dcrat | 10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91

Resubmissions

13/01/2025, 05:28

250113-f59araxqfz 10

12/01/2025, 19:36

250112-ybg9aaylfr 10

Analysis

max time kernel
96s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12/01/2025, 19:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe
Size

1.7MB
MD5

a95c577913d17f1786babed3306fed60
SHA1

16106bfac76f6e4f711a9dd7e016cd52fbaeb774
SHA256

10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91
SHA512

314edb12b8885f8f9ea83e991b49aafcc629d5325f3439460610cc0046f0f0d1d629cecd79c2a9c48899d07c171253be7e65a6ef27c1434cf5ff55d5043fdec0
SSDEEP

24576:N3QwuLyEbVoCtPreIjNLoN/VNGeSQDx1m17zezKOkCzeJGFUJ:NgwuuEpdDLNwVMeXDL0fdSzAG

Score

10^/10

dcrat execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 63 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2016	3888	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1032	3888	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3992	3888	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4124	3888	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3596	3888	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	848	3888	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1284	3888	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4228	3888	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3192	3888	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1248	3888	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4140	3888	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2860	3888	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4944	3888	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3292	3888	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1584	3888	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5016	3888	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	224	3888	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3528	3888	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3088	3888	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	884	3888	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1032	3888	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4224	3888	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3928	3888	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4124	3888	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	848	3888	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1592	3888	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4228	3888	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2908	3888	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2592	3888	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1248	3888	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5044	3888	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4688	3888	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1156	3888	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2736	3888	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2364	3888	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1580	3888	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3944	3888	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3780	3888	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1448	3888	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1476	3888	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2560	3888	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1032	3888	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3952	3888	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4312	3888	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1284	3888	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2516	3888	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1132	3888	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4516	3888	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2772	3888	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5028	3888	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4852	3888	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2792	3888	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3188	3888	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	916	3888	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1996	3888	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1256	3888	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4228	3888	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2348	3888	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1032	3888	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5032	3888	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4140	3888	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3644	3888	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2232	3888	schtasks.exe	83

DCRat payload 3 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/1476-1-0x0000000000700000-0x00000000008B6000-memory.dmp	dcrat
behavioral2/files/0x0007000000023cc0-32.dat	dcrat
behavioral2/files/0x0009000000023cb2-77.dat	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 33 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2360	powershell.exe
3340	powershell.exe
2844	powershell.exe
4160	powershell.exe
4980	powershell.exe
4968	powershell.exe
4160	powershell.exe
4732	powershell.exe
3144	powershell.exe
5088	powershell.exe
4148	powershell.exe
2504	powershell.exe
4300	powershell.exe
1732	powershell.exe
3068	powershell.exe
4508	powershell.exe
4728	powershell.exe
4580	powershell.exe
768	powershell.exe
3800	powershell.exe
3256	powershell.exe
1208	powershell.exe
4692	powershell.exe
3752	powershell.exe
3572	powershell.exe
1464	powershell.exe
4088	powershell.exe
1388	powershell.exe
1628	powershell.exe
2516	powershell.exe
2760	powershell.exe
1044	powershell.exe
672	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	upfc.exe

Executes dropped EXE 4 IoCs

pid	Process
4852	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe
1620	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe
3104	upfc.exe
5028	upfc.exe

Drops file in Program Files directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Windows NT\TableTextService\RCXCFF6.tmp	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe
File opened for modification	C:\Program Files (x86)\Windows NT\TableTextService\dwm.exe	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\ja-JP\RCXD48E.tmp	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\29c1c3cc0f7685	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe
File opened for modification	C:\Program Files\Reference Assemblies\dllhost.exe	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe
File created	C:\Program Files (x86)\Windows NT\Accessories\en-US\conhost.exe	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe
File created	C:\Program Files (x86)\Windows NT\TableTextService\en-US\conhost.exe	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe
File created	C:\Program Files (x86)\Windows Mail\cc11b995f2a76d	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\winlogon.exe	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe
File created	C:\Program Files\Windows Security\BrowserCore\unsecapp.exe	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\ja-JP\RCXD50C.tmp	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe
File opened for modification	C:\Program Files (x86)\Windows NT\TableTextService\en-US\conhost.exe	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe
File opened for modification	C:\Program Files\Windows NT\RCXCDE1.tmp	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe
File opened for modification	C:\Program Files\Windows NT\RCXCDE2.tmp	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe
File opened for modification	C:\Program Files (x86)\Windows NT\TableTextService\RCXCFF7.tmp	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe
File opened for modification	C:\Program Files\Windows Security\BrowserCore\RCXD27A.tmp	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe
File created	C:\Program Files\Reference Assemblies\5940a34987c991	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe
File created	C:\Program Files\MSBuild\Microsoft\fontdrvhost.exe	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe
File created	C:\Program Files (x86)\Windows NT\Accessories\en-US\088424020bedd6	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe
File opened for modification	C:\Program Files\Windows Security\BrowserCore\unsecapp.exe	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe
File opened for modification	C:\Program Files\MSBuild\Microsoft\fontdrvhost.exe	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe
File created	C:\Program Files (x86)\Windows Media Player\es-ES\csrss.exe	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe
File created	C:\Program Files (x86)\Windows Mail\winlogon.exe	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe
File opened for modification	C:\Program Files (x86)\Windows NT\Accessories\en-US\conhost.exe	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe
File created	C:\Program Files\Windows NT\wininit.exe	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe
File created	C:\Program Files\Windows NT\56085415360792	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe
File created	C:\Program Files (x86)\Windows NT\TableTextService\6cb0b6c459d5d3	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe
File created	C:\Program Files\Reference Assemblies\dllhost.exe	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe
File created	C:\Program Files\MSBuild\Microsoft\5b884080fd4f94	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe
File created	C:\Program Files (x86)\Windows NT\TableTextService\en-US\088424020bedd6	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\es-ES\csrss.exe	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe
File created	C:\Program Files (x86)\Windows Defender\ja-JP\5940a34987c991	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe
File opened for modification	C:\Program Files\Windows Security\BrowserCore\RCXD279.tmp	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe
File created	C:\Program Files (x86)\Windows Media Player\es-ES\886983d96e3d3e	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe
File created	C:\Program Files (x86)\Windows NT\TableTextService\dwm.exe	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\unsecapp.exe	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe
File opened for modification	C:\Program Files\Windows NT\wininit.exe	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe
File created	C:\Program Files\Windows Security\BrowserCore\29c1c3cc0f7685	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe
File created	C:\Program Files (x86)\Windows Defender\ja-JP\dllhost.exe	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\ja-JP\dllhost.exe	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\unsecapp.exe	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\SystemApps\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\dllhost.exe	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe
File created	C:\Windows\Fonts\csrss.exe	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe
File created	C:\Windows\it-IT\RuntimeBroker.exe	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe
File opened for modification	C:\Windows\Fonts\csrss.exe	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\Images\conhost.exe	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe
File created	C:\Windows\SystemApps\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\5940a34987c991	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe
File created	C:\Windows\Fonts\886983d96e3d3e	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe
File created	C:\Windows\it-IT\9e8d7a4ca61bd9	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\dllhost.exe	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe
File opened for modification	C:\Windows\it-IT\RuntimeBroker.exe	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe
File created	C:\Windows\SystemApps\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\Images\conhost.exe	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe
File created	C:\Windows\SystemApps\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\Images\088424020bedd6	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	upfc.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 63 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5016	schtasks.exe
848	schtasks.exe
5044	schtasks.exe
4312	schtasks.exe
4140	schtasks.exe
4224	schtasks.exe
3188	schtasks.exe
3192	schtasks.exe
2860	schtasks.exe
1592	schtasks.exe
1248	schtasks.exe
1132	schtasks.exe
3928	schtasks.exe
2364	schtasks.exe
2348	schtasks.exe
224	schtasks.exe
4688	schtasks.exe
1032	schtasks.exe
3992	schtasks.exe
2592	schtasks.exe
1032	schtasks.exe
4852	schtasks.exe
1032	schtasks.exe
3780	schtasks.exe
1476	schtasks.exe
2516	schtasks.exe
1996	schtasks.exe
4228	schtasks.exe
4944	schtasks.exe
3088	schtasks.exe
3944	schtasks.exe
1284	schtasks.exe
5028	schtasks.exe
3596	schtasks.exe
4228	schtasks.exe
1156	schtasks.exe
1448	schtasks.exe
1032	schtasks.exe
2232	schtasks.exe
3528	schtasks.exe
2736	schtasks.exe
3644	schtasks.exe
1580	schtasks.exe
4516	schtasks.exe
2772	schtasks.exe
2792	schtasks.exe
848	schtasks.exe
1284	schtasks.exe
916	schtasks.exe
4124	schtasks.exe
1248	schtasks.exe
3292	schtasks.exe
1584	schtasks.exe
2560	schtasks.exe
1256	schtasks.exe
2908	schtasks.exe
4140	schtasks.exe
2016	schtasks.exe
4228	schtasks.exe
884	schtasks.exe
4124	schtasks.exe
3952	schtasks.exe
5032	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1476	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe
1476	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe
1476	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe
1476	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe
1476	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe
1476	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe
1476	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe
1476	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe
1476	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe
1476	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe
1476	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe
1476	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe
1476	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe
1476	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe
1476	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe
1476	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe
1476	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe
1476	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe
1476	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe
1476	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe
1476	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe
1476	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe
1476	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe
1476	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe
1476	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe
1476	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe
1476	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe
1476	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe
1476	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe
1476	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe
1476	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe
3752	powershell.exe
3752	powershell.exe
5088	powershell.exe
5088	powershell.exe
4728	powershell.exe
4728	powershell.exe
1388	powershell.exe
1388	powershell.exe
3144	powershell.exe
3144	powershell.exe
4148	powershell.exe
4148	powershell.exe
4088	powershell.exe
4088	powershell.exe
4160	powershell.exe
4160	powershell.exe
3572	powershell.exe
3572	powershell.exe
2760	powershell.exe
2760	powershell.exe
2504	powershell.exe
2504	powershell.exe
3144	powershell.exe
2504	powershell.exe
1388	powershell.exe
4088	powershell.exe
3752	powershell.exe
5088	powershell.exe
4148	powershell.exe
4728	powershell.exe
4160	powershell.exe
2760	powershell.exe
3572	powershell.exe

Suspicious use of AdjustPrivilegeToken 38 IoCs

description	pid	Process
Token: SeDebugPrivilege	1476	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe
Token: SeDebugPrivilege	3752	powershell.exe
Token: SeDebugPrivilege	5088	powershell.exe
Token: SeDebugPrivilege	4088	powershell.exe
Token: SeDebugPrivilege	1388	powershell.exe
Token: SeDebugPrivilege	4728	powershell.exe
Token: SeDebugPrivilege	3144	powershell.exe
Token: SeDebugPrivilege	4148	powershell.exe
Token: SeDebugPrivilege	4160	powershell.exe
Token: SeDebugPrivilege	3572	powershell.exe
Token: SeDebugPrivilege	2760	powershell.exe
Token: SeDebugPrivilege	2504	powershell.exe
Token: SeDebugPrivilege	4852	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe
Token: SeDebugPrivilege	1464	powershell.exe
Token: SeDebugPrivilege	4732	powershell.exe
Token: SeDebugPrivilege	4580	powershell.exe
Token: SeDebugPrivilege	3256	powershell.exe
Token: SeDebugPrivilege	2360	powershell.exe
Token: SeDebugPrivilege	4980	powershell.exe
Token: SeDebugPrivilege	672	powershell.exe
Token: SeDebugPrivilege	3800	powershell.exe
Token: SeDebugPrivilege	1044	powershell.exe
Token: SeDebugPrivilege	4968	powershell.exe
Token: SeDebugPrivilege	4160	powershell.exe
Token: SeDebugPrivilege	1620	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe
Token: SeDebugPrivilege	1208	powershell.exe
Token: SeDebugPrivilege	4692	powershell.exe
Token: SeDebugPrivilege	3340	powershell.exe
Token: SeDebugPrivilege	4300	powershell.exe
Token: SeDebugPrivilege	3068	powershell.exe
Token: SeDebugPrivilege	768	powershell.exe
Token: SeDebugPrivilege	4508	powershell.exe
Token: SeDebugPrivilege	2844	powershell.exe
Token: SeDebugPrivilege	1732	powershell.exe
Token: SeDebugPrivilege	2516	powershell.exe
Token: SeDebugPrivilege	1628	powershell.exe
Token: SeDebugPrivilege	3104	upfc.exe
Token: SeDebugPrivilege	5028	upfc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1476 wrote to memory of 2760	1476	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe	97
PID 1476 wrote to memory of 2760	1476	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe	97
PID 1476 wrote to memory of 3144	1476	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe	98
PID 1476 wrote to memory of 3144	1476	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe	98
PID 1476 wrote to memory of 5088	1476	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe	99
PID 1476 wrote to memory of 5088	1476	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe	99
PID 1476 wrote to memory of 4728	1476	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe	100
PID 1476 wrote to memory of 4728	1476	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe	100
PID 1476 wrote to memory of 4088	1476	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe	101
PID 1476 wrote to memory of 4088	1476	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe	101
PID 1476 wrote to memory of 4148	1476	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe	102
PID 1476 wrote to memory of 4148	1476	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe	102
PID 1476 wrote to memory of 2504	1476	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe	103
PID 1476 wrote to memory of 2504	1476	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe	103
PID 1476 wrote to memory of 3752	1476	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe	104
PID 1476 wrote to memory of 3752	1476	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe	104
PID 1476 wrote to memory of 3572	1476	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe	105
PID 1476 wrote to memory of 3572	1476	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe	105
PID 1476 wrote to memory of 4160	1476	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe	106
PID 1476 wrote to memory of 4160	1476	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe	106
PID 1476 wrote to memory of 1388	1476	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe	107
PID 1476 wrote to memory of 1388	1476	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe	107
PID 1476 wrote to memory of 3848	1476	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe	119
PID 1476 wrote to memory of 3848	1476	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe	119
PID 3848 wrote to memory of 4824	3848	cmd.exe	121
PID 3848 wrote to memory of 4824	3848	cmd.exe	121
PID 3848 wrote to memory of 4852	3848	cmd.exe	123
PID 3848 wrote to memory of 4852	3848	cmd.exe	123
PID 4852 wrote to memory of 4732	4852	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe	152
PID 4852 wrote to memory of 4732	4852	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe	152
PID 4852 wrote to memory of 672	4852	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe	153
PID 4852 wrote to memory of 672	4852	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe	153
PID 4852 wrote to memory of 3800	4852	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe	154
PID 4852 wrote to memory of 3800	4852	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe	154
PID 4852 wrote to memory of 2360	4852	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe	155
PID 4852 wrote to memory of 2360	4852	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe	155
PID 4852 wrote to memory of 1464	4852	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe	157
PID 4852 wrote to memory of 1464	4852	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe	157
PID 4852 wrote to memory of 4580	4852	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe	158
PID 4852 wrote to memory of 4580	4852	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe	158
PID 4852 wrote to memory of 4968	4852	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe	159
PID 4852 wrote to memory of 4968	4852	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe	159
PID 4852 wrote to memory of 4980	4852	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe	161
PID 4852 wrote to memory of 4980	4852	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe	161
PID 4852 wrote to memory of 1044	4852	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe	162
PID 4852 wrote to memory of 1044	4852	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe	162
PID 4852 wrote to memory of 4160	4852	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe	163
PID 4852 wrote to memory of 4160	4852	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe	163
PID 4852 wrote to memory of 3256	4852	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe	164
PID 4852 wrote to memory of 3256	4852	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe	164
PID 4852 wrote to memory of 1620	4852	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe	174
PID 4852 wrote to memory of 1620	4852	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe	174
PID 1620 wrote to memory of 1208	1620	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe	208
PID 1620 wrote to memory of 1208	1620	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe	208
PID 1620 wrote to memory of 2844	1620	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe	209
PID 1620 wrote to memory of 2844	1620	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe	209
PID 1620 wrote to memory of 4508	1620	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe	210
PID 1620 wrote to memory of 4508	1620	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe	210
PID 1620 wrote to memory of 768	1620	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe	211
PID 1620 wrote to memory of 768	1620	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe	211
PID 1620 wrote to memory of 1732	1620	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe	212
PID 1620 wrote to memory of 1732	1620	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe	212
PID 1620 wrote to memory of 3340	1620	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe	213
PID 1620 wrote to memory of 3340	1620	10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe	213

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe
"C:\Users\Admin\AppData\Local\Temp\10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe"
1⤵
- Drops file in Drivers directory
- Checks computer location settings
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1476
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2760
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3144
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5088
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4728
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4088
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4148
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2504
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3752
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3572
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4160
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1388
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\D5QBP4coCl.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3848
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:4824
- - C:\Users\Admin\AppData\Local\Temp\10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe
    "C:\Users\Admin\AppData\Local\Temp\10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4852
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:4732
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:672
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:3800
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:2360
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:1464
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:4580
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:4968
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:4980
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:1044
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:4160
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:3256
  - - C:\Users\Admin\AppData\Local\Temp\10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe
      "C:\Users\Admin\AppData\Local\Temp\10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1620
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1208
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2844
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:4508
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:768
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1732
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:3340
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2516
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:3068
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:4300
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:4692
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1628
    - - C:\Users\Default\NetHood\upfc.exe
        
        "C:\Users\Default\NetHood\upfc.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:3104
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b9fa3bcb-e94d-455a-bdca-2f95cea0c0d1.vbs"
        6⤵
        
        PID:4544
        
        C:\Users\Default\NetHood\upfc.exe
        
        C:\Users\Default\NetHood\upfc.exe
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:5028
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\31a10b08-a6d6-4c91-a646-17137f7de3a1.vbs"
        6⤵
        
        PID:4564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows NT\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files\Windows NT\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows NT\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4124

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\TableTextService\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Security\BrowserCore\unsecapp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Program Files\Windows Security\BrowserCore\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Security\BrowserCore\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3192

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Defender\ja-JP\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\ja-JP\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4140

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Defender\ja-JP\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\unsecapp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Windows\SystemApps\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\SystemApps\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Windows\SystemApps\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Program Files\Reference Assemblies\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\Reference Assemblies\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Program Files\Reference Assemblies\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Program Files\MSBuild\Microsoft\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files\MSBuild\Microsoft\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Program Files\MSBuild\Microsoft\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4124

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 8 /tr "'C:\Users\Default\Local Settings\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Users\Default\Local Settings\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\Users\Default\Local Settings\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Windows\Fonts\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\Fonts\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Windows\Fonts\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Windows\it-IT\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\it-IT\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Windows\it-IT\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2364

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 14 /tr "'C:\Windows\SystemApps\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\Images\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Windows\SystemApps\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\Images\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 9 /tr "'C:\Windows\SystemApps\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\Images\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 8 /tr "'C:\Users\Default\NetHood\upfc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Users\Default\NetHood\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4312

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 5 /tr "'C:\Users\Default\NetHood\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Media Player\es-ES\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\es-ES\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1132

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Media Player\es-ES\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\powershell.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershell" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\powershell.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\powershell.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3188

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1256

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Mail\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4140

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Mail\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Windows Defender\ja-JP\dllhost.exe

Filesize
1.7MB

MD5
17b4676dc5344c6e0b5e35e82c9e2e31

SHA1
0d3df62be6c58daa47f7b25d1a7c8cacecab5838

SHA256
3d788c7517acb9303154c6d80fd8676440be4fc8365e6d4addf058e24bba69da

SHA512
6c526135d108ac2d315830392d6bbb09e1e490f7d690f4a69381af9ad25489e12de5a82900c157e0b37e229703ed5a529d077077a19fe6ae3f32704c17d19814

Download Submit
C:\Recovery\WindowsRE\6203df4a6bafc7

Filesize
332B

MD5
3da69f9db2c9381f449211a183096544

SHA1
a4f68d83897a145976406b9d34399283325644e0

SHA256
a8f75298adda57620f39c6ddac15a71653f6861d80b69ab75b1a2b53f103d994

SHA512
7de83438905b1fea05242b32e82a248755964d03505ea8e4df081f2883ac1c6a95ca2730d0899ca6d36f63a2908c01552e995e0fe27fdd360d4cd7742f72b4eb

Download Submit
C:\Recovery\WindowsRE\lsass.exe

Filesize
1.7MB

MD5
3430811b57e7082cbfc74e5d0997dd41

SHA1
a88a444b4bd43a32d5cc4c0b89d4ec54a58c1e4c

SHA256
ff2af835b4f614c059263d91fd4655fe91514eaea33e6fce2e5e2a705baa4da3

SHA512
ac4712eaaca1869400e47c32e68dedb0b8fdbdee19877ad94739e607505f9fe80df015284278588a8397da9594ca88137460b4ee0c21bb8a07255c99d0fed84c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe.log

Filesize
1KB

MD5
7800fca2323a4130444c572374a030f4

SHA1
40c9b8e0e5e7d72a5293f4010f2ccf21e637b4aa

SHA256
29f5645ac14353ac460858f52c856548f3aeb144b09eef672a6b4849bafe742e

SHA512
c8a7ad930b8c07007c7a67d8c32a2a4a401dcc34ab966e0e80901655fcbe1f5c95b72a195e6381b1de56c2c987eeab093d8e89891bec9e9684785c5d824b3554

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\upfc.exe.log

Filesize
1KB

MD5
3ad9a5252966a3ab5b1b3222424717be

SHA1
5397522c86c74ddbfb2585b9613c794f4b4c3410

SHA256
27525f5fc7871c6828ab5173315e95b5c7e918d2ee532781c562c378584b5249

SHA512
b1a745f7a0f33b777ffc34f74f42752144d9f2d06b8bc613e703570494762b3af87e153212c3274b18af14f17b8619e2f350b7c3cc11228f7d4208d4251e90e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
62623d22bd9e037191765d5083ce16a3

SHA1
4a07da6872672f715a4780513d95ed8ddeefd259

SHA256
95d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010

SHA512
9a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
77d622bb1a5b250869a3238b9bc1402b

SHA1
d47f4003c2554b9dfc4c16f22460b331886b191b

SHA256
f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

SHA512
d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
2e907f77659a6601fcc408274894da2e

SHA1
9f5b72abef1cd7145bf37547cdb1b9254b4efe9d

SHA256
385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233

SHA512
34fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3a6bad9528f8e23fb5c77fbd81fa28e8

SHA1
f127317c3bc6407f536c0f0600dcbcf1aabfba36

SHA256
986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

SHA512
846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
54522d22658e4f8f87ecb947b71b8feb

SHA1
6a6144bdf9c445099f52211b6122a2ecf72b77e9

SHA256
af18fc4864bc2982879aed928c960b6266f372c928f8c9632c5a4eecd64e448a

SHA512
55f2c5a455be20dcb4cb93a29e5389e0422237bdd7ac40112fec6f16a36e5e19df50d25d39a6d5acb2d41a96514c7ecd8631ce8e67c4ff04997282f49d947aba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
0fd3f36f28a947bdd05f1e05acf24489

SHA1
cf12e091a80740df2201c5b47049dd231c530ad3

SHA256
d36c21211f297a74a801881707690fa7a0a0a31addd3c7ba1522275b8848ab50

SHA512
5f132308b06e621aace1091f523649bcb5d1823b478691799791f4154cb96b9897f563eed8ad8db4a03714d815246479372e0920c659eb3fd9006271e58429ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
9078a011b49db705765cff4b845368b0

SHA1
533576940a2780b894e1ae46b17d2f4224051b77

SHA256
c89240e395a581db1b44d204e2bcbd5b0e7f636ac72585d8257e6b901f5a3615

SHA512
48e0896fc4818bb7e3f250c5cad70d5e4ce71d3f6a8d2d17d8becc36050c1de2a270fde8dea5bb3462f1e7f5eaf074053390934f26d0186113215a1c4e92dd1e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
a9a7f35c006bbf5da72f9cb250ffbddb

SHA1
458a8cedc38dac109631d9fccb3bf6d2c5c0e89e

SHA256
a1db56d56e35a6c95f98204e40f69f70422969681d408e5edc4afbf732eef86b

SHA512
d341773d30e09214567c65f24cd1854f1e438b8528aa30d35b6baac16e671dde1245edda654f19343b7c160da45985ab53f08453e7f6286e272d544f8741c131

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
80c8946cc1ff260c378961064b8caf44

SHA1
684844b25c6a11a494f2e17607919bd64a44ab81

SHA256
0a9427418328add42548c79fc7ad6af5f3470d782b0f086fbe65348b7ca5eb46

SHA512
6dcbe26d0cbf9786551e32f78e42f4d330c09101044a3e4cc56532f5ac30e4c63fa6718b72ccf3ea1dc8ee2d8aba3b29179691e342f30e30281c461bf141ced1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
575c67abdb0b2c72de0d9dd38b94d791

SHA1
27783f259ffd096b21c02c70cb999bf860183124

SHA256
fdf985fb9c56b4462675c41f68555f8762dd7043b15750968208b88be87252bc

SHA512
61b23a15b52cf51b525993e8cfc0b9fd41d1bb28501c96a35f776bfa738390783ad266c2d0383a53770f3662dd118a45114d92afee63b4673e88008a6559b774

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e2efbfd23e33d8d07d019bdd9ca20649

SHA1
68d3b285c423d311bdf8dc53354f5f4000caf386

SHA256
f4386e3a103dafd6e85bebc2ad649069d168b4da8a0ded51b3ec96fa1408a828

SHA512
b7a961002557ff2efb785f756c9347e250392eab3dcb5168c67e89238e85368a41d0a5bdc94bfbbc192ba427c83e982234b3cf8824b166a69973f3f9df177443

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
a83ce2908066654f712d1858746bc3c4

SHA1
14887f0537ce076cdc91801fb5fa584b25f1089f

SHA256
7c32ae0eaa4fef7404ce708744116ab8ea17d9575bbb3b06eb41a443f963456f

SHA512
991b20116815c7db3497d0ede9a216c7b78795e65f898847ffec513692f0c24d146a123725d14a2e1e3efb5744a626dd025a364f2f55f581e21640794a0cc551

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
c04853f5320a9adaf53ebe8083efeb8d

SHA1
3c32a341045ebf71d81498436005f49f915b50f5

SHA256
a385f51a9971c8c0707d5fffb9b61eb8b25d90ce8404b12a5ea199fea3301175

SHA512
4f03f1f0911b19450a5200081b55c0ed2febfdc46e9f15ee37f4370d71516107e7ff8af4613a4b02e17bcf65fcd532a02823859d09dbe4226088f299b6e09cff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
dd0716df5ff6e2ed8bfa08e271d64dd8

SHA1
c342bbe936058ea27843d5dbe5eb434f926612f7

SHA256
15ea3598b422f0d7705405688a174b98789b623154d4ccf3f3148f7c10bafdd8

SHA512
7e6dc8f9ad269ca3969e7b1284399f16f59559d5a4232537147fb7edcba86932474eff26921c09472894d55ee045dd3e371dcfce65d358785166742582e0b8a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
32b16440fab3a1055d9c22b90935bdfb

SHA1
ee350c4a65b81468487a3660dfe4f373660b9070

SHA256
ee68b728a82fefc941eba10390d9d70f5aeb442039c901eaf9a18477761cfd35

SHA512
5a1f36ab56e25548fd2875d364cfec39830e855b89628718f786bb8158147ee6fd66f2b7477d1b57b0d8cec5b8f10d173face18f4131ecec0dc67ca9ae56216c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
b3bc9ca267ea2969eb6201d77e58560c

SHA1
78f83a443aa1ca235edcab2da9e2fda6fecc1da4

SHA256
7ea18b6f900f2c30a5c34845d62d4fe9fc1f11e40714b3dbd69592cbfb5dc695

SHA512
8cc70e4f88f3d9f59beec22dafdb403144f7f390250205e08279a2f8e01e783af44ae31aa4a8a7ea05865b05303ac5e5048f7fb44488be538d9701b6195e9b28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
150616521d490e160cd33b97d678d206

SHA1
71594f5b97a4a61fe5f120eb10bcd6b73d7e6e78

SHA256
94595c05912cbb8380f7ed34499eb01fb91707a1ed1c02c02002a4361e889827

SHA512
7043dc4b336b1688205fbe762e731478ecaa0036c9f5e0434c79b8a6f8fa58b0705c8674fd6a047e6009edc52c37ce4e2ce81694e13b79a3e8183a32307f3815

Download Submit
C:\Users\Admin\AppData\Local\Temp\31a10b08-a6d6-4c91-a646-17137f7de3a1.vbs

Filesize
485B

MD5
c692675bb039d3a2fc8f6153a1e48a30

SHA1
b5d6dfde447786081c988df06b4513136cb99871

SHA256
76dd471439008999a82140eb44cb71222c5b08b76efc1a21c15eccc25ab3e860

SHA512
91e8ce641fe922abc234db183659ceb4c9586fbe87a9b29772dc4edc89a695ac3e5e1c917471bde1a9eaeb6f6543daf6b28256d6647206679b0ddde80a667df2

Download Submit
C:\Users\Admin\AppData\Local\Temp\D5QBP4coCl.bat

Filesize
268B

MD5
db9488c6ce0a1f7e557b37f1303fa745

SHA1
098802ee6a86ed11c6d12f41bac089cd3963cd4f

SHA256
655482345975a9050f49ff07d3b4f96a7440502beffa341e835ae5ca61e434d4

SHA512
b0824fda9682bce8fd8f5f0035c2e728e978dd5107a5ba93650ad4b9b61e5399b63cdd6306e78f131fa4f5ebebd549bcc355a1ad014851f538f9107f3fb6381a

Download Submit
C:\Users\Admin\AppData\Local\Temp\RCXCBDC.tmp

Filesize
1.7MB

MD5
a95c577913d17f1786babed3306fed60

SHA1
16106bfac76f6e4f711a9dd7e016cd52fbaeb774

SHA256
10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91

SHA512
314edb12b8885f8f9ea83e991b49aafcc629d5325f3439460610cc0046f0f0d1d629cecd79c2a9c48899d07c171253be7e65a6ef27c1434cf5ff55d5043fdec0

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1eryofzm.2rb.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\b9fa3bcb-e94d-455a-bdca-2f95cea0c0d1.vbs

Filesize
709B

MD5
55f66d502398c3527198ce63c4d88bd3

SHA1
67f14ffcca842f7b755eb6620ab6b5fd038cfab6

SHA256
f073d719577715bf9e90aa819755a8de232018922f425e0fcf15755a66194b26

SHA512
2deefe586ef36938954ece779635c22daa49b0ee5388f1ee1a1574dc9b99189a8a910ef8d5a95cfcf40f36ced5b60bca1a9e51a3f37fdb32f2e82c68fa3747f5

Download Submit
memory/1476-13-0x0000000002B70000-0x0000000002B7C000-memory.dmp

Filesize
48KB

Download
memory/1476-11-0x0000000002B50000-0x0000000002B58000-memory.dmp

Filesize
32KB

Download
memory/1476-1-0x0000000000700000-0x00000000008B6000-memory.dmp

Filesize
1.7MB

Download
memory/1476-22-0x00007FF8470A0000-0x00007FF847B61000-memory.dmp

Filesize
10.8MB

Download
memory/1476-21-0x00007FF8470A0000-0x00007FF847B61000-memory.dmp

Filesize
10.8MB

Download
memory/1476-18-0x000000001B5E0000-0x000000001B5EC000-memory.dmp

Filesize
48KB

Download
memory/1476-15-0x000000001B5B0000-0x000000001B5BA000-memory.dmp

Filesize
40KB

Download
memory/1476-16-0x000000001B5C0000-0x000000001B5C8000-memory.dmp

Filesize
32KB

Download
memory/1476-17-0x000000001B5D0000-0x000000001B5DC000-memory.dmp

Filesize
48KB

Download
memory/1476-14-0x000000001B730000-0x000000001B73C000-memory.dmp

Filesize
48KB

Download
memory/1476-0-0x00007FF8470A3000-0x00007FF8470A5000-memory.dmp

Filesize
8KB

Download
memory/1476-119-0x00007FF8470A0000-0x00007FF847B61000-memory.dmp

Filesize
10.8MB

Download
memory/1476-10-0x0000000002B40000-0x0000000002B4C000-memory.dmp

Filesize
48KB

Download
memory/1476-9-0x0000000002B60000-0x0000000002B70000-memory.dmp

Filesize
64KB

Download
memory/1476-8-0x0000000002B30000-0x0000000002B42000-memory.dmp

Filesize
72KB

Download
memory/1476-7-0x0000000002B10000-0x0000000002B26000-memory.dmp

Filesize
88KB

Download
memory/1476-4-0x000000001B560000-0x000000001B5B0000-memory.dmp

Filesize
320KB

Download
memory/1476-6-0x0000000002B00000-0x0000000002B10000-memory.dmp

Filesize
64KB

Download
memory/1476-5-0x0000000002AF0000-0x0000000002AF8000-memory.dmp

Filesize
32KB

Download
memory/1476-3-0x00000000029C0000-0x00000000029DC000-memory.dmp

Filesize
112KB

Download
memory/1476-2-0x00007FF8470A0000-0x00007FF847B61000-memory.dmp

Filesize
10.8MB

Download
memory/3752-97-0x0000021C1D080000-0x0000021C1D0A2000-memory.dmp

Filesize
136KB

Download