dcrat | 406b1f2c2723a298b50fb1f06c118490aacde3113e135c5d24f4d0a13382bb7f

Analysis

max time kernel
146s
max time network
152s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
23/12/2024, 13:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_406b1f2c2723a298b50fb1f06c118490aacde3113e135c5d24f4d0a13382bb7f.exe
Size

1.3MB
MD5

989357b95087d0fe85a8d53022283974
SHA1

51a249a6c56fa1c7909eba7aaff51a7808a3b5ed
SHA256

406b1f2c2723a298b50fb1f06c118490aacde3113e135c5d24f4d0a13382bb7f
SHA512

23f09c706efa87a42d44ffa359aa8941ba296a4a6a13f1d3689ff1426cd60499670c557648378d608f45036e633d7c72b301effdb44929746e2b787b91a9ccaa
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 42 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1356	2936	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2196	2936	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2844	2936	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2824	2936	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2668	2936	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2716	2936	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1032	2936	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1616	2936	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2096	2936	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1748	2936	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1836	2936	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	800	2936	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1004	2936	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2008	2936	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1772	2936	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	580	2936	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1672	2936	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1364	2936	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	864	2936	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2236	2936	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1580	2936	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1852	2936	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	276	2936	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2488	2936	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2712	2936	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	868	2936	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2264	2936	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1572	2936	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2732	2936	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2584	2936	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2380	2936	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1684	2936	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1560	2936	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2480	2936	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2424	2936	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2908	2936	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1276	2936	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2656	2936	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2408	2936	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2196	2936	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2832	2936	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2336	2936	schtasks.exe	34

DCRat payload 10 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0007000000016cab-12.dat	dcrat
behavioral1/memory/2092-13-0x0000000000FD0000-0x00000000010E0000-memory.dmp	dcrat
behavioral1/memory/916-51-0x00000000013A0000-0x00000000014B0000-memory.dmp	dcrat
behavioral1/memory/2112-94-0x0000000000870000-0x0000000000980000-memory.dmp	dcrat
behavioral1/memory/2916-199-0x0000000000B00000-0x0000000000C10000-memory.dmp	dcrat
behavioral1/memory/2564-319-0x0000000000D80000-0x0000000000E90000-memory.dmp	dcrat
behavioral1/memory/2044-380-0x0000000000040000-0x0000000000150000-memory.dmp	dcrat
behavioral1/memory/308-440-0x0000000000150000-0x0000000000260000-memory.dmp	dcrat
behavioral1/memory/2400-501-0x0000000000E10000-0x0000000000F20000-memory.dmp	dcrat
behavioral1/memory/2760-620-0x0000000001280000-0x0000000001390000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 16 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2792	powershell.exe
2744	powershell.exe
1780	powershell.exe
2452	powershell.exe
1952	powershell.exe
1700	powershell.exe
2532	powershell.exe
556	powershell.exe
2640	powershell.exe
1764	powershell.exe
2880	powershell.exe
1948	powershell.exe
2760	powershell.exe
1648	powershell.exe
2828	powershell.exe
2848	powershell.exe

Executes dropped EXE 11 IoCs

pid	Process
2092	DllCommonsvc.exe
916	DllCommonsvc.exe
2112	DllCommonsvc.exe
2916	DllCommonsvc.exe
1640	DllCommonsvc.exe
2564	DllCommonsvc.exe
2044	DllCommonsvc.exe
308	DllCommonsvc.exe
2400	DllCommonsvc.exe
2692	DllCommonsvc.exe
2760	DllCommonsvc.exe

Loads dropped DLL 2 IoCs

pid	Process
2528	cmd.exe
2528	cmd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 10 IoCs

Web Service

T1102

flow	ioc
19	raw.githubusercontent.com
22	raw.githubusercontent.com
34	raw.githubusercontent.com
4	raw.githubusercontent.com
5	raw.githubusercontent.com
9	raw.githubusercontent.com
12	raw.githubusercontent.com
15	raw.githubusercontent.com
26	raw.githubusercontent.com
30	raw.githubusercontent.com

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Sidebar\it-IT\DllCommonsvc.exe	DllCommonsvc.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\it-IT\DllCommonsvc.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Sidebar\it-IT\a76d7bf15d8370	DllCommonsvc.exe
File created	C:\Program Files\Microsoft Office\Office14\1033\services.exe	DllCommonsvc.exe
File created	C:\Program Files\Microsoft Office\Office14\1033\c5b4cb5e9653cc	DllCommonsvc.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\assembly\GAC_64\Microsoft.Windows.Diagnosis.SDEngine\6.1.0.0__31bf3856ad364e35\088424020bedd6	DllCommonsvc.exe
File created	C:\Windows\RemotePackages\RemoteApps\audiodg.exe	DllCommonsvc.exe
File created	C:\Windows\RemotePackages\RemoteApps\42af1c969fbb7b	DllCommonsvc.exe
File created	C:\Windows\RemotePackages\RemoteApps\5940a34987c991	DllCommonsvc.exe
File created	C:\Windows\fr-FR\System.exe	DllCommonsvc.exe
File created	C:\Windows\fr-FR\27d1bcfc3c54e0	DllCommonsvc.exe
File created	C:\Windows\Cursors\886983d96e3d3e	DllCommonsvc.exe
File created	C:\Windows\assembly\GAC_64\Microsoft.Windows.Diagnosis.SDEngine\6.1.0.0__31bf3856ad364e35\conhost.exe	DllCommonsvc.exe
File opened for modification	C:\Windows\assembly\GAC_64\Microsoft.Windows.Diagnosis.SDEngine\6.1.0.0__31bf3856ad364e35\conhost.exe	DllCommonsvc.exe
File created	C:\Windows\RemotePackages\RemoteApps\dllhost.exe	DllCommonsvc.exe
File created	C:\Windows\Cursors\csrss.exe	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_406b1f2c2723a298b50fb1f06c118490aacde3113e135c5d24f4d0a13382bb7f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 42 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
864	schtasks.exe
2336	schtasks.exe
580	schtasks.exe
1684	schtasks.exe
2196	schtasks.exe
2668	schtasks.exe
1004	schtasks.exe
2008	schtasks.exe
2824	schtasks.exe
1364	schtasks.exe
1852	schtasks.exe
2656	schtasks.exe
2584	schtasks.exe
1560	schtasks.exe
2908	schtasks.exe
1276	schtasks.exe
1616	schtasks.exe
2488	schtasks.exe
2264	schtasks.exe
2732	schtasks.exe
2480	schtasks.exe
2424	schtasks.exe
2832	schtasks.exe
1032	schtasks.exe
2096	schtasks.exe
276	schtasks.exe
2712	schtasks.exe
1572	schtasks.exe
1356	schtasks.exe
1836	schtasks.exe
1580	schtasks.exe
868	schtasks.exe
2844	schtasks.exe
1748	schtasks.exe
1672	schtasks.exe
2236	schtasks.exe
2408	schtasks.exe
2196	schtasks.exe
2716	schtasks.exe
800	schtasks.exe
1772	schtasks.exe
2380	schtasks.exe

Suspicious behavior: EnumeratesProcesses 29 IoCs

pid	Process
2092	DllCommonsvc.exe
556	powershell.exe
2828	powershell.exe
1700	powershell.exe
1648	powershell.exe
916	DllCommonsvc.exe
916	DllCommonsvc.exe
916	DllCommonsvc.exe
1780	powershell.exe
2744	powershell.exe
1952	powershell.exe
2532	powershell.exe
1948	powershell.exe
2760	powershell.exe
1764	powershell.exe
2880	powershell.exe
2452	powershell.exe
2848	powershell.exe
2792	powershell.exe
2640	powershell.exe
2112	DllCommonsvc.exe
2916	DllCommonsvc.exe
1640	DllCommonsvc.exe
2564	DllCommonsvc.exe
2044	DllCommonsvc.exe
308	DllCommonsvc.exe
2400	DllCommonsvc.exe
2692	DllCommonsvc.exe
2760	DllCommonsvc.exe

Suspicious use of AdjustPrivilegeToken 27 IoCs

description	pid	Process
Token: SeDebugPrivilege	2092	DllCommonsvc.exe
Token: SeDebugPrivilege	2828	powershell.exe
Token: SeDebugPrivilege	556	powershell.exe
Token: SeDebugPrivilege	1700	powershell.exe
Token: SeDebugPrivilege	1648	powershell.exe
Token: SeDebugPrivilege	916	DllCommonsvc.exe
Token: SeDebugPrivilege	1780	powershell.exe
Token: SeDebugPrivilege	2744	powershell.exe
Token: SeDebugPrivilege	1952	powershell.exe
Token: SeDebugPrivilege	2532	powershell.exe
Token: SeDebugPrivilege	1948	powershell.exe
Token: SeDebugPrivilege	2760	powershell.exe
Token: SeDebugPrivilege	1764	powershell.exe
Token: SeDebugPrivilege	2880	powershell.exe
Token: SeDebugPrivilege	2452	powershell.exe
Token: SeDebugPrivilege	2848	powershell.exe
Token: SeDebugPrivilege	2112	DllCommonsvc.exe
Token: SeDebugPrivilege	2792	powershell.exe
Token: SeDebugPrivilege	2640	powershell.exe
Token: SeDebugPrivilege	2916	DllCommonsvc.exe
Token: SeDebugPrivilege	1640	DllCommonsvc.exe
Token: SeDebugPrivilege	2564	DllCommonsvc.exe
Token: SeDebugPrivilege	2044	DllCommonsvc.exe
Token: SeDebugPrivilege	308	DllCommonsvc.exe
Token: SeDebugPrivilege	2400	DllCommonsvc.exe
Token: SeDebugPrivilege	2692	DllCommonsvc.exe
Token: SeDebugPrivilege	2760	DllCommonsvc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2356 wrote to memory of 2348	2356	JaffaCakes118_406b1f2c2723a298b50fb1f06c118490aacde3113e135c5d24f4d0a13382bb7f.exe	30
PID 2356 wrote to memory of 2348	2356	JaffaCakes118_406b1f2c2723a298b50fb1f06c118490aacde3113e135c5d24f4d0a13382bb7f.exe	30
PID 2356 wrote to memory of 2348	2356	JaffaCakes118_406b1f2c2723a298b50fb1f06c118490aacde3113e135c5d24f4d0a13382bb7f.exe	30
PID 2356 wrote to memory of 2348	2356	JaffaCakes118_406b1f2c2723a298b50fb1f06c118490aacde3113e135c5d24f4d0a13382bb7f.exe	30
PID 2348 wrote to memory of 2528	2348	WScript.exe	31
PID 2348 wrote to memory of 2528	2348	WScript.exe	31
PID 2348 wrote to memory of 2528	2348	WScript.exe	31
PID 2348 wrote to memory of 2528	2348	WScript.exe	31
PID 2528 wrote to memory of 2092	2528	cmd.exe	33
PID 2528 wrote to memory of 2092	2528	cmd.exe	33
PID 2528 wrote to memory of 2092	2528	cmd.exe	33
PID 2528 wrote to memory of 2092	2528	cmd.exe	33
PID 2092 wrote to memory of 1700	2092	DllCommonsvc.exe	45
PID 2092 wrote to memory of 1700	2092	DllCommonsvc.exe	45
PID 2092 wrote to memory of 1700	2092	DllCommonsvc.exe	45
PID 2092 wrote to memory of 556	2092	DllCommonsvc.exe	46
PID 2092 wrote to memory of 556	2092	DllCommonsvc.exe	46
PID 2092 wrote to memory of 556	2092	DllCommonsvc.exe	46
PID 2092 wrote to memory of 2828	2092	DllCommonsvc.exe	47
PID 2092 wrote to memory of 2828	2092	DllCommonsvc.exe	47
PID 2092 wrote to memory of 2828	2092	DllCommonsvc.exe	47
PID 2092 wrote to memory of 1648	2092	DllCommonsvc.exe	48
PID 2092 wrote to memory of 1648	2092	DllCommonsvc.exe	48
PID 2092 wrote to memory of 1648	2092	DllCommonsvc.exe	48
PID 2092 wrote to memory of 1704	2092	DllCommonsvc.exe	53
PID 2092 wrote to memory of 1704	2092	DllCommonsvc.exe	53
PID 2092 wrote to memory of 1704	2092	DllCommonsvc.exe	53
PID 1704 wrote to memory of 852	1704	cmd.exe	55
PID 1704 wrote to memory of 852	1704	cmd.exe	55
PID 1704 wrote to memory of 852	1704	cmd.exe	55
PID 1704 wrote to memory of 916	1704	cmd.exe	56
PID 1704 wrote to memory of 916	1704	cmd.exe	56
PID 1704 wrote to memory of 916	1704	cmd.exe	56
PID 916 wrote to memory of 2640	916	DllCommonsvc.exe	90
PID 916 wrote to memory of 2640	916	DllCommonsvc.exe	90
PID 916 wrote to memory of 2640	916	DllCommonsvc.exe	90
PID 916 wrote to memory of 1780	916	DllCommonsvc.exe	91
PID 916 wrote to memory of 1780	916	DllCommonsvc.exe	91
PID 916 wrote to memory of 1780	916	DllCommonsvc.exe	91
PID 916 wrote to memory of 2848	916	DllCommonsvc.exe	92
PID 916 wrote to memory of 2848	916	DllCommonsvc.exe	92
PID 916 wrote to memory of 2848	916	DllCommonsvc.exe	92
PID 916 wrote to memory of 1952	916	DllCommonsvc.exe	95
PID 916 wrote to memory of 1952	916	DllCommonsvc.exe	95
PID 916 wrote to memory of 1952	916	DllCommonsvc.exe	95
PID 916 wrote to memory of 1764	916	DllCommonsvc.exe	96
PID 916 wrote to memory of 1764	916	DllCommonsvc.exe	96
PID 916 wrote to memory of 1764	916	DllCommonsvc.exe	96
PID 916 wrote to memory of 2744	916	DllCommonsvc.exe	97
PID 916 wrote to memory of 2744	916	DllCommonsvc.exe	97
PID 916 wrote to memory of 2744	916	DllCommonsvc.exe	97
PID 916 wrote to memory of 2452	916	DllCommonsvc.exe	98
PID 916 wrote to memory of 2452	916	DllCommonsvc.exe	98
PID 916 wrote to memory of 2452	916	DllCommonsvc.exe	98
PID 916 wrote to memory of 2760	916	DllCommonsvc.exe	99
PID 916 wrote to memory of 2760	916	DllCommonsvc.exe	99
PID 916 wrote to memory of 2760	916	DllCommonsvc.exe	99
PID 916 wrote to memory of 2792	916	DllCommonsvc.exe	100
PID 916 wrote to memory of 2792	916	DllCommonsvc.exe	100
PID 916 wrote to memory of 2792	916	DllCommonsvc.exe	100
PID 916 wrote to memory of 2532	916	DllCommonsvc.exe	101
PID 916 wrote to memory of 2532	916	DllCommonsvc.exe	101
PID 916 wrote to memory of 2532	916	DllCommonsvc.exe	101
PID 916 wrote to memory of 2880	916	DllCommonsvc.exe	103

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_406b1f2c2723a298b50fb1f06c118490aacde3113e135c5d24f4d0a13382bb7f.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_406b1f2c2723a298b50fb1f06c118490aacde3113e135c5d24f4d0a13382bb7f.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2348
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2528
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2092
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1700
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\assembly\GAC_64\Microsoft.Windows.Diagnosis.SDEngine\6.1.0.0__31bf3856ad364e35\conhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:556
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\explorer.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2828
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\RemotePackages\RemoteApps\audiodg.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1648
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\d4IjOEVlLZ.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1704
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:852
      - C:\providercommon\DllCommonsvc.exe
        
        "C:\providercommon\DllCommonsvc.exe"
        6⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:916
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2640
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Sidebar\it-IT\DllCommonsvc.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1780
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\csrss.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2848
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\spoolsv.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1952
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\Idle.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1764
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Microsoft Office\Office14\1033\services.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2744
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\DllCommonsvc.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2452
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\RemotePackages\RemoteApps\dllhost.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2760
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\csrss.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2792
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\fr-FR\System.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2532
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Cursors\csrss.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2880
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\dllhost.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1948
        
        C:\Program Files (x86)\Windows Sidebar\it-IT\DllCommonsvc.exe
        
        "C:\Program Files (x86)\Windows Sidebar\it-IT\DllCommonsvc.exe"
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2112
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\qpvm5o68kg.bat"
        8⤵
        
        PID:1888
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:2852
        
        C:\Program Files (x86)\Windows Sidebar\it-IT\DllCommonsvc.exe
        
        "C:\Program Files (x86)\Windows Sidebar\it-IT\DllCommonsvc.exe"
        9⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2916
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\eG7Plib0M1.bat"
        10⤵
        
        PID:2784
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:2652
        
        C:\Program Files (x86)\Windows Sidebar\it-IT\DllCommonsvc.exe
        
        "C:\Program Files (x86)\Windows Sidebar\it-IT\DllCommonsvc.exe"
        11⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1640
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\USq6qxpMr5.bat"
        12⤵
        
        PID:2400
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:1144
        
        C:\Program Files (x86)\Windows Sidebar\it-IT\DllCommonsvc.exe
        
        "C:\Program Files (x86)\Windows Sidebar\it-IT\DllCommonsvc.exe"
        13⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2564
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\uruRJY5g5x.bat"
        14⤵
        
        PID:2956
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        15⤵
        
        PID:2092
        
        C:\Program Files (x86)\Windows Sidebar\it-IT\DllCommonsvc.exe
        
        "C:\Program Files (x86)\Windows Sidebar\it-IT\DllCommonsvc.exe"
        15⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2044
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Cu9aubHCzw.bat"
        16⤵
        
        PID:2368
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        17⤵
        
        PID:2480
        
        C:\Program Files (x86)\Windows Sidebar\it-IT\DllCommonsvc.exe
        
        "C:\Program Files (x86)\Windows Sidebar\it-IT\DllCommonsvc.exe"
        17⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:308
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Nm0aad8I0L.bat"
        18⤵
        
        PID:3000
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        19⤵
        
        PID:1608
        
        C:\Program Files (x86)\Windows Sidebar\it-IT\DllCommonsvc.exe
        
        "C:\Program Files (x86)\Windows Sidebar\it-IT\DllCommonsvc.exe"
        19⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2400
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\kyAhxuXJBD.bat"
        20⤵
        
        PID:3044
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        21⤵
        
        PID:868
        
        C:\Program Files (x86)\Windows Sidebar\it-IT\DllCommonsvc.exe
        
        "C:\Program Files (x86)\Windows Sidebar\it-IT\DllCommonsvc.exe"
        21⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2692
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\vdJwOJplm6.bat"
        22⤵
        
        PID:2984
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        23⤵
        
        PID:1392
        
        C:\Program Files (x86)\Windows Sidebar\it-IT\DllCommonsvc.exe
        
        "C:\Program Files (x86)\Windows Sidebar\it-IT\DllCommonsvc.exe"
        23⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2760
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\1e6qhBZ49x.bat"
        24⤵
        
        PID:684
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        25⤵
        
        PID:2844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 10 /tr "'C:\Windows\assembly\GAC_64\Microsoft.Windows.Diagnosis.SDEngine\6.1.0.0__31bf3856ad364e35\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Windows\assembly\GAC_64\Microsoft.Windows.Diagnosis.SDEngine\6.1.0.0__31bf3856ad364e35\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2196

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 12 /tr "'C:\Windows\assembly\GAC_64\Microsoft.Windows.Diagnosis.SDEngine\6.1.0.0__31bf3856ad364e35\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 9 /tr "'C:\providercommon\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\providercommon\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\providercommon\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 5 /tr "'C:\Windows\RemotePackages\RemoteApps\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Windows\RemotePackages\RemoteApps\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 5 /tr "'C:\Windows\RemotePackages\RemoteApps\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2096

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Sidebar\it-IT\DllCommonsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\it-IT\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Sidebar\it-IT\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\providercommon\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\providercommon\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\providercommon\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\providercommon\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\providercommon\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 12 /tr "'C:\providercommon\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1364

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 13 /tr "'C:\Program Files\Microsoft Office\Office14\1033\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\Office14\1033\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:276

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 9 /tr "'C:\Program Files\Microsoft Office\Office14\1033\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 6 /tr "'C:\Users\Default User\DllCommonsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\Users\Default User\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 7 /tr "'C:\Users\Default User\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2264

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Windows\RemotePackages\RemoteApps\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\RemotePackages\RemoteApps\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Windows\RemotePackages\RemoteApps\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 12 /tr "'C:\Windows\fr-FR\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Windows\fr-FR\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2424

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 5 /tr "'C:\Windows\fr-FR\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Windows\Cursors\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1276

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\Cursors\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Windows\Cursors\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2196

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\MSOCache\All Users\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
623d3961d8ad992aa01cd8f650ab4124

SHA1
a37afe077141d001831144ab5eae0487d712c3ec

SHA256
63d6504853605eabcb45a02f6c192dea08629582816822728b6cd7463b061c36

SHA512
dea548415e2e85562ae7f9d3a3652d787bb1c7226ceec63b087e6a25fe04d47337000c24348d3a51f7258baeb9252c8056722b9d46cf00b8bc73610ee0d92fc1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c89fd609127664da840fb469fced91c7

SHA1
3145d5f059171d90ab11de722566d1c73a78d884

SHA256
2237726d00bc6d02ecad15af233e9a7b336bc49ca05f27192005fca14808e83d

SHA512
d94446523ca8e269d9b681a7db422a20681df0e9d320a634edc9ede716827bf46efb57f8e59e588222e3afcb0ff0eac6e54eeabf98d12521d0120dbbdc9cb39c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4faa2019c57a90793715be915e7e7f17

SHA1
520f85688ed80b7c23e2afce49e75d5d0ec2ea7d

SHA256
4119e251afede65c6ef0ab3e7bea494423586e540c05a24a69d74374513e0b56

SHA512
6a92ceb3d2c2b1fc63fec20aeb00af76d08ccc359dbb74dbeddb377e940ed79fbd2048d3b1a8467b37b2ccffd09d84852702b79db80674a47855eda14dc99f31

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3a0ada1d614dd1bd5fb7cb8d26b80fdf

SHA1
a00501c56407c3034422b414fa47ff2366764489

SHA256
435e33a953171ef5e01eddeecd3d4cd088f2db70ddbd5dcf6d83c18a80df8e03

SHA512
2db413643547ba642f5d98c133b5df367af1c599f32f1d6b98211fa949267e98a399b30acb5afaf3ea37645eb0f5ddcef0b54e4d3a326fc08edfad1c11792ee4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a0adc93ea4a826415127d75b0cd67089

SHA1
79685720f380e0b58e65c5f24c6a0260d3da7412

SHA256
1d2ac4cfe71e0e667a66bde3bc6c4732142230346d37fb4ac174d66a2c7ea62f

SHA512
7d6abf688f47351c502d299cae600e95d45c268005ffb2da52b9c90c23d28855ce2db9ea9d6238f457b0174e7204accd6981bec789f5527ffd69f7af8fa15305

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
28bab0060a7d57408ceda86ef27cbfa2

SHA1
73edd41c809f4d1a82c3ccb940191162e529872b

SHA256
5be8b8702a936f0ba46ee0771869e978bd4677a94391fd312d64efb8199cb668

SHA512
8552559871b6f1f6d63db5c7d3015052646478078332252df6ee3e12f6d022af64dad2291f315bd2cf99f7416b863ab5cd0e81c39e1321b20d33671fdc8dc5ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
470705b78cc5cbbc6d3157d682b23f4b

SHA1
a8d2732328d6db169a46db446bc58189c48c171c

SHA256
f7afaa36e5d9710dd9ce7217f6eef253ada9531bcf69dcb25804b1cdd06a7abb

SHA512
0e0722127dd5c5b2e62b39ea8295823f35a0b523bbf7a243aeaab5106f6edfb13f38a85f1ba3aa34e8d8a04a3c07096db4126543997aa33034f5736482750e81

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
62e2b20dc79fca72f0e6acbb372a26e9

SHA1
40a60e0ed3e573f59ca487c6aa7b42e21da24510

SHA256
cbd0279eb7971dbdaab7bc208ccce82c8c7a80e73cf0a8da858563a8a064e0f1

SHA512
cd996b6216afb32a26453e1075c514b9b783482ac7aee62d485cd2fe3cb7b0d48f0fcfe19a0475e40a2aca0ce8b7a172686aba7f51c0274dc61ce399a5c3e397

Download Submit
C:\Users\Admin\AppData\Local\Temp\1e6qhBZ49x.bat

Filesize
226B

MD5
ae149d9d9c00f3c3de67a004a1c1ac40

SHA1
6916033f4222d718022ae064a6f2bfb91925af4c

SHA256
e83dd7efa981048f8929c2b76d4a9c01aca9cfcaf7cb65cc87b667db3803f195

SHA512
60a4c1c093bcb73d6acb82d9f0df10f08c4576f99ee1278208bd73bb6cad3f56ba593222da18140a91c85c85e9a6f1b3debde060b7bf2449934efd8948f953db

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab43D6.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cu9aubHCzw.bat

Filesize
226B

MD5
d7ff2fb21b9dc5a5e19a4b338e5ad44e

SHA1
8bcf0027afda65703130121385100279939d5457

SHA256
550709342ad8f3b0d5b6f009e1f96ea019c7abfef577de3d8126c50f7ba91764

SHA512
a367fe69056302503120deec5dc4a131b62c87a42c9f51940df43f76057aeed75f43f5db220f2737827a9f3b270f183442e6f8b43c2323f1294566af92fd47ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\Nm0aad8I0L.bat

Filesize
226B

MD5
6e89302dff2caab79c34427c3633b447

SHA1
6b9b67d45625f706f8d069db5da00c8ec69fa5c9

SHA256
870745aa31df6be8efd2a62161cc52082bdfcd47d6336ffbb6160891b76ad2f1

SHA512
a1d35e15c0b793567ae993f5ae735cc4e1fdcd5ed3995a21d3ba2081a28d35c3b4561b0704a8c8668c7bdb3202894a95f3afab2e5e9b0bd9eced880accb0322b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4436.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\USq6qxpMr5.bat

Filesize
226B

MD5
1fb693b15d4923c1c58961dafbd6aa75

SHA1
3df036a5a04d7e0d51fb001c512309bc129cb1f2

SHA256
f1f470124893ac94894dc0ac8ddcef1b6f67d2908883fd7e89a8fe3d19e2da25

SHA512
c6ebc31395187e8c84dcb5af6f1f3e93da6132f08f8960e1fae29866b1dc3f1c1e9bcff4fe944466780b81ba968d9bfe1fa14361f95f2b7cc2277f5228694431

Download Submit
C:\Users\Admin\AppData\Local\Temp\d4IjOEVlLZ.bat

Filesize
199B

MD5
2f9128155dcc827e59cfeed6744b15c1

SHA1
68f69d41036eaa25730595ab6c62e2c422a16559

SHA256
87a337de43bf4bcd03439e17bca2c6f96dd05dc8ebc011cf7d6173fa0e127333

SHA512
07248152e8c850ebecf07452d1bc8c9c060d0a2147ac30c92a0a9c1826de1a03bf512d85098b60881ce90a026700c82541ddb1f0c1fad2651f1d3febbdb02285

Download Submit
C:\Users\Admin\AppData\Local\Temp\eG7Plib0M1.bat

Filesize
226B

MD5
308888ffe14091861e7a81b281f4ad8d

SHA1
a0a9ad423ae8964df5e02737b2955010c8cf2d84

SHA256
41498f929469607680329fb83091b8424a1ea3872bfb7e6e427c14e91b8f760d

SHA512
e3b05716d279f4f19499164e590d06b4a8badd6e3720b167535a5355ef7ba518678718531f7a0fd5050aae2964138efe1f721c5370551138b8e58499a1493b1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\kyAhxuXJBD.bat

Filesize
226B

MD5
7c2ec63d6ffd149cd65d8c08404c6b16

SHA1
b0096ceee2c12b8fe45644ffa189c18ff77eb1d9

SHA256
6dc46271f88f4a875c7864f8c3095fac2add9463f7bdfd0d8d7a1454ed6ad932

SHA512
a06427d9481b909202a9dc161a4ceb09f3e5782b07282d91756c20657a97de89a24467c9f62d3e53ac716e793af23a547e6e71c473de99f3328aed7b9ad22ce6

Download Submit
C:\Users\Admin\AppData\Local\Temp\qpvm5o68kg.bat

Filesize
226B

MD5
2ddc11f97688dab8971e6fca1da4ea16

SHA1
368df1e558f8aacaac48f41f155d23e385da36f7

SHA256
eecf4ff24cfd0573785aba0a6d8f2b4fc554fb699e295095858e7ae6fec67945

SHA512
00f519a6ae4baa4c48b153d8260acd49de553b646339a9f4823d19217c2734023ec1159b9f85c796b2fe63287dc825d63df542e7f662b1c574b57645831b684f

Download Submit
C:\Users\Admin\AppData\Local\Temp\uruRJY5g5x.bat

Filesize
226B

MD5
92d9d517bd6878d7429483a27004b2fb

SHA1
c71f0cb1c09938b016c1d018d83805cf0af1e0cc

SHA256
b033a9ebf784aae595cdf07b990cd3308cff34930cab4654b3e2aa032b1204ab

SHA512
7ba527ee508889b07ff79bf0937e1639ce4b5ebd105716479272b6c4a9f669d37d08f132a06b77d7dda63d4a71977bab5e002b01d896064546e35d31870c48e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\vdJwOJplm6.bat

Filesize
226B

MD5
c0027f8b4dd67962794cb5c596bc5944

SHA1
a763da4dad7cfcc382213f3d19a5edee05dbeef4

SHA256
d1135c8ec44270d669ed9bf80631809af3a7237d3e56c681875f0ed5e8acb2ea

SHA512
5bc355cebae8500078f57ea497ea7b6fd22f04d5e1dcb32e2a322fb24c4f6210cdca762963f31a493a8797c2bf4c5c70ffcd6d2c344531d42befc828c8adb521

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
4d798db7db17651392577ef5afd234b3

SHA1
264643007530b5c10a0776cca60340d2a0f6b21c

SHA256
554627cbf6fdb186ddab23959c0d9b68f53533aee77f087d0096955f23162ba7

SHA512
344af3427ad3198a3fef467fdd5985e176c8b3fa68b0d54efbec815e7679ccd389babbea47b8edd19722cf971510f257385ff044c793fcbbfc38288025b6daf6

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/308-441-0x0000000000140000-0x0000000000152000-memory.dmp

Filesize
72KB

Download
memory/308-440-0x0000000000150000-0x0000000000260000-memory.dmp

Filesize
1.1MB

Download
memory/556-43-0x0000000002460000-0x0000000002468000-memory.dmp

Filesize
32KB

Download
memory/916-51-0x00000000013A0000-0x00000000014B0000-memory.dmp

Filesize
1.1MB

Download
memory/2044-380-0x0000000000040000-0x0000000000150000-memory.dmp

Filesize
1.1MB

Download
memory/2092-16-0x0000000000350000-0x000000000035C000-memory.dmp

Filesize
48KB

Download
memory/2092-17-0x0000000000370000-0x000000000037C000-memory.dmp

Filesize
48KB

Download
memory/2092-15-0x0000000000360000-0x000000000036C000-memory.dmp

Filesize
48KB

Download
memory/2092-14-0x0000000000340000-0x0000000000352000-memory.dmp

Filesize
72KB

Download
memory/2092-13-0x0000000000FD0000-0x00000000010E0000-memory.dmp

Filesize
1.1MB

Download
memory/2112-94-0x0000000000870000-0x0000000000980000-memory.dmp

Filesize
1.1MB

Download
memory/2400-501-0x0000000000E10000-0x0000000000F20000-memory.dmp

Filesize
1.1MB

Download
memory/2564-319-0x0000000000D80000-0x0000000000E90000-memory.dmp

Filesize
1.1MB

Download
memory/2564-320-0x00000000003E0000-0x00000000003F2000-memory.dmp

Filesize
72KB

Download
memory/2744-93-0x0000000002520000-0x0000000002528000-memory.dmp

Filesize
32KB

Download
memory/2744-89-0x000000001B230000-0x000000001B512000-memory.dmp

Filesize
2.9MB

Download
memory/2760-620-0x0000000001280000-0x0000000001390000-memory.dmp

Filesize
1.1MB

Download
memory/2828-42-0x000000001B3A0000-0x000000001B682000-memory.dmp

Filesize
2.9MB

Download
memory/2916-199-0x0000000000B00000-0x0000000000C10000-memory.dmp

Filesize
1.1MB

Download
memory/2916-200-0x00000000003C0000-0x00000000003D2000-memory.dmp

Filesize
72KB

Download