dcrat | 749d45aebd98b6bdde085f4300f3a436b6d9390d41caa2c1909a89bb505e3f5a

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07-01-2025 22:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

749d45aebd98b6bdde085f4300f3a436b6d9390d41caa2c1909a89bb505e3f5a.exe
Size

1.3MB
MD5

0e49db0d206eed714574b0663d080cfa
SHA1

a7e2e9804148dbac51ccf860e0eba994b050b251
SHA256

749d45aebd98b6bdde085f4300f3a436b6d9390d41caa2c1909a89bb505e3f5a
SHA512

8d5cfd219ee419ff1ead6cbd4b50566994134edf8820a55df7a4c266e496ded5d3001c6d9dd6fc95f6c919a3e8726998ff49a2569d43b172219a535bda7ac389
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjCr:UbA30GnzV/q+DnsXgt

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 51 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2892	2992	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2228	2992	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2640	2992	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2888	2992	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2620	2992	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2648	2992	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2000	2992	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2248	2992	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1960	2992	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1492	2992	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2856	2992	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1828	2992	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1832	2992	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2504	2992	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1664	2992	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1548	2992	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	356	2992	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1596	2992	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1040	2992	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1976	2992	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2944	2992	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3044	2992	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2348	2992	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2252	2992	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2240	2992	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2352	2992	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	348	2992	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1688	2992	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	900	2992	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	664	2992	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1984	2992	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	940	2992	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2460	2992	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	776	2992	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	532	2992	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2720	2992	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	892	2992	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1564	2992	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	600	2992	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2132	2992	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2464	2992	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2208	2992	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1504	2992	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2260	2992	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1044	2992	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1292	2992	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1264	2992	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2024	2992	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1656	2992	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1712	2992	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2984	2992	schtasks.exe	35

DCRat payload 11 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0007000000015cdc-9.dat	dcrat
behavioral1/memory/2980-13-0x0000000000B70000-0x0000000000C80000-memory.dmp	dcrat
behavioral1/memory/2896-58-0x0000000001290000-0x00000000013A0000-memory.dmp	dcrat
behavioral1/memory/2784-259-0x0000000000230000-0x0000000000340000-memory.dmp	dcrat
behavioral1/memory/2824-319-0x0000000000050000-0x0000000000160000-memory.dmp	dcrat
behavioral1/memory/1660-379-0x00000000011D0000-0x00000000012E0000-memory.dmp	dcrat
behavioral1/memory/1832-439-0x0000000000030000-0x0000000000140000-memory.dmp	dcrat
behavioral1/memory/2712-500-0x0000000000390000-0x00000000004A0000-memory.dmp	dcrat
behavioral1/memory/2936-560-0x0000000000DA0000-0x0000000000EB0000-memory.dmp	dcrat
behavioral1/memory/2352-620-0x0000000000210000-0x0000000000320000-memory.dmp	dcrat
behavioral1/memory/2200-680-0x0000000000E40000-0x0000000000F50000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 18 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2800	powershell.exe
2844	powershell.exe
2064	powershell.exe
2520	powershell.exe
3032	powershell.exe
3004	powershell.exe
2808	powershell.exe
1992	powershell.exe
2588	powershell.exe
2416	powershell.exe
2760	powershell.exe
2864	powershell.exe
2548	powershell.exe
3040	powershell.exe
2772	powershell.exe
2756	powershell.exe
2392	powershell.exe
1744	powershell.exe

Executes dropped EXE 11 IoCs

pid	Process
2980	DllCommonsvc.exe
2896	OSPPSVC.exe
2776	OSPPSVC.exe
2784	OSPPSVC.exe
2824	OSPPSVC.exe
1660	OSPPSVC.exe
1832	OSPPSVC.exe
2712	OSPPSVC.exe
2936	OSPPSVC.exe
2352	OSPPSVC.exe
2200	OSPPSVC.exe

Loads dropped DLL 2 IoCs

pid	Process
2424	cmd.exe
2424	cmd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 10 IoCs

Web Service

T1102

flow	ioc
4	raw.githubusercontent.com
9	raw.githubusercontent.com
12	raw.githubusercontent.com
19	raw.githubusercontent.com
22	raw.githubusercontent.com
33	raw.githubusercontent.com
5	raw.githubusercontent.com
15	raw.githubusercontent.com
25	raw.githubusercontent.com
29	raw.githubusercontent.com

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\MSBuild\6203df4a6bafc7	DllCommonsvc.exe
File created	C:\Program Files\Reference Assemblies\cmd.exe	DllCommonsvc.exe
File created	C:\Program Files\Reference Assemblies\ebf1f9fa8afd6d	DllCommonsvc.exe
File created	C:\Program Files\Windows Portable Devices\winlogon.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows NT\Accessories\fr-FR\csrss.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\MSBuild\Idle.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\MSBuild\6ccacd8608530f	DllCommonsvc.exe
File created	C:\Program Files (x86)\MSBuild\lsass.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Portable Devices\cc11b995f2a76d	DllCommonsvc.exe
File created	C:\Program Files\Windows NT\Accessories\fr-FR\886983d96e3d3e	DllCommonsvc.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\Setup\State\5940a34987c991	DllCommonsvc.exe
File created	C:\Windows\DigitalLocker\en-US\dllhost.exe	DllCommonsvc.exe
File created	C:\Windows\DigitalLocker\en-US\5940a34987c991	DllCommonsvc.exe
File created	C:\Windows\PCHEALTH\smss.exe	DllCommonsvc.exe
File created	C:\Windows\PCHEALTH\69ddcba757bf72	DllCommonsvc.exe
File created	C:\Windows\Setup\State\dllhost.exe	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	749d45aebd98b6bdde085f4300f3a436b6d9390d41caa2c1909a89bb505e3f5a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 51 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1832	schtasks.exe
1664	schtasks.exe
600	schtasks.exe
1044	schtasks.exe
1504	schtasks.exe
2984	schtasks.exe
2888	schtasks.exe
1828	schtasks.exe
1984	schtasks.exe
776	schtasks.exe
892	schtasks.exe
1264	schtasks.exe
1656	schtasks.exe
1548	schtasks.exe
2352	schtasks.exe
2460	schtasks.exe
2132	schtasks.exe
2260	schtasks.exe
900	schtasks.exe
664	schtasks.exe
2228	schtasks.exe
2640	schtasks.exe
2620	schtasks.exe
1596	schtasks.exe
3044	schtasks.exe
2248	schtasks.exe
2504	schtasks.exe
2240	schtasks.exe
2024	schtasks.exe
2464	schtasks.exe
2648	schtasks.exe
1960	schtasks.exe
2856	schtasks.exe
2944	schtasks.exe
2348	schtasks.exe
940	schtasks.exe
1712	schtasks.exe
2892	schtasks.exe
356	schtasks.exe
1040	schtasks.exe
2252	schtasks.exe
348	schtasks.exe
2720	schtasks.exe
1564	schtasks.exe
2208	schtasks.exe
2000	schtasks.exe
1492	schtasks.exe
1976	schtasks.exe
1688	schtasks.exe
532	schtasks.exe
1292	schtasks.exe

Suspicious behavior: EnumeratesProcesses 29 IoCs

pid	Process
2980	DllCommonsvc.exe
1992	powershell.exe
2520	powershell.exe
1744	powershell.exe
2772	powershell.exe
2756	powershell.exe
2896	OSPPSVC.exe
3040	powershell.exe
2800	powershell.exe
2416	powershell.exe
3004	powershell.exe
2808	powershell.exe
2064	powershell.exe
2844	powershell.exe
2392	powershell.exe
2864	powershell.exe
2588	powershell.exe
2548	powershell.exe
3032	powershell.exe
2760	powershell.exe
2776	OSPPSVC.exe
2784	OSPPSVC.exe
2824	OSPPSVC.exe
1660	OSPPSVC.exe
1832	OSPPSVC.exe
2712	OSPPSVC.exe
2936	OSPPSVC.exe
2352	OSPPSVC.exe
2200	OSPPSVC.exe

Suspicious use of AdjustPrivilegeToken 29 IoCs

description	pid	Process
Token: SeDebugPrivilege	2980	DllCommonsvc.exe
Token: SeDebugPrivilege	1992	powershell.exe
Token: SeDebugPrivilege	2520	powershell.exe
Token: SeDebugPrivilege	1744	powershell.exe
Token: SeDebugPrivilege	2772	powershell.exe
Token: SeDebugPrivilege	2896	OSPPSVC.exe
Token: SeDebugPrivilege	2756	powershell.exe
Token: SeDebugPrivilege	3040	powershell.exe
Token: SeDebugPrivilege	2800	powershell.exe
Token: SeDebugPrivilege	2416	powershell.exe
Token: SeDebugPrivilege	3004	powershell.exe
Token: SeDebugPrivilege	2808	powershell.exe
Token: SeDebugPrivilege	2064	powershell.exe
Token: SeDebugPrivilege	2844	powershell.exe
Token: SeDebugPrivilege	2392	powershell.exe
Token: SeDebugPrivilege	2864	powershell.exe
Token: SeDebugPrivilege	2588	powershell.exe
Token: SeDebugPrivilege	2548	powershell.exe
Token: SeDebugPrivilege	3032	powershell.exe
Token: SeDebugPrivilege	2760	powershell.exe
Token: SeDebugPrivilege	2776	OSPPSVC.exe
Token: SeDebugPrivilege	2784	OSPPSVC.exe
Token: SeDebugPrivilege	2824	OSPPSVC.exe
Token: SeDebugPrivilege	1660	OSPPSVC.exe
Token: SeDebugPrivilege	1832	OSPPSVC.exe
Token: SeDebugPrivilege	2712	OSPPSVC.exe
Token: SeDebugPrivilege	2936	OSPPSVC.exe
Token: SeDebugPrivilege	2352	OSPPSVC.exe
Token: SeDebugPrivilege	2200	OSPPSVC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 2328	2548	749d45aebd98b6bdde085f4300f3a436b6d9390d41caa2c1909a89bb505e3f5a.exe	30
PID 2548 wrote to memory of 2328	2548	749d45aebd98b6bdde085f4300f3a436b6d9390d41caa2c1909a89bb505e3f5a.exe	30
PID 2548 wrote to memory of 2328	2548	749d45aebd98b6bdde085f4300f3a436b6d9390d41caa2c1909a89bb505e3f5a.exe	30
PID 2548 wrote to memory of 2328	2548	749d45aebd98b6bdde085f4300f3a436b6d9390d41caa2c1909a89bb505e3f5a.exe	30
PID 2328 wrote to memory of 2424	2328	WScript.exe	31
PID 2328 wrote to memory of 2424	2328	WScript.exe	31
PID 2328 wrote to memory of 2424	2328	WScript.exe	31
PID 2328 wrote to memory of 2424	2328	WScript.exe	31
PID 2424 wrote to memory of 2980	2424	cmd.exe	33
PID 2424 wrote to memory of 2980	2424	cmd.exe	33
PID 2424 wrote to memory of 2980	2424	cmd.exe	33
PID 2424 wrote to memory of 2980	2424	cmd.exe	33
PID 2980 wrote to memory of 1992	2980	DllCommonsvc.exe	87
PID 2980 wrote to memory of 1992	2980	DllCommonsvc.exe	87
PID 2980 wrote to memory of 1992	2980	DllCommonsvc.exe	87
PID 2980 wrote to memory of 2588	2980	DllCommonsvc.exe	88
PID 2980 wrote to memory of 2588	2980	DllCommonsvc.exe	88
PID 2980 wrote to memory of 2588	2980	DllCommonsvc.exe	88
PID 2980 wrote to memory of 2064	2980	DllCommonsvc.exe	89
PID 2980 wrote to memory of 2064	2980	DllCommonsvc.exe	89
PID 2980 wrote to memory of 2064	2980	DllCommonsvc.exe	89
PID 2980 wrote to memory of 3032	2980	DllCommonsvc.exe	90
PID 2980 wrote to memory of 3032	2980	DllCommonsvc.exe	90
PID 2980 wrote to memory of 3032	2980	DllCommonsvc.exe	90
PID 2980 wrote to memory of 2548	2980	DllCommonsvc.exe	91
PID 2980 wrote to memory of 2548	2980	DllCommonsvc.exe	91
PID 2980 wrote to memory of 2548	2980	DllCommonsvc.exe	91
PID 2980 wrote to memory of 2520	2980	DllCommonsvc.exe	93
PID 2980 wrote to memory of 2520	2980	DllCommonsvc.exe	93
PID 2980 wrote to memory of 2520	2980	DllCommonsvc.exe	93
PID 2980 wrote to memory of 2392	2980	DllCommonsvc.exe	94
PID 2980 wrote to memory of 2392	2980	DllCommonsvc.exe	94
PID 2980 wrote to memory of 2392	2980	DllCommonsvc.exe	94
PID 2980 wrote to memory of 3040	2980	DllCommonsvc.exe	95
PID 2980 wrote to memory of 3040	2980	DllCommonsvc.exe	95
PID 2980 wrote to memory of 3040	2980	DllCommonsvc.exe	95
PID 2980 wrote to memory of 2416	2980	DllCommonsvc.exe	96
PID 2980 wrote to memory of 2416	2980	DllCommonsvc.exe	96
PID 2980 wrote to memory of 2416	2980	DllCommonsvc.exe	96
PID 2980 wrote to memory of 1744	2980	DllCommonsvc.exe	99
PID 2980 wrote to memory of 1744	2980	DllCommonsvc.exe	99
PID 2980 wrote to memory of 1744	2980	DllCommonsvc.exe	99
PID 2980 wrote to memory of 2800	2980	DllCommonsvc.exe	100
PID 2980 wrote to memory of 2800	2980	DllCommonsvc.exe	100
PID 2980 wrote to memory of 2800	2980	DllCommonsvc.exe	100
PID 2980 wrote to memory of 2844	2980	DllCommonsvc.exe	101
PID 2980 wrote to memory of 2844	2980	DllCommonsvc.exe	101
PID 2980 wrote to memory of 2844	2980	DllCommonsvc.exe	101
PID 2980 wrote to memory of 3004	2980	DllCommonsvc.exe	102
PID 2980 wrote to memory of 3004	2980	DllCommonsvc.exe	102
PID 2980 wrote to memory of 3004	2980	DllCommonsvc.exe	102
PID 2980 wrote to memory of 2772	2980	DllCommonsvc.exe	103
PID 2980 wrote to memory of 2772	2980	DllCommonsvc.exe	103
PID 2980 wrote to memory of 2772	2980	DllCommonsvc.exe	103
PID 2980 wrote to memory of 2760	2980	DllCommonsvc.exe	104
PID 2980 wrote to memory of 2760	2980	DllCommonsvc.exe	104
PID 2980 wrote to memory of 2760	2980	DllCommonsvc.exe	104
PID 2980 wrote to memory of 2864	2980	DllCommonsvc.exe	105
PID 2980 wrote to memory of 2864	2980	DllCommonsvc.exe	105
PID 2980 wrote to memory of 2864	2980	DllCommonsvc.exe	105
PID 2980 wrote to memory of 2808	2980	DllCommonsvc.exe	106
PID 2980 wrote to memory of 2808	2980	DllCommonsvc.exe	106
PID 2980 wrote to memory of 2808	2980	DllCommonsvc.exe	106
PID 2980 wrote to memory of 2756	2980	DllCommonsvc.exe	107

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\749d45aebd98b6bdde085f4300f3a436b6d9390d41caa2c1909a89bb505e3f5a.exe
"C:\Users\Admin\AppData\Local\Temp\749d45aebd98b6bdde085f4300f3a436b6d9390d41caa2c1909a89bb505e3f5a.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2328
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2424
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2980
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1992
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2588
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\OSPPSVC.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2064
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\cmd.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3032
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\services.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2548
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\MSBuild\Idle.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2520
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\lsm.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2392
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Setup\State\dllhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3040
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\MSBuild\lsass.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2416
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Reference Assemblies\cmd.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1744
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2800
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\wininit.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2844
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Searches\dllhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3004
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\System.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2772
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\DigitalLocker\en-US\dllhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2760
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Portable Devices\winlogon.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2864
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows NT\Accessories\fr-FR\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2808
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\PCHEALTH\smss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2756
    - - C:\Users\Default User\OSPPSVC.exe
        
        "C:\Users\Default User\OSPPSVC.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2896
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\vhtd8auDHa.bat"
        6⤵
        
        PID:2576
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:2928
        
        C:\Users\Default User\OSPPSVC.exe
        
        "C:\Users\Default User\OSPPSVC.exe"
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2776
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Jobc5AEC9X.bat"
        8⤵
        
        PID:2836
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:2184
        
        C:\Users\Default User\OSPPSVC.exe
        
        "C:\Users\Default User\OSPPSVC.exe"
        9⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2784
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\q3WH03M43W.bat"
        10⤵
        
        PID:688
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:1868
        
        C:\Users\Default User\OSPPSVC.exe
        
        "C:\Users\Default User\OSPPSVC.exe"
        11⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2824
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\GX2kvMhQbI.bat"
        12⤵
        
        PID:1880
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:1852
        
        C:\Users\Default User\OSPPSVC.exe
        
        "C:\Users\Default User\OSPPSVC.exe"
        13⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1660
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\x5nMQhEI33.bat"
        14⤵
        
        PID:2788
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        15⤵
        
        PID:584
        
        C:\Users\Default User\OSPPSVC.exe
        
        "C:\Users\Default User\OSPPSVC.exe"
        15⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1832
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\j95GpUP4tv.bat"
        16⤵
        
        PID:860
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        17⤵
        
        PID:2220
        
        C:\Users\Default User\OSPPSVC.exe
        
        "C:\Users\Default User\OSPPSVC.exe"
        17⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2712
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\WYuyh03jyF.bat"
        18⤵
        
        PID:1616
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        19⤵
        
        PID:2980
        
        C:\Users\Default User\OSPPSVC.exe
        
        "C:\Users\Default User\OSPPSVC.exe"
        19⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2936
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\DGa94wSM8j.bat"
        20⤵
        
        PID:2896
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        21⤵
        
        PID:2104
        
        C:\Users\Default User\OSPPSVC.exe
        
        "C:\Users\Default User\OSPPSVC.exe"
        21⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2352
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\yTtrehocny.bat"
        22⤵
        
        PID:564
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        23⤵
        
        PID:2100
        
        C:\Users\Default User\OSPPSVC.exe
        
        "C:\Users\Default User\OSPPSVC.exe"
        23⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 9 /tr "'C:\Users\Default User\OSPPSVC.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Users\Default User\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 6 /tr "'C:\Users\Default User\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 8 /tr "'C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 6 /tr "'C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 7 /tr "'C:\Users\Public\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Users\Public\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 5 /tr "'C:\Users\Public\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\MSBuild\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\MSBuild\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 10 /tr "'C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 11 /tr "'C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Windows\Setup\State\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\Setup\State\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Windows\Setup\State\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\MSBuild\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\MSBuild\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2252

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 9 /tr "'C:\Program Files\Reference Assemblies\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2240

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Program Files\Reference Assemblies\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 14 /tr "'C:\Program Files\Reference Assemblies\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 11 /tr "'C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 8 /tr "'C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\Searches\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Admin\Searches\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\Searches\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 9 /tr "'C:\providercommon\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\providercommon\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 9 /tr "'C:\providercommon\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Windows\DigitalLocker\en-US\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2132

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\DigitalLocker\en-US\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Windows\DigitalLocker\en-US\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Portable Devices\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2260

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Portable Devices\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows NT\Accessories\fr-FR\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Windows NT\Accessories\fr-FR\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1264

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows NT\Accessories\fr-FR\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 7 /tr "'C:\Windows\PCHEALTH\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\PCHEALTH\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 14 /tr "'C:\Windows\PCHEALTH\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b1a47b519d6bfc01991eb24410845dfa

SHA1
28fd92fee2b037f9beb9861dc7e1849fe6faaf49

SHA256
67935dbfa644ecde696fa8138f8e4cd3a65d3b741d1a8828e7394fd7b11f706d

SHA512
1239b328a0b17bacb28fddb88ad05e49ef42fef4060388ff7e70d794b72c68ff7c606d81cfe7e7151c00d1771a14191edf672013e376218ffceb1444403af284

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eb2dc76267498bbfda345c0541d2aff4

SHA1
621bb39c523ebc363a1f5256a2b1f56a734b166a

SHA256
ec166e6168d47c19073fe7fd8599597a25b138ec6467f6d9b6542cf21df675bd

SHA512
58615299bb0c5fcfc88fb0a66803b7f0bf8b5fd26a005f738264de8a3166f49611c8db3c4284cf03c4caee16fea69f913c42b26ad8ae3edfe860e0021cc7c9ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cfdcf085bb6d5c33f412580565043f3d

SHA1
ca5c14cb13e640af54c76288175e6dec4bcdcf9d

SHA256
3c8fb5350159b1add130fe83778776b389849abbcb9c3f5a0c88e057b2447aa4

SHA512
4343f794322fcd168fc7b6abbe7ea05ee91b07527ea266c8278bde8adfafe3e7faadd761d98fc4ea4a373daff2bf701f46dfba5a2e605b028975e9051a51cad3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dbcc03e481fec25f427c68bebd734ddc

SHA1
acbb5342b4c9618161ec28c884ab69ad969fa6cf

SHA256
6ae8a3c10870005c58a8f37640de7ed42492bbd44758b3a40d1af3e37374e315

SHA512
c46fb36a54d89a3c1d912c1554222ccdbe0df952dd550e48a523f0d6edfd63e2c69e1029edd56a48c0ace20f4275844ed37ae9e8cf43b554bc818c748d4e2ac8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
817b44eff592b62cfd8ce3915cc89ba3

SHA1
0ee9dca47022006046f60bdb1f154a9e8bae0bb3

SHA256
188c96f51a8b29dace18f645249f3934b7251f901b8b02e96076e286006d8bb7

SHA512
c8fd536e23b81874e5740014e0c6e343f91a3a6aeee6fa7e456eccd46bdd9f187298d1f117da7c43bb98287cfdfd154bbd7949b8b162f2c856d7e24e18e5dbfd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2dadc6ff2c4a65711a4576f504035992

SHA1
120fcb88d1d4f0fa990f49088d411b99d89f51b5

SHA256
9dae55e024be19a8bda831277faa3b05d59d61bdd28be255e04e40725f0df2cc

SHA512
89858c236e50b9aeefc2d7e444215da31b3a86f08c1715419882fb2cf2a70a7e7420fb4e5b0f0346f589798d92e2ef5ae29ca5c3b92035419ba3cca0e6210f79

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3c146b30b37f9ea384c67698641cca1a

SHA1
208397e5784567372983e10181b8db93c9ff4a3a

SHA256
67c57d86f512012c5fb3da940c745c37fa319d9e3e89e3eeaf7751226a8e3f9f

SHA512
a0ac5f7f3de45b311e45d1351821476b8e4334e6a65c37bc9698223cd8342b5d6754d5cfa5a5bef876d7a58ef80f42d856a50d1093eccc394004c6da72548372

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e81bb7bbe144e2b3fe79df4b2bfab7eb

SHA1
6ba3bc7a9a3887e6224e33332d6e623389b7fabc

SHA256
e374b97c7c9f54f0889f256c605986c48ab9c23e13c03eaff191f01d230e0447

SHA512
33a86ac8d5aeffd98d6c7f0f2fba1bda4adbb059c9c955cb0026e62d538a6b82a9aa0a0102702451e6576b4b02c6d83c687e3c7e5743097ccb8c23a8a3764d4c

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabEC44.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\DGa94wSM8j.bat

Filesize
198B

MD5
f36bcc03fdf58cf439a2e4e6001099da

SHA1
3f16a277c65bd0aa45add3e93f4e1f151c27203a

SHA256
6c9179c9cf70757e19638e9ef7a67719920b892fe12d94dbac45a731e7d91f7b

SHA512
8c82ed8b740f426b7d7b63b679187f002aa82afe0eb2d8661aa130142f144750cd5403024086440226f9ac5816fdfa0578ba156ded66bb0e1b6e86deca9c682f

Download Submit
C:\Users\Admin\AppData\Local\Temp\GX2kvMhQbI.bat

Filesize
198B

MD5
19748758ebfa4e6ffff53c94f9364569

SHA1
648d4e774c0389feff31bc72011c1549a75a9be0

SHA256
04668d8e74573845c081ca034dc125c1d447ceba300f98d353463be5940f7965

SHA512
1135b96aa1a90787445ff12a289ebede7467b52412dba74615923d7ceb9c3c49e76cd1d304fc79ccb62598056ea3ffab52920e951d879401792e7df698d51ef9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Jobc5AEC9X.bat

Filesize
198B

MD5
4359616a246fc5ac34de040f5e6a4561

SHA1
962d49496ef484268df3bc7b43a7a7b4d488e824

SHA256
7357233bc394432e1fc607195c984939d3d0d89e2c7117ed1a5336c91de4fa02

SHA512
87a73f5422899f2dcb4a4aaa507d7a4ba66190c75aac69671c7f2ff1e757dcfb79d2bb0154a0be188edc5cccba851d9794423cacad49a560e0c476f7c688c20b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarEC57.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\WYuyh03jyF.bat

Filesize
198B

MD5
f51a9d3bd1b10d9c2eb7fa05bdfd7edd

SHA1
a86c00ed4f4c5a09d919320fade224ca3519e857

SHA256
79c2413da27706a8507a104e62ddb84e4dc406c7f610284efd99a07e628ef0d1

SHA512
0f67d0d922c38e8c9b92c791acb10b5c08927ac9c5b983763db3dd27203f419642c66c850414e126b8e2a5f7eeed0b038e4cdc5fb0472092c4b7db849b000d99

Download Submit
C:\Users\Admin\AppData\Local\Temp\j95GpUP4tv.bat

Filesize
198B

MD5
4811ff9d3efb0874b743debbd685fdfb

SHA1
7d5c4b50fd7a0fb8cb4284f7203e768e81c0bbb1

SHA256
f6ab7ef6d164f801d662e181f00e15d6a3db6d190ff933c8669c8347bc7bd1ad

SHA512
a70c332038d779c42cd68005ddf034ab473b32e74781fdaa7e4c8ed2deebad73b2f6056966b4cd33ab96305a0f54a1e66507db75f1b4495cbf59abe77b8bd00f

Download Submit
C:\Users\Admin\AppData\Local\Temp\q3WH03M43W.bat

Filesize
198B

MD5
068b1323e2b2e1d0317cc40f65c05794

SHA1
6e87844d4708d81e0616a7476255a397e84dd18b

SHA256
0a6fa8e9423370009c7671168ca714ebe222456f7484b7e679f1baf53ba61085

SHA512
09b44fbb0931f38fdf71cae3c19a2583ee35dc87b1c311e2c867933ce5ad803078f9dbb769a29a9916d43af99564f7e33f997a5e347f1a07611665693fe5055e

Download Submit
C:\Users\Admin\AppData\Local\Temp\vhtd8auDHa.bat

Filesize
198B

MD5
770ac9132f3e3844a2ea5ba1f271144e

SHA1
98eec061a0dcc23c2a2944045bc85008dfba4514

SHA256
565cba751e542ccb1a142f554b49bed15c2ce9b12385547e5a027ec8514e82dc

SHA512
03e1e0b09e0e986f74d034f3baf393a9340a114dd86ef58385f85b5a349d84ac7e278a90b124d0898c961ab0abdadabba9ebe895acb3fa4fac85e19409dff473

Download Submit
C:\Users\Admin\AppData\Local\Temp\x5nMQhEI33.bat

Filesize
198B

MD5
243944547de779037ca0f6d0ad6e48d6

SHA1
ec60f8b5cc0ae3f424789ab8f90466b403aac76b

SHA256
d9916c466ddfe22965fbe8ee77eeadec90ea6a91515db1e1c8b2e16a8e9fe42b

SHA512
e71c5c817c56942dd3979bd51e1bcf1f4db03797babda591b55b9813a8ff47ea5b5b7be1dd9c0ca6abb4a7eda106eedea5a88d537f343b1d4939396c2209013c

Download Submit
C:\Users\Admin\AppData\Local\Temp\yTtrehocny.bat

Filesize
198B

MD5
1e6c0afd847ce96e72313a666075767b

SHA1
9a7c45fb33f9574a5f8c94eec9b6d9b0fea8b1b6

SHA256
475432277f3beba68390472ff64259aaad736e6e4cb445fd62f5ac43b523c646

SHA512
e00a31e9bcef81b23c4c4ed7a34ceb0c58808627c3a6727fc1cdd699527bce930340de392b0f2dc684a03400f26aa96102ba82c15469bb025f4b9ccc157ff991

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
a29d2ea1e808bcd876f3ab16feab0dda

SHA1
f09f211c2d7f4835d882d3b829193cd5fd363e67

SHA256
ae93c2dd7528ed2d4b59fef0259a546341626ac487e1069dc03641c651d14719

SHA512
cf9da56cbb826a955f38ae8b9fb58d625f71e21bd5a6e638052a83843ac991aa25a35215b67e943f30331fb0f2f1b56a8d5a4293a619681afe258f0d15afb0e5

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
memory/1660-379-0x00000000011D0000-0x00000000012E0000-memory.dmp

Filesize
1.1MB

Download
memory/1832-440-0x00000000004E0000-0x00000000004F2000-memory.dmp

Filesize
72KB

Download
memory/1832-439-0x0000000000030000-0x0000000000140000-memory.dmp

Filesize
1.1MB

Download
memory/1992-79-0x000000001B650000-0x000000001B932000-memory.dmp

Filesize
2.9MB

Download
memory/2200-680-0x0000000000E40000-0x0000000000F50000-memory.dmp

Filesize
1.1MB

Download
memory/2352-620-0x0000000000210000-0x0000000000320000-memory.dmp

Filesize
1.1MB

Download
memory/2712-500-0x0000000000390000-0x00000000004A0000-memory.dmp

Filesize
1.1MB

Download
memory/2772-80-0x0000000002040000-0x0000000002048000-memory.dmp

Filesize
32KB

Download
memory/2776-199-0x0000000000340000-0x0000000000352000-memory.dmp

Filesize
72KB

Download
memory/2784-259-0x0000000000230000-0x0000000000340000-memory.dmp

Filesize
1.1MB

Download
memory/2824-319-0x0000000000050000-0x0000000000160000-memory.dmp

Filesize
1.1MB

Download
memory/2896-58-0x0000000001290000-0x00000000013A0000-memory.dmp

Filesize
1.1MB

Download
memory/2936-560-0x0000000000DA0000-0x0000000000EB0000-memory.dmp

Filesize
1.1MB

Download
memory/2980-16-0x0000000000460000-0x000000000046C000-memory.dmp

Filesize
48KB

Download
memory/2980-13-0x0000000000B70000-0x0000000000C80000-memory.dmp

Filesize
1.1MB

Download
memory/2980-14-0x0000000000440000-0x0000000000452000-memory.dmp

Filesize
72KB

Download
memory/2980-15-0x0000000000450000-0x000000000045C000-memory.dmp

Filesize
48KB

Download
memory/2980-17-0x0000000000470000-0x000000000047C000-memory.dmp

Filesize
48KB

Download