0000000000390000-memory.dmp	dcrat
behavioral1/memory/1744-199-0x00000000010C0000-0x00000000011D0000-memory.dmp	dcrat
behavioral1/memory/2356-259-0x00000000000B0000-0x00000000001C0000-memory.dmp	dcrat
behavioral1/memory/2148-319-0x0000000000C20000-0x0000000000D30000-memory.dmp	dcrat
behavioral1/memory/2424-557-0x0000000000DF0000-0x0000000000F00000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 17 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2140	powershell.exe
2240	powershell.exe
2220	powershell.exe
2124	powershell.exe
2212	powershell.exe
2276	powershell.exe
2928	powershell.exe
1684	powershell.exe
2944	powershell.exe
576	powershell.exe
2932	powershell.exe
2936	powershell.exe
1820	powershell.exe
2980	powershell.exe
2460	powershell.exe
2260	powershell.exe
864	powershell.exe

Executes dropped EXE 9 IoCs

pid	Process
2952	DllCommonsvc.exe
1704	wininit.exe
1744	wininit.exe
2356	wininit.exe
2148	wininit.exe
3044	wininit.exe
1700	wininit.exe
1724	wininit.exe
2424	wininit.exe

Loads dropped DLL 2 IoCs

pid	Process
2960	cmd.exe
2960	cmd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 10 IoCs

Web Service

T1102

flow	ioc
20	raw.githubusercontent.com
26	raw.githubusercontent.com
9	raw.githubusercontent.com
12	raw.githubusercontent.com
16	raw.githubusercontent.com
17	raw.githubusercontent.com
4	raw.githubusercontent.com
5	raw.githubusercontent.com
23	raw.githubusercontent.com
30	raw.githubusercontent.com

Drops file in Program Files directory 13 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\Idle.exe	DllCommonsvc.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\Idle.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\6ccacd8608530f	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows NT\TableTextService\dllhost.exe	DllCommonsvc.exe
File created	C:\Program Files\Microsoft Office\Office14\System.exe	DllCommonsvc.exe
File created	C:\Program Files\Microsoft Office\Office14\27d1bcfc3c54e0	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Mail\ja-JP\7a0fd90576e088	DllCommonsvc.exe
File created	C:\Program Files\Windows Photo Viewer\de-DE\audiodg.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Photo Viewer\de-DE\42af1c969fbb7b	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows NT\TableTextService\5940a34987c991	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Mail\ja-JP\explorer.exe	DllCommonsvc.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\audiodg.exe	DllCommonsvc.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\42af1c969fbb7b	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_6e9cfcb0f3e0533021bb247e7e567f1693fd685f21d1a5e2d77caf14e769fbdc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 48 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1224	schtasks.exe
1916	schtasks.exe
2376	schtasks.exe
2692	schtasks.exe
3016	schtasks.exe
2472	schtasks.exe
2440	schtasks.exe
2492	schtasks.exe
2208	schtasks.exe
2568	schtasks.exe
1248	schtasks.exe
1644	schtasks.exe
1308	schtasks.exe
2760	schtasks.exe
2352	schtasks.exe
2028	schtasks.exe
1872	schtasks.exe
2144	schtasks.exe
1004	schtasks.exe
1600	schtasks.exe
2184	schtasks.exe
948	schtasks.exe
1584	schtasks.exe
1708	schtasks.exe
612	schtasks.exe
2824	schtasks.exe
2664	schtasks.exe
2356	schtasks.exe
2784	schtasks.exe
2648	schtasks.exe
3004	schtasks.exe
2496	schtasks.exe
2456	schtasks.exe
1724	schtasks.exe
2264	schtasks.exe
2296	schtasks.exe
2064	schtasks.exe
960	schtasks.exe
2388	schtasks.exe
1616	schtasks.exe
3056	schtasks.exe
2292	schtasks.exe
708	schtasks.exe
2640	schtasks.exe
752	schtasks.exe
2720	schtasks.exe
1868	schtasks.exe
932	schtasks.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
2952	DllCommonsvc.exe
2952	DllCommonsvc.exe
2952	DllCommonsvc.exe
2932	powershell.exe
2276	powershell.exe
2980	powershell.exe
2124	powershell.exe
1684	powershell.exe
2260	powershell.exe
2220	powershell.exe
2936	powershell.exe
1820	powershell.exe
2928	powershell.exe
2212	powershell.exe
576	powershell.exe
2240	powershell.exe
864	powershell.exe
2944	powershell.exe
2460	powershell.exe
2140	powershell.exe
1704	wininit.exe
1744	wininit.exe
2356	wininit.exe
2148	wininit.exe
3044	wininit.exe
1700	wininit.exe
1724	wininit.exe
2424	wininit.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: SeDebugPrivilege	2952	DllCommonsvc.exe
Token: SeDebugPrivilege	2932	powershell.exe
Token: SeDebugPrivilege	2276	powershell.exe
Token: SeDebugPrivilege	2980	powershell.exe
Token: SeDebugPrivilege	2124	powershell.exe
Token: SeDebugPrivilege	1684	powershell.exe
Token: SeDebugPrivilege	2260	powershell.exe
Token: SeDebugPrivilege	2220	powershell.exe
Token: SeDebugPrivilege	2936	powershell.exe
Token: SeDebugPrivilege	1820	powershell.exe
Token: SeDebugPrivilege	2928	powershell.exe
Token: SeDebugPrivilege	2212	powershell.exe
Token: SeDebugPrivilege	576	powershell.exe
Token: SeDebugPrivilege	2240	powershell.exe
Token: SeDebugPrivilege	864	powershell.exe
Token: SeDebugPrivilege	2944	powershell.exe
Token: SeDebugPrivilege	2460	powershell.exe
Token: SeDebugPrivilege	2140	powershell.exe
Token: SeDebugPrivilege	1704	wininit.exe
Token: SeDebugPrivilege	1744	wininit.exe
Token: SeDebugPrivilege	2356	wininit.exe
Token: SeDebugPrivilege	2148	wininit.exe
Token: SeDebugPrivilege	3044	wininit.exe
Token: SeDebugPrivilege	1700	wininit.exe
Token: SeDebugPrivilege	1724	wininit.exe
Token: SeDebugPrivilege	2424	wininit.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1820 wrote to memory of 2260	1820	JaffaCakes118_6e9cfcb0f3e0533021bb247e7e567f1693fd685f21d1a5e2d77caf14e769fbdc.exe	30
PID 1820 wrote to memory of 2260	1820	JaffaCakes118_6e9cfcb0f3e0533021bb247e7e567f1693fd685f21d1a5e2d77caf14e769fbdc.exe	30
PID 1820 wrote to memory of 2260	1820	JaffaCakes118_6e9cfcb0f3e0533021bb247e7e567f1693fd685f21d1a5e2d77caf14e769fbdc.exe	30
PID 1820 wrote to memory of 2260	1820	JaffaCakes118_6e9cfcb0f3e0533021bb247e7e567f1693fd685f21d1a5e2d77caf14e769fbdc.exe	30
PID 2260 wrote to memory of 2960	2260	WScript.exe	31
PID 2260 wrote to memory of 2960	2260	WScript.exe	31
PID 2260 wrote to memory of 2960	2260	WScript.exe	31
PID 2260 wrote to memory of 2960	2260	WScript.exe	31
PID 2960 wrote to memory of 2952	2960	cmd.exe	33
PID 2960 wrote to memory of 2952	2960	cmd.exe	33
PID 2960 wrote to memory of 2952	2960	cmd.exe	33
PID 2960 wrote to memory of 2952	2960	cmd.exe	33
PID 2952 wrote to memory of 2140	2952	DllCommonsvc.exe	83
PID 2952 wrote to memory of 2140	2952	DllCommonsvc.exe	83
PID 2952 wrote to memory of 2140	2952	DllCommonsvc.exe	83
PID 2952 wrote to memory of 1684	2952	DllCommonsvc.exe	84
PID 2952 wrote to memory of 1684	2952	DllCommonsvc.exe	84
PID 2952 wrote to memory of 1684	2952	DllCommonsvc.exe	84
PID 2952 wrote to memory of 2240	2952	DllCommonsvc.exe	85
PID 2952 wrote to memory of 2240	2952	DllCommonsvc.exe	85
PID 2952 wrote to memory of 2240	2952	DllCommonsvc.exe	85
PID 2952 wrote to memory of 2932	2952	DllCommonsvc.exe	86
PID 2952 wrote to memory of 2932	2952	DllCommonsvc.exe	86
PID 2952 wrote to memory of 2932	2952	DllCommonsvc.exe	86
PID 2952 wrote to memory of 2124	2952	DllCommonsvc.exe	88
PID 2952 wrote to memory of 2124	2952	DllCommonsvc.exe	88
PID 2952 wrote to memory of 2124	2952	DllCommonsvc.exe	88
PID 2952 wrote to memory of 2220	2952	DllCommonsvc.exe	89
PID 2952 wrote to memory of 2220	2952	DllCommonsvc.exe	89
PID 2952 wrote to memory of 2220	2952	DllCommonsvc.exe	89
PID 2952 wrote to memory of 1820	2952	DllCommonsvc.exe	91
PID 2952 wrote to memory of 1820	2952	DllCommonsvc.exe	91
PID 2952 wrote to memory of 1820	2952	DllCommonsvc.exe	91
PID 2952 wrote to memory of 576	2952	DllCommonsvc.exe	93
PID 2952 wrote to memory of 576	2952	DllCommonsvc.exe	93
PID 2952 wrote to memory of 576	2952	DllCommonsvc.exe	93
PID 2952 wrote to memory of 2460	2952	DllCommonsvc.exe	94
PID 2952 wrote to memory of 2460	2952	DllCommonsvc.exe	94
PID 2952 wrote to memory of 2460	2952	DllCommonsvc.exe	94
PID 2952 wrote to memory of 2276	2952	DllCommonsvc.exe	95
PID 2952 wrote to memory of 2276	2952	DllCommonsvc.exe	95
PID 2952 wrote to memory of 2276	2952	DllCommonsvc.exe	95
PID 2952 wrote to memory of 2212	2952	DllCommonsvc.exe	96
PID 2952 wrote to memory of 2212	2952	DllCommonsvc.exe	96
PID 2952 wrote to memory of 2212	2952	DllCommonsvc.exe	96
PID 2952 wrote to memory of 2980	2952	DllCommonsvc.exe	97
PID 2952 wrote to memory of 2980	2952	DllCommonsvc.exe	97
PID 2952 wrote to memory of 2980	2952	DllCommonsvc.exe	97
PID 2952 wrote to memory of 2260	2952	DllCommonsvc.exe	98
PID 2952 wrote to memory of 2260	2952	DllCommonsvc.exe	98
PID 2952 wrote to memory of 2260	2952	DllCommonsvc.exe	98
PID 2952 wrote to memory of 2936	2952	DllCommonsvc.exe	99
PID 2952 wrote to memory of 2936	2952	DllCommonsvc.exe	99
PID 2952 wrote to memory of 2936	2952	DllCommonsvc.exe	99
PID 2952 wrote to memory of 2944	2952	DllCommonsvc.exe	101
PID 2952 wrote to memory of 2944	2952	DllCommonsvc.exe	101
PID 2952 wrote to memory of 2944	2952	DllCommonsvc.exe	101
PID 2952 wrote to memory of 864	2952	DllCommonsvc.exe	103
PID 2952 wrote to memory of 864	2952	DllCommonsvc.exe	103
PID 2952 wrote to memory of 864	2952	DllCommonsvc.exe	103
PID 2952 wrote to memory of 2928	2952	DllCommonsvc.exe	105
PID 2952 wrote to memory of 2928	2952	DllCommonsvc.exe	105
PID 2952 wrote to memory of 2928	2952	DllCommonsvc.exe	105
PID 2952 wrote to memory of 2720	2952	DllCommonsvc.exe	117

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6e9cfcb0f3e0533021bb247e7e567f1693fd685f21d1a5e2d77caf14e769fbdc.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6e9cfcb0f3e0533021bb247e7e567f1693fd685f21d1a5e2d77caf14e769fbdc.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1820
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2260
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2960
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2952
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2140
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\Idle.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1684
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Photo Viewer\de-DE\audiodg.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2240
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\wininit.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2932
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\OSPPSVC.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2124
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\OSPPSVC.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2220
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\wininit.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1820
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows NT\TableTextService\dllhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:576
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\smss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2460
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\smss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2276
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\winlogon.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2212
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Microsoft Office\Office14\System.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2980
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\Idle.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2260
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Mail\ja-JP\explorer.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2936
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\sppsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2944
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\audiodg.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:864
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Favorites\Idle.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2928
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\JmnsDPSvSt.bat"
        5⤵
        
        PID:2720
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:936
      - C:\providercommon\wininit.exe
        
        "C:\providercommon\wininit.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1704
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\1F0LTC0kP2.bat"
        7⤵
        
        PID:2352
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:1160
        
        C:\providercommon\wininit.exe
        
        "C:\providercommon\wininit.exe"
        8⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1744
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\rcE1qBYVKA.bat"
        9⤵
        
        PID:1196
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:1156
        
        C:\providercommon\wininit.exe
        
        "C:\providercommon\wininit.exe"
        10⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2356
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\FIx4sKIZfl.bat"
        11⤵
        
        PID:1584
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:2420
        
        C:\providercommon\wininit.exe
        
        "C:\providercommon\wininit.exe"
        12⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2148
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\tbw0avzYF4.bat"
        13⤵
        
        PID:2920
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        14⤵
        
        PID:2504
        
        C:\providercommon\wininit.exe
        
        "C:\providercommon\wininit.exe"
        14⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3044
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\kp2dTY47HA.bat"
        15⤵
        
        PID:2220
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        16⤵
        
        PID:2940
        
        C:\providercommon\wininit.exe
        
        "C:\providercommon\wininit.exe"
        16⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1700
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\TmtjCtAJTq.bat"
        17⤵
        
        PID:2252
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        18⤵
        
        PID:2584
        
        C:\providercommon\wininit.exe
        
        "C:\providercommon\wininit.exe"
        18⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1724
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\6SU00hIhBO.bat"
        19⤵
        
        PID:2572
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        20⤵
        
        PID:2052
        
        C:\providercommon\wininit.exe
        
        "C:\providercommon\wininit.exe"
        20⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2424

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Photo Viewer\de-DE\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\de-DE\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Photo Viewer\de-DE\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 11 /tr "'C:\providercommon\OSPPSVC.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\providercommon\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 5 /tr "'C:\providercommon\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 11 /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\OSPPSVC.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 12 /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\providercommon\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2264

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\providercommon\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\providercommon\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2296

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\TableTextService\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 8 /tr "'C:\providercommon\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\providercommon\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2440

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 9 /tr "'C:\providercommon\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\MSOCache\All Users\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2456

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 5 /tr "'C:\Program Files\Microsoft Office\Office14\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\Office14\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 8 /tr "'C:\Program Files\Microsoft Office\Office14\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 10 /tr "'C:\Users\Default User\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Users\Default User\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 7 /tr "'C:\Users\Default User\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Mail\ja-JP\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\ja-JP\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Mail\ja-JP\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 7 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 8 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 9 /tr "'C:\Users\Public\Favorites\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Users\Public\Favorites\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\Users\Public\Favorites\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c4840e591ee77f5310a96516dfe1b774

SHA1
ba2f97a3c984ca09488f8f98e6e53a9ef6f8c947

SHA256
5a478b998af060e825a066acef30b7f0efde5e1e74bcaa60a4aca37d1aa47277

SHA512
cfb4fd874940739a65f46da469ffe75dc7d01be9232fa3850a90f8dab213f98bf5ba769c0103334bddd4cff8bad755a46d8c0e308505175ca7de17fe5573c519

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5d714588491767edc8ef7eab6b0e6193

SHA1
5c83e15f1a0ff13d5dfe43d55f414744ac4e7b1c

SHA256
cf32c7ed15d4883aa59e30df14562227c5ebeef61eabed5516577b1f73fda70e

SHA512
fed18869d0402a455617f49228024ae51067eac5bc25f4b89fa67fb8982aa3f5c27acebea1eff8c304fd0ec9913bae8804d37e90a78710b19ca5320e5ec14e65

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
728af89e5dc5147c57a2cb28b15c871d

SHA1
801a6b88b2fac1d62c10fe363bcbf922e25310f1

SHA256
4ccd84a7c8076839eff33d1189779e28626f933105e1cfa84761e7362b45fac9

SHA512
b4e7ae36b77a71ca68c9c0d72b77b47cc995a31800e2b2eee0d1c1186d33842691004407c12c0ee336112cb678570849a2104a01c9aafbbbe3140227d7f648b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2206d059052e190faca9007683ac2536

SHA1
58d3bc723232969df368a9bdca92964cf37fdaaf

SHA256
8f69d6e144a694aa1787b6d0991da37534bf68b821febb9dcb7ea77d26c7afb4

SHA512
99d685b439099d5a1e473d49e5f645253b8d5797c962044b106ff4a64102179eb624362809364f6b27733e0a322daf8502c3d7dac49ee831f441d45feaf5f55e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f6993a6d1b171b0aaad37bd3f09209c8

SHA1
2fab040759c6f67808f90aaaf177f0af19109557

SHA256
cf1cdce272dd707b62de029a5cff7eddb587b0267ac02a3f2363d7b62626bcde

SHA512
61a32dd7e995104848d9807f569aecf7fec40340a69bcfd18c1c96fd8af245f206ac96316fc6f28876242fee85e467abe2b0245a4d1ad001722297e3b98b6e5d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d4cb9b8b83b2c3724d1201e997f65a08

SHA1
14129cf721b54ba58008a61af7c836b9565d012b

SHA256
6db84166004b9a50c25d4b331429af03c4765bf8a2ad1f88fbc47d2a1dfec6d3

SHA512
68de1374f3fa77f8cb9d64f61ada56829d54b2bf418d2c828b10cadcb1493430c1a364a41ea4a7f6094468f5884f93e793bafab5855daddc5cb619ce5ff409c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
25fffa99e7d033bab66f2ecc377907ff

SHA1
853ec5db9ce69aca9a43216195c917b11be0c2e9

SHA256
6acd9d6275ac0d69ccf93d262928ce1f4935868e5bdcf6d1ed7ad0037ef19466

SHA512
c287604905ed094bd07036f7a739acef0cec80851b4d765a9cf3bafa8456a044a10158e45d8ff6edcd485499e484514bab8e1e85d617970cbf7737667dd88d56

Download Submit
C:\Users\Admin\AppData\Local\Temp\1F0LTC0kP2.bat

Filesize
194B

MD5
ee9bac347d1026f8b3ca4212ae6595ee

SHA1
45a9c23d8ac93806bd7943a0cb5a49e14ca4e8c0

SHA256
73dc09a5d5c0be96ca89af523c5b3376bb45c7f0a522798e35180aaa3f893a8c

SHA512
66713d582e8499450a6ee9ebf67680ea2e0e448b288dca62cfec44aa0c369c9aaa9281c051949800e6af82797d1b95cf81fbbf07a1b8ee52ae9da158c3375d21

Download Submit
C:\Users\Admin\AppData\Local\Temp\6SU00hIhBO.bat

Filesize
194B

MD5
e40f3c02f5b9ca1d34e81c16d9c59384

SHA1
b13ea66e9fee61766fb6634ccc05be69bf4b589b

SHA256
d0724692cf2be0e58267f38bb62e5a71a7ce90b89c06d5cff5ac02d88cc43b6a

SHA512
d2f28baeb03c50978584dc90f50a87b8d7febded7a7dbd4d74c9611e7a64c08ae05ba7baa0d30fc9e32dc393d1d8c52250fc6ebdbd7c5edb2f7754ac1bfef59d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3584.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\FIx4sKIZfl.bat

Filesize
194B

MD5
8ec614d496b8bf607fb64ecec41ae062

SHA1
b3c7159090a0d0b555450556ed02343f870a1133

SHA256
5a41ac185d9b1f1958d5fbb81c2c836b912a27f0949dcdf6a53568cb82b5d120

SHA512
82271430489bf3092acccb551ff6f32f1254c4114c76dc8ade6205bf05f749b2d165c96e0b9a613db76f4aea43994075337e350851f83d67a34ecf5429273ca4

Download Submit
C:\Users\Admin\AppData\Local\Temp\JmnsDPSvSt.bat

Filesize
194B

MD5
74c9637f274e1f916cd362b5add2205b

SHA1
7fe8f4ab3c5264a8575883c3acb62780a59c4570

SHA256
d9b601006bea34374642f39d8e8e834c198cbc912c070d6168d8c88d597c16c5

SHA512
5b9473698ab20c5dde8e0271fa8123fd412a532a68a38d3a3e5b11a349c3c60ca07c049f471c34b5672dfcb2004a38858b134f8e72b7944c1a44175b9a3451c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar35D5.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmtjCtAJTq.bat

Filesize
194B

MD5
2a5e855f20fb604a0bc644d139df1685

SHA1
08737a4deda12ece088c73cfda7e4cf60dca7885

SHA256
ad64ec9d88578505c5fce0eefb876416955ec774821449151939164f383c59ae

SHA512
b58fc9ae6aedb63128070817bc3c81999e2616c1bcda31674cff4892c437aaabf357fff0b24ae967e0a580b2e859d884c9b53a8c430f8f80521260ddd196d72a

Download Submit
C:\Users\Admin\AppData\Local\Temp\kp2dTY47HA.bat

Filesize
194B

MD5
5681bc5f2a12099a3a18297f3ffb567f

SHA1
44c5d66ee5cee3bc7820529046f31f9a4e00a2a1

SHA256
c58c52599903591778d5c3a28767b09f807a4e598dfe999ed476b7470de7b83c

SHA512
986326b1ddf7649a8bcb4d5cc487f4dd09c421ca4f76681c168f0bc7770660ebe97ed22af1d70a8735c4848aaab4cfd7500c15a374ce501d0a6c1656b36fad60

Download Submit
C:\Users\Admin\AppData\Local\Temp\rcE1qBYVKA.bat

Filesize
194B

MD5
6c6c023265158bbc701eb95313fd38a0

SHA1
80b2adc67f38e6097b2424689c76d2f269608a10

SHA256
e07b6c640b2685582f8d551a6c24047f7cc5c0ce0bd0b2dca787902d56465368

SHA512
ebd1a2c7ef82f0e55987316349849da853de467e5c73672039dbcdfd8f706216d520a5274f07da34574aed7a87312fd53210778202bb4a53d92d54ae98c76963

Download Submit
C:\Users\Admin\AppData\Local\Temp\tbw0avzYF4.bat

Filesize
194B

MD5
6df8d8529fc5df1632922d0b0643fffd

SHA1
5a739daeb5b461065f75d67a7af6f4ade1188b3c

SHA256
7319c4ddc8b1f9cc1759668fcbf35940108e264ab492c75e6ef5ecb914ccda7c

SHA512
509e5ed6c0350f19b2172b7fb13f63e6c73dd1e86d6d11cd16863ff3384748ac92ca7f2e5b153fab4c585d796c18e44968798ccc5193f70d6c3573a59bc87c58

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\JSBB5RDN6DN4LCIWT2YI.temp

Filesize
7KB

MD5
7e9b7defb13a4251ae747de923ab5759

SHA1
0a99a722d7ee37a310508cef625e6480f9eb7b0d

SHA256
39141e123975429977d015a43ecd6deb96cd2554d70e9fc3c5a1aa0e0181b7c8

SHA512
80ca020e83964d56ea82254d3dfa6b11861f858bfe031abb73c6c0fea02ae1f627a0572ab28f93c1a6b8249f91fedc6e95ea5ae7e7789ee05187ac7a8884e25b

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
memory/1704-140-0x0000000000280000-0x0000000000390000-memory.dmp

Filesize
1.1MB

Download
memory/1724-497-0x0000000000440000-0x0000000000452000-memory.dmp

Filesize
72KB

Download
memory/1744-199-0x00000000010C0000-0x00000000011D0000-memory.dmp

Filesize
1.1MB

Download
memory/2148-319-0x0000000000C20000-0x0000000000D30000-memory.dmp

Filesize
1.1MB

Download
memory/2356-259-0x00000000000B0000-0x00000000001C0000-memory.dmp

Filesize
1.1MB

Download
memory/2424-557-0x0000000000DF0000-0x0000000000F00000-memory.dmp

Filesize
1.1MB

Download
memory/2932-65-0x00000000022F0000-0x00000000022F8000-memory.dmp

Filesize
32KB

Download
memory/2932-63-0x000000001B260000-0x000000001B542000-memory.dmp

Filesize
2.9MB

Download
memory/2952-16-0x00000000003F0000-0x00000000003FC000-memory.dmp

Filesize
48KB

Download
memory/2952-13-0x0000000000980000-0x0000000000A90000-memory.dmp

Filesize
1.1MB

Download
memory/2952-14-0x00000000003D0000-0x00000000003E2000-memory.dmp

Filesize
72KB

Download
memory/2952-15-0x00000000003E0000-0x00000000003EC000-memory.dmp

Filesize
48KB

Download
memory/2952-17-0x0000000000490000-0x000000000049C000-memory.dmp

Filesize
48KB

Download