dcrat | 02a08316901022785b6eafefdc8ab497a0e63b9025da8bc9bbe16bd927cff394

Analysis

max time kernel
146s
max time network
150s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
23-12-2024 12:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_02a08316901022785b6eafefdc8ab497a0e63b9025da8bc9bbe16bd927cff394.exe
Size

1.3MB
MD5

e8f690f83c953e178fd0fde513b01196
SHA1

6b147e9f76b3542f69075ca6672efa251a2c3449
SHA256

02a08316901022785b6eafefdc8ab497a0e63b9025da8bc9bbe16bd927cff394
SHA512

43ba3f272ef37cf2a992195de2a0ec7607e51c2227334db3ae0b9b19320508ff20d76de9dfbae9a2db06d6c54e560e0ab0ae48da8c5b18c8ebc22a5ebaeda4b4
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 51 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2712	3052	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3000	3052	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2816	3052	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2728	3052	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2680	3052	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2724	3052	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2720	3052	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2116	3052	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1144	3052	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1496	3052	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1196	3052	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1328	3052	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2944	3052	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2368	3052	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1096	3052	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2056	3052	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1660	3052	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2988	3052	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2776	3052	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2960	3052	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3020	3052	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2388	3052	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2372	3052	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2768	3052	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2832	3052	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2684	3052	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1528	3052	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2696	3052	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2496	3052	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2736	3052	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3008	3052	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2724	3052	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1644	3052	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1128	3052	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2020	3052	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2928	3052	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2004	3052	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2984	3052	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3000	3052	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1380	3052	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1808	3052	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2904	3052	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	744	3052	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1656	3052	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2920	3052	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2100	3052	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2760	3052	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1088	3052	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1912	3052	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	772	3052	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1092	3052	schtasks.exe	35

DCRat payload 9 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0008000000016d69-9.dat	dcrat
behavioral1/memory/2068-13-0x0000000000D10000-0x0000000000E20000-memory.dmp	dcrat
behavioral1/memory/1064-111-0x00000000009D0000-0x0000000000AE0000-memory.dmp	dcrat
behavioral1/memory/1560-197-0x0000000000050000-0x0000000000160000-memory.dmp	dcrat
behavioral1/memory/2696-257-0x0000000000CA0000-0x0000000000DB0000-memory.dmp	dcrat
behavioral1/memory/1796-317-0x00000000002C0000-0x00000000003D0000-memory.dmp	dcrat
behavioral1/memory/2368-377-0x00000000001B0000-0x00000000002C0000-memory.dmp	dcrat
behavioral1/memory/964-437-0x00000000002F0000-0x0000000000400000-memory.dmp	dcrat
behavioral1/memory/1396-497-0x0000000000D90000-0x0000000000EA0000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 19 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1944	powershell.exe
1412	powershell.exe
2268	powershell.exe
1488	powershell.exe
1820	powershell.exe
1604	powershell.exe
2052	powershell.exe
2132	powershell.exe
1696	powershell.exe
2248	powershell.exe
2280	powershell.exe
2548	powershell.exe
3028	powershell.exe
1540	powershell.exe
612	powershell.exe
1640	powershell.exe
2960	powershell.exe
896	powershell.exe
2252	powershell.exe

Executes dropped EXE 10 IoCs

pid	Process
2068	DllCommonsvc.exe
1796	DllCommonsvc.exe
1064	OSPPSVC.exe
1560	OSPPSVC.exe
2696	OSPPSVC.exe
1796	OSPPSVC.exe
2368	OSPPSVC.exe
964	OSPPSVC.exe
1396	OSPPSVC.exe
2820	OSPPSVC.exe

Loads dropped DLL 2 IoCs

pid	Process
2196	cmd.exe
2196	cmd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 9 IoCs

Web Service

T1102

flow	ioc
4	raw.githubusercontent.com
9	raw.githubusercontent.com
16	raw.githubusercontent.com
19	raw.githubusercontent.com
27	raw.githubusercontent.com
30	raw.githubusercontent.com
5	raw.githubusercontent.com
13	raw.githubusercontent.com
23	raw.githubusercontent.com

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\Office14\7a0fd90576e088	DllCommonsvc.exe
File created	C:\Program Files (x86)\Common Files\Services\lsm.exe	DllCommonsvc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Services\lsm.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Common Files\Services\101b941d020240	DllCommonsvc.exe
File created	C:\Program Files\Microsoft Office\Office14\explorer.exe	DllCommonsvc.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\AppPatch\AppPatch64\powershell.exe	DllCommonsvc.exe
File opened for modification	C:\Windows\AppPatch\AppPatch64\powershell.exe	DllCommonsvc.exe
File created	C:\Windows\AppPatch\AppPatch64\e978f868350d50	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_02a08316901022785b6eafefdc8ab497a0e63b9025da8bc9bbe16bd927cff394.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 51 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1380	schtasks.exe
1092	schtasks.exe
2712	schtasks.exe
2728	schtasks.exe
1496	schtasks.exe
1096	schtasks.exe
2832	schtasks.exe
2904	schtasks.exe
3000	schtasks.exe
2724	schtasks.exe
1144	schtasks.exe
2056	schtasks.exe
1656	schtasks.exe
2100	schtasks.exe
772	schtasks.exe
2816	schtasks.exe
1196	schtasks.exe
1328	schtasks.exe
3020	schtasks.exe
1660	schtasks.exe
1528	schtasks.exe
2004	schtasks.exe
2020	schtasks.exe
2928	schtasks.exe
2920	schtasks.exe
2680	schtasks.exe
2116	schtasks.exe
2960	schtasks.exe
2496	schtasks.exe
2724	schtasks.exe
744	schtasks.exe
1912	schtasks.exe
2988	schtasks.exe
2388	schtasks.exe
2372	schtasks.exe
2736	schtasks.exe
3008	schtasks.exe
1644	schtasks.exe
2984	schtasks.exe
1808	schtasks.exe
2720	schtasks.exe
2368	schtasks.exe
2776	schtasks.exe
2696	schtasks.exe
2760	schtasks.exe
3000	schtasks.exe
1088	schtasks.exe
2944	schtasks.exe
2768	schtasks.exe
2684	schtasks.exe
1128	schtasks.exe

Suspicious behavior: EnumeratesProcesses 61 IoCs

pid	Process
2068	DllCommonsvc.exe
2068	DllCommonsvc.exe
2068	DllCommonsvc.exe
2280	powershell.exe
2132	powershell.exe
612	powershell.exe
2268	powershell.exe
2252	powershell.exe
1696	powershell.exe
2248	powershell.exe
2052	powershell.exe
1796	DllCommonsvc.exe
1796	DllCommonsvc.exe
1796	DllCommonsvc.exe
1796	DllCommonsvc.exe
1796	DllCommonsvc.exe
1796	DllCommonsvc.exe
1796	DllCommonsvc.exe
1796	DllCommonsvc.exe
1796	DllCommonsvc.exe
1796	DllCommonsvc.exe
1796	DllCommonsvc.exe
1796	DllCommonsvc.exe
1796	DllCommonsvc.exe
1796	DllCommonsvc.exe
1796	DllCommonsvc.exe
1796	DllCommonsvc.exe
1796	DllCommonsvc.exe
1796	DllCommonsvc.exe
1796	DllCommonsvc.exe
1796	DllCommonsvc.exe
1796	DllCommonsvc.exe
1796	DllCommonsvc.exe
1796	DllCommonsvc.exe
1796	DllCommonsvc.exe
1796	DllCommonsvc.exe
1796	DllCommonsvc.exe
1796	DllCommonsvc.exe
1796	DllCommonsvc.exe
1796	DllCommonsvc.exe
1796	DllCommonsvc.exe
1796	DllCommonsvc.exe
3028	powershell.exe
1604	powershell.exe
1540	powershell.exe
2548	powershell.exe
1944	powershell.exe
2960	powershell.exe
1640	powershell.exe
896	powershell.exe
1412	powershell.exe
1488	powershell.exe
1820	powershell.exe
1064	OSPPSVC.exe
1560	OSPPSVC.exe
2696	OSPPSVC.exe
1796	OSPPSVC.exe
2368	OSPPSVC.exe
964	OSPPSVC.exe
1396	OSPPSVC.exe
2820	OSPPSVC.exe

Suspicious use of AdjustPrivilegeToken 29 IoCs

description	pid	Process
Token: SeDebugPrivilege	2068	DllCommonsvc.exe
Token: SeDebugPrivilege	2280	powershell.exe
Token: SeDebugPrivilege	2132	powershell.exe
Token: SeDebugPrivilege	612	powershell.exe
Token: SeDebugPrivilege	2268	powershell.exe
Token: SeDebugPrivilege	1796	DllCommonsvc.exe
Token: SeDebugPrivilege	2252	powershell.exe
Token: SeDebugPrivilege	1696	powershell.exe
Token: SeDebugPrivilege	2248	powershell.exe
Token: SeDebugPrivilege	2052	powershell.exe
Token: SeDebugPrivilege	3028	powershell.exe
Token: SeDebugPrivilege	1604	powershell.exe
Token: SeDebugPrivilege	1540	powershell.exe
Token: SeDebugPrivilege	2548	powershell.exe
Token: SeDebugPrivilege	1944	powershell.exe
Token: SeDebugPrivilege	2960	powershell.exe
Token: SeDebugPrivilege	1640	powershell.exe
Token: SeDebugPrivilege	896	powershell.exe
Token: SeDebugPrivilege	1412	powershell.exe
Token: SeDebugPrivilege	1488	powershell.exe
Token: SeDebugPrivilege	1820	powershell.exe
Token: SeDebugPrivilege	1064	OSPPSVC.exe
Token: SeDebugPrivilege	1560	OSPPSVC.exe
Token: SeDebugPrivilege	2696	OSPPSVC.exe
Token: SeDebugPrivilege	1796	OSPPSVC.exe
Token: SeDebugPrivilege	2368	OSPPSVC.exe
Token: SeDebugPrivilege	964	OSPPSVC.exe
Token: SeDebugPrivilege	1396	OSPPSVC.exe
Token: SeDebugPrivilege	2820	OSPPSVC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 1756	2188	JaffaCakes118_02a08316901022785b6eafefdc8ab497a0e63b9025da8bc9bbe16bd927cff394.exe	30
PID 2188 wrote to memory of 1756	2188	JaffaCakes118_02a08316901022785b6eafefdc8ab497a0e63b9025da8bc9bbe16bd927cff394.exe	30
PID 2188 wrote to memory of 1756	2188	JaffaCakes118_02a08316901022785b6eafefdc8ab497a0e63b9025da8bc9bbe16bd927cff394.exe	30
PID 2188 wrote to memory of 1756	2188	JaffaCakes118_02a08316901022785b6eafefdc8ab497a0e63b9025da8bc9bbe16bd927cff394.exe	30
PID 1756 wrote to memory of 2196	1756	WScript.exe	31
PID 1756 wrote to memory of 2196	1756	WScript.exe	31
PID 1756 wrote to memory of 2196	1756	WScript.exe	31
PID 1756 wrote to memory of 2196	1756	WScript.exe	31
PID 2196 wrote to memory of 2068	2196	cmd.exe	34
PID 2196 wrote to memory of 2068	2196	cmd.exe	34
PID 2196 wrote to memory of 2068	2196	cmd.exe	34
PID 2196 wrote to memory of 2068	2196	cmd.exe	34
PID 2068 wrote to memory of 612	2068	DllCommonsvc.exe	57
PID 2068 wrote to memory of 612	2068	DllCommonsvc.exe	57
PID 2068 wrote to memory of 612	2068	DllCommonsvc.exe	57
PID 2068 wrote to memory of 2280	2068	DllCommonsvc.exe	58
PID 2068 wrote to memory of 2280	2068	DllCommonsvc.exe	58
PID 2068 wrote to memory of 2280	2068	DllCommonsvc.exe	58
PID 2068 wrote to memory of 2052	2068	DllCommonsvc.exe	59
PID 2068 wrote to memory of 2052	2068	DllCommonsvc.exe	59
PID 2068 wrote to memory of 2052	2068	DllCommonsvc.exe	59
PID 2068 wrote to memory of 2252	2068	DllCommonsvc.exe	60
PID 2068 wrote to memory of 2252	2068	DllCommonsvc.exe	60
PID 2068 wrote to memory of 2252	2068	DllCommonsvc.exe	60
PID 2068 wrote to memory of 2268	2068	DllCommonsvc.exe	61
PID 2068 wrote to memory of 2268	2068	DllCommonsvc.exe	61
PID 2068 wrote to memory of 2268	2068	DllCommonsvc.exe	61
PID 2068 wrote to memory of 2248	2068	DllCommonsvc.exe	62
PID 2068 wrote to memory of 2248	2068	DllCommonsvc.exe	62
PID 2068 wrote to memory of 2248	2068	DllCommonsvc.exe	62
PID 2068 wrote to memory of 1696	2068	DllCommonsvc.exe	63
PID 2068 wrote to memory of 1696	2068	DllCommonsvc.exe	63
PID 2068 wrote to memory of 1696	2068	DllCommonsvc.exe	63
PID 2068 wrote to memory of 2132	2068	DllCommonsvc.exe	64
PID 2068 wrote to memory of 2132	2068	DllCommonsvc.exe	64
PID 2068 wrote to memory of 2132	2068	DllCommonsvc.exe	64
PID 2068 wrote to memory of 1796	2068	DllCommonsvc.exe	73
PID 2068 wrote to memory of 1796	2068	DllCommonsvc.exe	73
PID 2068 wrote to memory of 1796	2068	DllCommonsvc.exe	73
PID 1796 wrote to memory of 2548	1796	DllCommonsvc.exe	104
PID 1796 wrote to memory of 2548	1796	DllCommonsvc.exe	104
PID 1796 wrote to memory of 2548	1796	DllCommonsvc.exe	104
PID 1796 wrote to memory of 1488	1796	DllCommonsvc.exe	105
PID 1796 wrote to memory of 1488	1796	DllCommonsvc.exe	105
PID 1796 wrote to memory of 1488	1796	DllCommonsvc.exe	105
PID 1796 wrote to memory of 1640	1796	DllCommonsvc.exe	107
PID 1796 wrote to memory of 1640	1796	DllCommonsvc.exe	107
PID 1796 wrote to memory of 1640	1796	DllCommonsvc.exe	107
PID 1796 wrote to memory of 3028	1796	DllCommonsvc.exe	108
PID 1796 wrote to memory of 3028	1796	DllCommonsvc.exe	108
PID 1796 wrote to memory of 3028	1796	DllCommonsvc.exe	108
PID 1796 wrote to memory of 2960	1796	DllCommonsvc.exe	110
PID 1796 wrote to memory of 2960	1796	DllCommonsvc.exe	110
PID 1796 wrote to memory of 2960	1796	DllCommonsvc.exe	110
PID 1796 wrote to memory of 1944	1796	DllCommonsvc.exe	113
PID 1796 wrote to memory of 1944	1796	DllCommonsvc.exe	113
PID 1796 wrote to memory of 1944	1796	DllCommonsvc.exe	113
PID 1796 wrote to memory of 1604	1796	DllCommonsvc.exe	114
PID 1796 wrote to memory of 1604	1796	DllCommonsvc.exe	114
PID 1796 wrote to memory of 1604	1796	DllCommonsvc.exe	114
PID 1796 wrote to memory of 1540	1796	DllCommonsvc.exe	115
PID 1796 wrote to memory of 1540	1796	DllCommonsvc.exe	115
PID 1796 wrote to memory of 1540	1796	DllCommonsvc.exe	115
PID 1796 wrote to memory of 1412	1796	DllCommonsvc.exe	116

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_02a08316901022785b6eafefdc8ab497a0e63b9025da8bc9bbe16bd927cff394.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_02a08316901022785b6eafefdc8ab497a0e63b9025da8bc9bbe16bd927cff394.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1756
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2196
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2068
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:612
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Common Files\Services\lsm.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2280
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\dwm.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2052
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\audiodg.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2252
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\spoolsv.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2268
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Pictures\explorer.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2248
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\lsm.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1696
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\wininit.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2132
    - - C:\providercommon\DllCommonsvc.exe
        
        "C:\providercommon\DllCommonsvc.exe"
        5⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1796
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2548
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\AppPatch\AppPatch64\powershell.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1488
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\powershell.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1640
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Microsoft Office\Office14\explorer.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3028
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\explorer.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2960
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\smss.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1944
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Start Menu\OSPPSVC.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1604
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\NetHood\conhost.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1540
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\lsass.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1412
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\System.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1820
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\WmiPrvSE.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:896
      - C:\Users\Default\Start Menu\OSPPSVC.exe
        
        "C:\Users\Default\Start Menu\OSPPSVC.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1064
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\kUVpzpaF2i.bat"
        7⤵
        
        PID:1496
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:2304
        
        C:\Users\Default\Start Menu\OSPPSVC.exe
        
        "C:\Users\Default\Start Menu\OSPPSVC.exe"
        8⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1560
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\be8zRZs4e0.bat"
        9⤵
        
        PID:1324
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:2232
        
        C:\Users\Default\Start Menu\OSPPSVC.exe
        
        "C:\Users\Default\Start Menu\OSPPSVC.exe"
        10⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2696
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\syea0WjfTx.bat"
        11⤵
        
        PID:2076
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:2360
        
        C:\Users\Default\Start Menu\OSPPSVC.exe
        
        "C:\Users\Default\Start Menu\OSPPSVC.exe"
        12⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1796
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\5G5G1KH0qy.bat"
        13⤵
        
        PID:2496
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        14⤵
        
        PID:2064
        
        C:\Users\Default\Start Menu\OSPPSVC.exe
        
        "C:\Users\Default\Start Menu\OSPPSVC.exe"
        14⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2368
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\SU2rmp5bpW.bat"
        15⤵
        
        PID:1032
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        16⤵
        
        PID:1016
        
        C:\Users\Default\Start Menu\OSPPSVC.exe
        
        "C:\Users\Default\Start Menu\OSPPSVC.exe"
        16⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:964
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\XBBOHPKclM.bat"
        17⤵
        
        PID:1876
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        18⤵
        
        PID:1704
        
        C:\Users\Default\Start Menu\OSPPSVC.exe
        
        "C:\Users\Default\Start Menu\OSPPSVC.exe"
        18⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1396
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\a1rZrAbBst.bat"
        19⤵
        
        PID:1672
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        20⤵
        
        PID:2724
        
        C:\Users\Default\Start Menu\OSPPSVC.exe
        
        "C:\Users\Default\Start Menu\OSPPSVC.exe"
        20⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2820
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\msQYHxuKnC.bat"
        21⤵
        
        PID:2196
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        22⤵
        
        PID:2424

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Common Files\Services\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\Services\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Common Files\Services\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\MSOCache\All Users\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 10 /tr "'C:\providercommon\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\providercommon\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1196

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 13 /tr "'C:\providercommon\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1328

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 9 /tr "'C:\Users\Default\Pictures\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Users\Default\Pictures\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2368

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\Users\Default\Pictures\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1096

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 9 /tr "'C:\providercommon\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\providercommon\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 7 /tr "'C:\providercommon\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\providercommon\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\providercommon\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 9 /tr "'C:\providercommon\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 11 /tr "'C:\Windows\AppPatch\AppPatch64\powershell.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershell" /sc ONLOGON /tr "'C:\Windows\AppPatch\AppPatch64\powershell.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 7 /tr "'C:\Windows\AppPatch\AppPatch64\powershell.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\powershell.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershell" /sc ONLOGON /tr "'C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\powershell.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\powershell.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 9 /tr "'C:\Program Files\Microsoft Office\Office14\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\Office14\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\Program Files\Microsoft Office\Office14\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 5 /tr "'C:\providercommon\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\providercommon\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 5 /tr "'C:\providercommon\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1128

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 9 /tr "'C:\Users\Default\Start Menu\OSPPSVC.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Users\Default\Start Menu\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 9 /tr "'C:\Users\Default\Start Menu\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\Users\Default\NetHood\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Users\Default\NetHood\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 9 /tr "'C:\Users\Default\NetHood\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'C:\providercommon\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\providercommon\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'C:\providercommon\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2100

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Users\Admin\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 10 /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 7 /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ddc1aae50092e0ff6dc0d71d8db62d79

SHA1
bcc8439f61dee505a74ece6399d680774db5ea2f

SHA256
54b75260ad2e92998a1ffba324252b550fd86d0e0d686bf247e3ffc9193c84e1

SHA512
a3630683b3764513a5d2d5f0785f11e3c75e7eb755043a80f2fe73d59c79af4fade88615d8d21e0ae5ea173e01e98bfebbbdba1d5e15370c432487b7f5aa086b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1e3a3c414710423d6851edd3c8df38df

SHA1
952b9b544ce0de32469420748a3d6bfc01583ab5

SHA256
87c917c4344894170663b46ef84441fca31d75da6348d8a550652f89222342dc

SHA512
edd521cdde8f375c26ecdf703033c693434979ee3132649e301a9ed2f6a1d1af3c3fa3d622f812c3bf54ff04a3ed6bb8c22fd0cf388529ec7f70889c6f322435

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9fba1f3d5174ee108d123fd5eb213c6a

SHA1
832072cebdefea3916ba0265b48c427dd07fb6da

SHA256
f479550a64a79e9456d9bd939f4b3c397fcbf74290c040bbcd82df093e61bd92

SHA512
d6b17c424ab4eaaeb42a3e0391773a84a6e289384a4c3909b784ebdd2d3cb967ed617dd1ff95faecd192f7528706150a4155a7f067c7a524930c50d0e397237c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a92facbe02bd1a1496a8ed51b7804a27

SHA1
2f1cdf102a2eee1caadec481c37de77b9c6687c1

SHA256
1b759dbb3230ce6ff76e4a851ccb4d15ba74529fcd5f49b683ecde8c5e77ea83

SHA512
3cd7f341c6511c81a7851c4b599679f1a9f2164a394d6d35eec2505b977e653c3f3be29c111fcf865ad55e9bf62e92b26faad57247717ca214032191bd2106cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6e51127887413437fb0772673ca4f466

SHA1
9279073b8c803d1bb361d982df8e65c04e47ef11

SHA256
141e9efed4de5394381051208dd062a91b2fae2c95bc01baf2635c6d74176937

SHA512
7bd679a531862a93e8050b13cad61b1d9c94e5c00623032ffe2d0ecb10c2ed75a8fc894a9c85d61ffdd7ecaf85434c9a159bcfb45a99bc4a1fa355fc082f901f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
52382c0571ad32da2bcc9865b085d047

SHA1
d7cb366f80f83d85c3c9a6666773f8627197bb8e

SHA256
755538d976b610d43fbdaefb219440bde21157017b3642ada6e4b0e0e6bedc2f

SHA512
5543a43c43bbef692cdebceb2ac93e403276f8896986f1a33e1018a4ede346d0381804839e8dc9a108adbe86fa2d30851faf336e5fb69c00fb6d852be813af22

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b76a5253c3aeede26006b16b054acdcc

SHA1
290191a719d8aeeb89d57fffc5b78dc604a30e3b

SHA256
340a650c9f970a786fa899cfec221d7ecefa9a9f85c00525dc550a80c4bf3e99

SHA512
b40c0733f07b5a22ff4058200cd7b58cb505234fc7fd73c65d96dadd7e14725122e680f02d0d6022b4485848d4771ddf0f3dbd7e12b432df8621f49741d6be1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\5G5G1KH0qy.bat

Filesize
204B

MD5
ab3ea8e8c9967ce9104ed91edf051889

SHA1
9e95d7c8aca18142c66199c3430224b568db49b1

SHA256
29363a14b61f2ab35c215fe15c256f2b4f269cf4c1912aff447c75d74a0f9bf7

SHA512
4ece553078d87a305a6d5c03fb5e2f66829ef6cb7015777107a5072176b9b34ab2f8ff567e9a05ea9a7e5dec6977b06fc051f278f257540e11342e78b34e722e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4626.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\SU2rmp5bpW.bat

Filesize
204B

MD5
7c2459353afdb342446dff5a75eef32b

SHA1
87791120524d2ceb6982f22673fed5fd01477e68

SHA256
aa2f407ba3bb55dcb7721515a70f88c900fc30b756e11193682ac3ef3fc970d9

SHA512
c157e9ac95d1ee1bea434a2f4eba3975d21f300519c3672529c78564e2746002f1cb6558d9ad52f0cb0a48dbfa101d210a2a6f96796b26d98bb87091a659873a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar47FD.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\XBBOHPKclM.bat

Filesize
204B

MD5
834d3da620055dded02dc019b919e17c

SHA1
93fc20d77638883f18e800ab95bcf71ec5a413c3

SHA256
80a48129906aef12b4c1a8c3337314280d6914065535524e1e394865c61c2730

SHA512
501cfdf450d48a9b539ef69d8af1ed8d4b66566d7e47417f6048a55eabae07f3a0e143264034aceb28a52ba30fa6f5ca4ff42955516be811565066e4a9675771

Download Submit
C:\Users\Admin\AppData\Local\Temp\a1rZrAbBst.bat

Filesize
204B

MD5
6559f13d0cfe4dd37039721452e0d65e

SHA1
d451fc36b62a09acdb6ada02b625378c7d6b4ccb

SHA256
360411054f2e7d0262f49db56bf0fa5955218cd0d3a103be5ada5e1a12397680

SHA512
85dd75b17f8e0c18fee65f44ffd9eb8221ab50562c52eb16267219f2e75b042ce6663611cd74c2b307ec6105801547be0082bb21479f7d2dcc6503b41b1ac7ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\be8zRZs4e0.bat

Filesize
204B

MD5
1d72c01fa46e828aedda584c3596162e

SHA1
dc3230219d6294ce9ba00308eb3f715f363a4a35

SHA256
b81b2280c73d4504bea858044ca97556994e227c80072559a046cc5dea4693ad

SHA512
fa3f91f3a022f39925c03d0d9a8be38404626d661df2747ad01b3b9094b39251f26de06d3e92f63ef646a206a9ec7857591b020c19ccc0c8ba66448a895bf6ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\kUVpzpaF2i.bat

Filesize
204B

MD5
17cf41090838887eb17b9f3bbae6d638

SHA1
1bedf61e87bcab8b7553bb0db6fcbef281074c18

SHA256
9ded1bfc20b173aabb5d53c0d8c9fd008e562b2c36f4894e48613836eb753455

SHA512
11e65c6f7aa8593d46ffbe4571c4efff8291c56d7c5c4c0784ebc62284169ade952b0183467c1d79f037c8e95e11aa937ea6182ebb5eb912c04d2dc21e3c5cb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\msQYHxuKnC.bat

Filesize
204B

MD5
bfe49448b8ab52bb825624afbda408b9

SHA1
b32829c952ace8309acf77d2beafabcba12a1981

SHA256
399ff7ef8e429bab946bce92b40e0312dfa83627db01c47ed5a8f33fd383693e

SHA512
f081eff3238d3767c92f3f6586a7721e08a2e2e6a4731b8f00222cde6a5fc9eea18dbba4f3134b66579e0f0f4305397deda019860e6246c4dc24b893181c075b

Download Submit
C:\Users\Admin\AppData\Local\Temp\syea0WjfTx.bat

Filesize
204B

MD5
e3598312abe18aa0bb0cd02a28cc6a0d

SHA1
c08f6626d5d2a402cb1efddaad92c5ed3f034515

SHA256
6a8e32ddb3d952a61d933992c6e708d8d7f083f031f816e58127048923a2ef8d

SHA512
8bb317bc26270f79bfa4c7d22c48682487ecd5852d4a7b7dd9703357b0aa0298b78f767244ff43db5c87aba056a9823178955b2c273b76b6e285504f1e2d723c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
425cde9fbcd34a49d0fafcffee8eddd0

SHA1
89b9b4da45e2b97180c83089f6a1de9d43a7e82b

SHA256
36cf5cfcecdde56562f2ad2cba2085975aecf92d62ba3f9d1702cd2af4afd109

SHA512
9e8ed86a8d3401c8c328792962507cb782e26089717d90825e798b935247c023cec2602734f7e8ac671f28c4c21a34d14834ff94c8e5243827ff456b6314d45d

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
memory/964-437-0x00000000002F0000-0x0000000000400000-memory.dmp

Filesize
1.1MB

Download
memory/1064-111-0x00000000009D0000-0x0000000000AE0000-memory.dmp

Filesize
1.1MB

Download
memory/1396-497-0x0000000000D90000-0x0000000000EA0000-memory.dmp

Filesize
1.1MB

Download
memory/1560-197-0x0000000000050000-0x0000000000160000-memory.dmp

Filesize
1.1MB

Download
memory/1796-72-0x00000000004E0000-0x00000000004F2000-memory.dmp

Filesize
72KB

Download
memory/1796-317-0x00000000002C0000-0x00000000003D0000-memory.dmp

Filesize
1.1MB

Download
memory/2068-14-0x0000000000240000-0x0000000000252000-memory.dmp

Filesize
72KB

Download
memory/2068-17-0x0000000000560000-0x000000000056C000-memory.dmp

Filesize
48KB

Download
memory/2068-16-0x00000000004D0000-0x00000000004DC000-memory.dmp

Filesize
48KB

Download
memory/2068-15-0x0000000000250000-0x000000000025C000-memory.dmp

Filesize
48KB

Download
memory/2068-13-0x0000000000D10000-0x0000000000E20000-memory.dmp

Filesize
1.1MB

Download
memory/2280-39-0x0000000001F50000-0x0000000001F58000-memory.dmp

Filesize
32KB

Download
memory/2280-37-0x000000001B1A0000-0x000000001B482000-memory.dmp

Filesize
2.9MB

Download
memory/2368-377-0x00000000001B0000-0x00000000002C0000-memory.dmp

Filesize
1.1MB

Download
memory/2696-257-0x0000000000CA0000-0x0000000000DB0000-memory.dmp

Filesize
1.1MB

Download
memory/3028-104-0x00000000024E0000-0x00000000024E8000-memory.dmp

Filesize
32KB

Download
memory/3028-103-0x000000001B2E0000-0x000000001B5C2000-memory.dmp

Filesize
2.9MB

Download