dcrat | 854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
11-01-2025 23:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe
Size

1.7MB
MD5

f2a682c815b566f24cddcaa11469c774
SHA1

9fa7e11c793432e8aebfb2ed67bd3963dd5459ba
SHA256

854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c
SHA512

95d46731c94157862fb2e45c23b5b2bf3e8718366a814f7e3c8270f89ad413f392df430088cffc80996ccab159cace9e18d4ff36ca1b6d0a183b75051f9431ec
SSDEEP

24576:N3QwuLyEbVoCtPreIjNLoN/VNGeSQDx1m17zezKOkCzeJGFUJ0:NgwuuEpdDLNwVMeXDL0fdSzAGH

Score

10^/10

dcrat execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 42 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2880	2768	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2900	2768	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3068	2768	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2952	2768	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2764	2768	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1528	2768	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2868	2768	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2696	2768	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2752	2768	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	524	2768	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1832	2768	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1144	2768	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3016	2768	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2644	2768	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1880	2768	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1504	2768	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2944	2768	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2368	2768	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2020	2768	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1996	2768	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1484	2768	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1976	2768	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2916	2768	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2940	2768	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2280	2768	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2252	2768	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2396	2768	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1868	2768	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	880	2768	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1492	2768	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	432	2768	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3032	2768	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1160	2768	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1752	2768	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1616	2768	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	236	2768	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1184	2768	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1148	2768	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1884	2768	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2640	2768	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1648	2768	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2540	2768	schtasks.exe	30

DCRat payload 5 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/memory/2060-1-0x0000000000D60000-0x0000000000F16000-memory.dmp	dcrat
behavioral1/files/0x00050000000195bd-29.dat	dcrat
behavioral1/files/0x000600000001a488-99.dat	dcrat
behavioral1/files/0x000e0000000195b5-184.dat	dcrat
behavioral1/memory/1144-247-0x0000000001230000-0x00000000013E6000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
968	powershell.exe
2800	powershell.exe
2484	powershell.exe
1980	powershell.exe
2440	powershell.exe
2860	powershell.exe
1460	powershell.exe
1652	powershell.exe
2660	powershell.exe
1036	powershell.exe
1324	powershell.exe
1064	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe

Executes dropped EXE 2 IoCs

pid	Process
1144	WmiPrvSE.exe
1380	WmiPrvSE.exe

Drops file in Program Files directory 30 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Mail\854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe
File created	C:\Program Files (x86)\MSBuild\6203df4a6bafc7	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\ja-JP\services.exe	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\886983d96e3d3e	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\ja-JP\RCXF53C.tmp	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe
File opened for modification	C:\Program Files\Windows Mail\RCXF964.tmp	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe
File opened for modification	C:\Program Files\Windows Mail\RCXFA01.tmp	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe
File opened for modification	C:\Program Files (x86)\MSBuild\RCXFC93.tmp	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe
File opened for modification	C:\Program Files\Microsoft Games\FreeCell\it-IT\RCX784.tmp	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe
File created	C:\Program Files (x86)\Windows Defender\ja-JP\c5b4cb5e9653cc	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\csrss.exe	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe
File created	C:\Program Files\DVD Maker\it-IT\smss.exe	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe
File created	C:\Program Files\DVD Maker\it-IT\69ddcba757bf72	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe
File opened for modification	C:\Program Files (x86)\MSBuild\RCXFC82.tmp	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe
File opened for modification	C:\Program Files\Microsoft Games\FreeCell\it-IT\csrss.exe	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe
File created	C:\Program Files\Microsoft Games\FreeCell\it-IT\886983d96e3d3e	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe
File opened for modification	C:\Program Files (x86)\MSBuild\lsass.exe	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe
File opened for modification	C:\Program Files\DVD Maker\it-IT\RCXE8C.tmp	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe
File opened for modification	C:\Program Files\DVD Maker\it-IT\RCXE9D.tmp	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe
File created	C:\Program Files (x86)\Windows Defender\ja-JP\services.exe	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe
File created	C:\Program Files\Microsoft Games\FreeCell\it-IT\csrss.exe	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe
File opened for modification	C:\Program Files\Microsoft Games\FreeCell\it-IT\RCX795.tmp	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe
File opened for modification	C:\Program Files (x86)\MSBuild\Microsoft\RCXC88.tmp	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe
File opened for modification	C:\Program Files\Windows Mail\854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe
File opened for modification	C:\Program Files (x86)\MSBuild\Microsoft\RCXC78.tmp	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe
File created	C:\Program Files (x86)\MSBuild\lsass.exe	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\ja-JP\RCXF54C.tmp	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe
File opened for modification	C:\Program Files\DVD Maker\it-IT\smss.exe	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe
File created	C:\Program Files\Windows Mail\82a865fd2a1aa1	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe
File opened for modification	C:\Program Files (x86)\MSBuild\Microsoft\csrss.exe	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\CSC\v2.0.6\sppsvc.exe	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 42 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3016	schtasks.exe
2944	schtasks.exe
1996	schtasks.exe
1484	schtasks.exe
2940	schtasks.exe
2396	schtasks.exe
1144	schtasks.exe
1752	schtasks.exe
1648	schtasks.exe
2696	schtasks.exe
2764	schtasks.exe
1528	schtasks.exe
1832	schtasks.exe
1976	schtasks.exe
1492	schtasks.exe
1184	schtasks.exe
1148	schtasks.exe
2900	schtasks.exe
2252	schtasks.exe
3032	schtasks.exe
2952	schtasks.exe
1880	schtasks.exe
1504	schtasks.exe
2916	schtasks.exe
2280	schtasks.exe
1868	schtasks.exe
880	schtasks.exe
236	schtasks.exe
3068	schtasks.exe
2368	schtasks.exe
1616	schtasks.exe
2540	schtasks.exe
524	schtasks.exe
2752	schtasks.exe
2644	schtasks.exe
2020	schtasks.exe
2868	schtasks.exe
432	schtasks.exe
1160	schtasks.exe
1884	schtasks.exe
2640	schtasks.exe
2880	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2060	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe
2060	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe
2060	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe
2060	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe
2060	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe
2060	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe
2060	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe
2060	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe
2060	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe
2060	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe
2060	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe
2060	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe
2060	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe
2060	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe
2060	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe
2060	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe
2060	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe
2060	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe
2060	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe
2060	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe
2060	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe
2060	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe
2060	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe
2060	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe
2060	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe
2060	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe
2060	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe
2060	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe
2060	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe
2060	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe
2060	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe
2060	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe
2060	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe
2060	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe
2060	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe
2060	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe
2060	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe
2060	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe
2060	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe
2060	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe
2060	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe
2060	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe
2060	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe
2060	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe
2060	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe
2060	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe
2060	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe
2060	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe
2060	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe
2060	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe
2060	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe
2060	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe
2060	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe
2060	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe
2060	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe
2060	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe
2060	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe
2060	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe
2060	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe
2060	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe
2060	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe
2484	powershell.exe
1980	powershell.exe
2800	powershell.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeDebugPrivilege	2060	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe
Token: SeDebugPrivilege	2484	powershell.exe
Token: SeDebugPrivilege	1980	powershell.exe
Token: SeDebugPrivilege	2800	powershell.exe
Token: SeDebugPrivilege	1652	powershell.exe
Token: SeDebugPrivilege	968	powershell.exe
Token: SeDebugPrivilege	2660	powershell.exe
Token: SeDebugPrivilege	1036	powershell.exe
Token: SeDebugPrivilege	2860	powershell.exe
Token: SeDebugPrivilege	2440	powershell.exe
Token: SeDebugPrivilege	1324	powershell.exe
Token: SeDebugPrivilege	1460	powershell.exe
Token: SeDebugPrivilege	1144	WmiPrvSE.exe
Token: SeDebugPrivilege	1064	powershell.exe
Token: SeDebugPrivilege	1380	WmiPrvSE.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 2800	2060	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe	74
PID 2060 wrote to memory of 2800	2060	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe	74
PID 2060 wrote to memory of 2800	2060	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe	74
PID 2060 wrote to memory of 2484	2060	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe	75
PID 2060 wrote to memory of 2484	2060	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe	75
PID 2060 wrote to memory of 2484	2060	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe	75
PID 2060 wrote to memory of 1652	2060	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe	76
PID 2060 wrote to memory of 1652	2060	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe	76
PID 2060 wrote to memory of 1652	2060	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe	76
PID 2060 wrote to memory of 2440	2060	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe	78
PID 2060 wrote to memory of 2440	2060	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe	78
PID 2060 wrote to memory of 2440	2060	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe	78
PID 2060 wrote to memory of 1980	2060	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe	79
PID 2060 wrote to memory of 1980	2060	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe	79
PID 2060 wrote to memory of 1980	2060	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe	79
PID 2060 wrote to memory of 2660	2060	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe	81
PID 2060 wrote to memory of 2660	2060	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe	81
PID 2060 wrote to memory of 2660	2060	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe	81
PID 2060 wrote to memory of 1064	2060	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe	82
PID 2060 wrote to memory of 1064	2060	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe	82
PID 2060 wrote to memory of 1064	2060	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe	82
PID 2060 wrote to memory of 1324	2060	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe	85
PID 2060 wrote to memory of 1324	2060	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe	85
PID 2060 wrote to memory of 1324	2060	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe	85
PID 2060 wrote to memory of 968	2060	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe	87
PID 2060 wrote to memory of 968	2060	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe	87
PID 2060 wrote to memory of 968	2060	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe	87
PID 2060 wrote to memory of 1460	2060	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe	88
PID 2060 wrote to memory of 1460	2060	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe	88
PID 2060 wrote to memory of 1460	2060	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe	88
PID 2060 wrote to memory of 1036	2060	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe	90
PID 2060 wrote to memory of 1036	2060	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe	90
PID 2060 wrote to memory of 1036	2060	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe	90
PID 2060 wrote to memory of 2860	2060	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe	91
PID 2060 wrote to memory of 2860	2060	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe	91
PID 2060 wrote to memory of 2860	2060	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe	91
PID 2060 wrote to memory of 1144	2060	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe	98
PID 2060 wrote to memory of 1144	2060	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe	98
PID 2060 wrote to memory of 1144	2060	854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe	98
PID 1144 wrote to memory of 2744	1144	WmiPrvSE.exe	99
PID 1144 wrote to memory of 2744	1144	WmiPrvSE.exe	99
PID 1144 wrote to memory of 2744	1144	WmiPrvSE.exe	99
PID 1144 wrote to memory of 2688	1144	WmiPrvSE.exe	100
PID 1144 wrote to memory of 2688	1144	WmiPrvSE.exe	100
PID 1144 wrote to memory of 2688	1144	WmiPrvSE.exe	100
PID 2744 wrote to memory of 1380	2744	WScript.exe	101
PID 2744 wrote to memory of 1380	2744	WScript.exe	101
PID 2744 wrote to memory of 1380	2744	WScript.exe	101

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe
"C:\Users\Admin\AppData\Local\Temp\854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe"
1⤵
- Drops file in Drivers directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2800
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2484
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1652
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2440
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1980
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2660
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1064
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1324
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:968
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1460
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1036
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2860
- C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe
  "C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1144
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4d339eab-13d7-4c8e-bba9-5152e9e16d0e.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2744
  - - C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe
      "C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:1380
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4d7e10e2-8f1b-4ea0-8b4f-5743954dbc61.vbs"
    3⤵
    PID:2688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Users\Default User\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 8 /tr "'C:\Users\Default User\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Defender\ja-JP\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\ja-JP\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Defender\ja-JP\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c8" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Mail\854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c8" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Mail\854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\MSBuild\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\MSBuild\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2368

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Users\Admin\Music\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Admin\Music\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\Music\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 12 /tr "'C:\Users\Default User\OSPPSVC.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2280

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Users\Default User\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2252

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 7 /tr "'C:\Users\Default User\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Program Files\Microsoft Games\FreeCell\it-IT\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Microsoft Games\FreeCell\it-IT\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Program Files\Microsoft Games\FreeCell\it-IT\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1160

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\Microsoft\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\Program Files\DVD Maker\it-IT\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files\DVD Maker\it-IT\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1148

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 8 /tr "'C:\Program Files\DVD Maker\it-IT\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\winlogon.exe

Filesize
1.7MB

MD5
670b29c525f599efd356c66b721de8d3

SHA1
0405c3577c0b219b7dec7fc0e1c4faebe1a5de5a

SHA256
a77954645dc9622074e1c12c89a724aec84578588260469183a982963856f074

SHA512
c1b46be01544a5affc00f418cb5ac14854ef6952650ca275d59a529fc23000c36f6c56fc2ae5fdafe1296da734c9e235471440edd0a0b19193abff68783fe51a

Download Submit
C:\Program Files (x86)\MSBuild\lsass.exe

Filesize
1.7MB

MD5
f2a682c815b566f24cddcaa11469c774

SHA1
9fa7e11c793432e8aebfb2ed67bd3963dd5459ba

SHA256
854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c

SHA512
95d46731c94157862fb2e45c23b5b2bf3e8718366a814f7e3c8270f89ad413f392df430088cffc80996ccab159cace9e18d4ff36ca1b6d0a183b75051f9431ec

Download Submit
C:\Program Files\Windows Mail\854533e8d0bbf39a16975738f7d10dc32f776ad5a35963fc823796f5f780d41c.exe

Filesize
1.7MB

MD5
5e7f89a5070eaeb859558fef9e65a646

SHA1
fde80529f1ad7130e52a0a28361dc51f9d576d35

SHA256
2ff13abbbd351774bb30b6ef7d58b8f7c56f692f7ec142d1f0d9daa1747694f7

SHA512
13f4db1315989daae53f5f2fc8c845d5adfc25eeb4ea14dd162d0080c212d3b567d350240b5e946557481d716cb631d1f7cd27bd035933885683585b87a06250

Download Submit
C:\Users\Admin\AppData\Local\Temp\4d339eab-13d7-4c8e-bba9-5152e9e16d0e.vbs

Filesize
751B

MD5
e3ce87897795e38630ec3a2cb73060ca

SHA1
30bf507f68553a7771703360c63a07804a5b2d93

SHA256
5c1269a00007f0d10f582c92b748524186fab642f68c153e6e7c3169f42abf91

SHA512
53790d921e5eab4008a8ac30b1794ee74fb93ced148585ede88acad83d26ab3dee08518265a6649d44fb171ce695faa432fc55454a96b87ce1fe7e74f08d5b85

Download Submit
C:\Users\Admin\AppData\Local\Temp\4d7e10e2-8f1b-4ea0-8b4f-5743954dbc61.vbs

Filesize
527B

MD5
4d2c0b2d716b161d27a5cb8b85d5ac64

SHA1
1ceef517d819ad0085f41c365280b2154d9b99bb

SHA256
a6ed35f84e052ff59795a1801be44ac4cbc921742d5205b8362d29293960c805

SHA512
7a53914d4afdfc0cf219f700bbeb2fb0bf110af9023d3c256ecef43687745cadfe276274c65a53a783a65b8c3d291f0a9a3472dfcea659762e25dd026bc4c133

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
8e121f35a641e50dcb693eb84236d303

SHA1
72d99c7475db326e04fc688e30baa13e63d41b80

SHA256
f5d3e34ac86364c63690156e186f0a12009c8656725b6605c9e9027c96e3d0c3

SHA512
59e98942371dd4eb2c4ce3d65ca18a19ed6e36d4476e55c0276681be86fe25887593e0a9a49728cace166ea37769dd4b2c4e20284128954e3d5296537d347a7f

Download Submit
memory/1144-285-0x0000000000580000-0x0000000000592000-memory.dmp

Filesize
72KB

Download
memory/1144-247-0x0000000001230000-0x00000000013E6000-memory.dmp

Filesize
1.7MB

Download
memory/2060-21-0x000007FEF5DD0000-0x000007FEF67BC000-memory.dmp

Filesize
9.9MB

Download
memory/2060-66-0x000007FEF5DD3000-0x000007FEF5DD4000-memory.dmp

Filesize
4KB

Download
memory/2060-10-0x000000001A8B0000-0x000000001A8B8000-memory.dmp

Filesize
32KB

Download
memory/2060-12-0x000000001A8C0000-0x000000001A8CC000-memory.dmp

Filesize
48KB

Download
memory/2060-13-0x000000001A8E0000-0x000000001A8EC000-memory.dmp

Filesize
48KB

Download
memory/2060-14-0x000000001A8D0000-0x000000001A8DA000-memory.dmp

Filesize
40KB

Download
memory/2060-15-0x000000001A8F0000-0x000000001A8F8000-memory.dmp

Filesize
32KB

Download
memory/2060-16-0x000000001A900000-0x000000001A90C000-memory.dmp

Filesize
48KB

Download
memory/2060-17-0x000000001A910000-0x000000001A91C000-memory.dmp

Filesize
48KB

Download
memory/2060-18-0x000007FEF5DD0000-0x000007FEF67BC000-memory.dmp

Filesize
9.9MB

Download
memory/2060-0-0x000007FEF5DD3000-0x000007FEF5DD4000-memory.dmp

Filesize
4KB

Download
memory/2060-24-0x000007FEF5DD0000-0x000007FEF67BC000-memory.dmp

Filesize
9.9MB

Download
memory/2060-8-0x0000000002330000-0x0000000002340000-memory.dmp

Filesize
64KB

Download
memory/2060-9-0x0000000002340000-0x000000000234C000-memory.dmp

Filesize
48KB

Download
memory/2060-7-0x0000000002320000-0x0000000002332000-memory.dmp

Filesize
72KB

Download
memory/2060-113-0x000007FEF5DD0000-0x000007FEF67BC000-memory.dmp

Filesize
9.9MB

Download
memory/2060-162-0x000007FEF5DD0000-0x000007FEF67BC000-memory.dmp

Filesize
9.9MB

Download
memory/2060-182-0x000007FEF5DD0000-0x000007FEF67BC000-memory.dmp

Filesize
9.9MB

Download
memory/2060-6-0x0000000000C40000-0x0000000000C56000-memory.dmp

Filesize
88KB

Download
memory/2060-211-0x000007FEF5DD0000-0x000007FEF67BC000-memory.dmp

Filesize
9.9MB

Download
memory/2060-5-0x0000000000C30000-0x0000000000C40000-memory.dmp

Filesize
64KB

Download
memory/2060-1-0x0000000000D60000-0x0000000000F16000-memory.dmp

Filesize
1.7MB

Download
memory/2060-4-0x0000000000580000-0x0000000000588000-memory.dmp

Filesize
32KB

Download
memory/2060-284-0x000007FEF5DD0000-0x000007FEF67BC000-memory.dmp

Filesize
9.9MB

Download
memory/2060-2-0x000007FEF5DD0000-0x000007FEF67BC000-memory.dmp

Filesize
9.9MB

Download
memory/2060-3-0x00000000004E0000-0x00000000004FC000-memory.dmp

Filesize
112KB

Download
memory/2484-234-0x000000001B400000-0x000000001B6E2000-memory.dmp

Filesize
2.9MB

Download
memory/2484-235-0x0000000001EE0000-0x0000000001EE8000-memory.dmp

Filesize
32KB

Download