dcrat | 9248f9181c8098936be56dc3084f4fba31d1b2664a051577e57456a168f5186a

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	Hypersaves.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	Hypersaves.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	Hypersave.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	Hypersave.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	Hypersaves.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	Hypersave.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	Hypersave.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	Hypersave.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	Hypersave.exe

Executes dropped EXE 15 IoCs

pid	Process
208	Hypersave.exe
1696	Hypersaves.exe
2968	Hypersaves.exe
3620	taskhostw.exe
1416	Hypersave.exe
3720	Hypersaves.exe
4124	Hypersave.exe
5080	Hypersaves.exe
3404	Hypersave.exe
1444	Hypersave.exe
3912	Hypersaves.exe
5004	Hypersaves.exe
3032	Hypersave.exe
380	Hypersaves.exe
2524	fontdrvhost.exe

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\6cb0b6c459d5d3	Hypersaves.exe
File created	C:\Program Files\WindowsApps\backgroundTaskHost.exe	Hypersaves.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\f3b6ecef712a24	Hypersaves.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\dwm.exe	Hypersaves.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\5b884080fd4f94	Hypersaves.exe
File created	C:\Program Files\ModifiableWindowsApps\RuntimeBroker.exe	Hypersaves.exe
File created	C:\Program Files (x86)\Windows Mail\SppExtComObj.exe	Hypersaves.exe
File created	C:\Program Files (x86)\Windows Mail\e1ef82546f0b02	Hypersaves.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\spoolsv.exe	Hypersaves.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\fontdrvhost.exe	Hypersaves.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\ServiceState\EventLog\RuntimeBroker.exe	Hypersaves.exe
File created	C:\Windows\LanguageOverlayCache\services.exe	Hypersaves.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hypersave.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hypersave.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hypersave.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hypersave.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hypersave.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hypersave.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	Hypersave.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	Hypersave.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	Hypersave.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	Hypersaves.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	Hypersave.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	Hypersaves.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	Hypersave.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	Hypersave.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 64 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
8	schtasks.exe
2304	schtasks.exe
3304	schtasks.exe
3488	schtasks.exe
4896	schtasks.exe
3720	schtasks.exe
4296	schtasks.exe
808	schtasks.exe
3972	schtasks.exe
1448	schtasks.exe
1976	schtasks.exe
4352	schtasks.exe
3596	schtasks.exe
4872	schtasks.exe
4616	schtasks.exe
1136	schtasks.exe
3900	schtasks.exe
440	schtasks.exe
3888	schtasks.exe
3540	schtasks.exe
324	schtasks.exe
4184	schtasks.exe
4904	schtasks.exe
2152	schtasks.exe
936	schtasks.exe
432	schtasks.exe
3232	schtasks.exe
4324	schtasks.exe
4268	schtasks.exe
3124	schtasks.exe
2792	schtasks.exe
2724	schtasks.exe
3864	schtasks.exe
3640	schtasks.exe
3168	schtasks.exe
1600	schtasks.exe
4184	schtasks.exe
2604	schtasks.exe
2340	schtasks.exe
2948	schtasks.exe
1592	schtasks.exe
4576	schtasks.exe
3796	schtasks.exe
1704	schtasks.exe
2124	schtasks.exe
4904	schtasks.exe
1340	schtasks.exe
2560	schtasks.exe
2424	schtasks.exe
1220	schtasks.exe
3780	schtasks.exe
4492	schtasks.exe
3948	schtasks.exe
3868	schtasks.exe
2148	schtasks.exe
2396	schtasks.exe
3584	schtasks.exe
4604	schtasks.exe
4012	schtasks.exe
1724	schtasks.exe
4004	schtasks.exe
4792	schtasks.exe
3900	schtasks.exe
5060	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1696	Hypersaves.exe
2968	Hypersaves.exe
2968	Hypersaves.exe
2968	Hypersaves.exe
2968	Hypersaves.exe
2968	Hypersaves.exe
2968	Hypersaves.exe
2968	Hypersaves.exe
2968	Hypersaves.exe
2968	Hypersaves.exe
2968	Hypersaves.exe
2968	Hypersaves.exe
2968	Hypersaves.exe
2968	Hypersaves.exe
2968	Hypersaves.exe
2968	Hypersaves.exe
2968	Hypersaves.exe
2968	Hypersaves.exe
2968	Hypersaves.exe
2968	Hypersaves.exe
2968	Hypersaves.exe
2968	Hypersaves.exe
3620	taskhostw.exe
1700	taskmgr.exe
1700	taskmgr.exe
380	Hypersaves.exe
380	Hypersaves.exe
380	Hypersaves.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
2524	fontdrvhost.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5076	7zFM.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeRestorePrivilege	5076	7zFM.exe
Token: 35	5076	7zFM.exe
Token: SeSecurityPrivilege	5076	7zFM.exe
Token: SeDebugPrivilege	1696	Hypersaves.exe
Token: SeDebugPrivilege	2968	Hypersaves.exe
Token: SeDebugPrivilege	3620	taskhostw.exe
Token: SeDebugPrivilege	3720	Hypersaves.exe
Token: SeDebugPrivilege	5080	Hypersaves.exe
Token: SeDebugPrivilege	3912	Hypersaves.exe
Token: SeDebugPrivilege	5004	Hypersaves.exe
Token: SeDebugPrivilege	1700	taskmgr.exe
Token: SeSystemProfilePrivilege	1700	taskmgr.exe
Token: SeCreateGlobalPrivilege	1700	taskmgr.exe
Token: SeDebugPrivilege	380	Hypersaves.exe
Token: SeDebugPrivilege	2524	fontdrvhost.exe
Token: 33	1700	taskmgr.exe
Token: SeIncBasePriorityPrivilege	1700	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5076	7zFM.exe
5076	7zFM.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe
1700	taskmgr.exe

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 208 wrote to memory of 2540	208	Hypersave.exe	87
PID 208 wrote to memory of 2540	208	Hypersave.exe	87
PID 208 wrote to memory of 2540	208	Hypersave.exe	87
PID 2540 wrote to memory of 312	2540	WScript.exe	92
PID 2540 wrote to memory of 312	2540	WScript.exe	92
PID 2540 wrote to memory of 312	2540	WScript.exe	92
PID 312 wrote to memory of 1696	312	cmd.exe	94
PID 312 wrote to memory of 1696	312	cmd.exe	94
PID 1696 wrote to memory of 2144	1696	Hypersaves.exe	101
PID 1696 wrote to memory of 2144	1696	Hypersaves.exe	101
PID 2144 wrote to memory of 4224	2144	cmd.exe	103
PID 2144 wrote to memory of 4224	2144	cmd.exe	103
PID 2144 wrote to memory of 2968	2144	cmd.exe	107
PID 2144 wrote to memory of 2968	2144	cmd.exe	107
PID 2968 wrote to memory of 3620	2968	Hypersaves.exe	144
PID 2968 wrote to memory of 3620	2968	Hypersaves.exe	144
PID 1416 wrote to memory of 4784	1416	Hypersave.exe	147
PID 1416 wrote to memory of 4784	1416	Hypersave.exe	147
PID 1416 wrote to memory of 4784	1416	Hypersave.exe	147
PID 4784 wrote to memory of 2936	4784	WScript.exe	149
PID 4784 wrote to memory of 2936	4784	WScript.exe	149
PID 4784 wrote to memory of 2936	4784	WScript.exe	149
PID 2936 wrote to memory of 3720	2936	cmd.exe	151
PID 2936 wrote to memory of 3720	2936	cmd.exe	151
PID 4124 wrote to memory of 4980	4124	Hypersave.exe	154
PID 4124 wrote to memory of 4980	4124	Hypersave.exe	154
PID 4124 wrote to memory of 4980	4124	Hypersave.exe	154
PID 4980 wrote to memory of 2152	4980	WScript.exe	155
PID 4980 wrote to memory of 2152	4980	WScript.exe	155
PID 4980 wrote to memory of 2152	4980	WScript.exe	155
PID 2152 wrote to memory of 5080	2152	cmd.exe	157
PID 2152 wrote to memory of 5080	2152	cmd.exe	157
PID 3404 wrote to memory of 4612	3404	Hypersave.exe	160
PID 3404 wrote to memory of 4612	3404	Hypersave.exe	160
PID 3404 wrote to memory of 4612	3404	Hypersave.exe	160
PID 4612 wrote to memory of 5116	4612	WScript.exe	162
PID 4612 wrote to memory of 5116	4612	WScript.exe	162
PID 4612 wrote to memory of 5116	4612	WScript.exe	162
PID 5116 wrote to memory of 3912	5116	cmd.exe	164
PID 5116 wrote to memory of 3912	5116	cmd.exe	164
PID 1444 wrote to memory of 1164	1444	Hypersave.exe	165
PID 1444 wrote to memory of 1164	1444	Hypersave.exe	165
PID 1444 wrote to memory of 1164	1444	Hypersave.exe	165
PID 1164 wrote to memory of 2920	1164	WScript.exe	166
PID 1164 wrote to memory of 2920	1164	WScript.exe	166
PID 1164 wrote to memory of 2920	1164	WScript.exe	166
PID 2920 wrote to memory of 5004	2920	cmd.exe	168
PID 2920 wrote to memory of 5004	2920	cmd.exe	168
PID 3032 wrote to memory of 1788	3032	Hypersave.exe	170
PID 3032 wrote to memory of 1788	3032	Hypersave.exe	170
PID 3032 wrote to memory of 1788	3032	Hypersave.exe	170
PID 1788 wrote to memory of 4720	1788	WScript.exe	171
PID 1788 wrote to memory of 4720	1788	WScript.exe	171
PID 1788 wrote to memory of 4720	1788	WScript.exe	171
PID 4720 wrote to memory of 380	4720	cmd.exe	174
PID 4720 wrote to memory of 380	4720	cmd.exe	174
PID 380 wrote to memory of 1544	380	Hypersaves.exe	208
PID 380 wrote to memory of 1544	380	Hypersaves.exe	208
PID 1544 wrote to memory of 3904	1544	cmd.exe	210
PID 1544 wrote to memory of 3904	1544	cmd.exe	210
PID 1544 wrote to memory of 2524	1544	cmd.exe	211
PID 1544 wrote to memory of 2524	1544	cmd.exe	211

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\zalypa.rar"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5076

C:\Users\Admin\Desktop\Hypersave.exe
"C:\Users\Admin\Desktop\Hypersave.exe"
1⤵
- DcRat
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:208
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\agentDhcpSvc\pi9IuiLHWNaL.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2540
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\agentDhcpSvc\gbli075iaSnGi986a4C8TH704K.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:312
  - - C:\agentDhcpSvc\Hypersaves.exe
      "C:\agentDhcpSvc\Hypersaves.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1696
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\5bxb1a8eWE.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2144
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:4224
      - C:\agentDhcpSvc\Hypersaves.exe
        
        "C:\agentDhcpSvc\Hypersaves.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2968
        
        C:\Recovery\WindowsRE\taskhostw.exe
        
        "C:\Recovery\WindowsRE\taskhostw.exe"
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\agentDhcpSvc\RuntimeBroker.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:3480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\agentDhcpSvc\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\agentDhcpSvc\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1136

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\Searches\Idle.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:2412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Users\Admin\Searches\Idle.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2148

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 14 /tr "'C:\Users\Admin\Searches\Idle.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 8 /tr "'C:\Users\Public\conhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Users\Public\conhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 13 /tr "'C:\Users\Public\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\spoolsv.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:1564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\spoolsv.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\spoolsv.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2152

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\dwm.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\dwm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 12 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\dwm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\unsecapp.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:4656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\unsecapp.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\sysmon.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:440

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sysmon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:2376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\sysmon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3124

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\Desktop\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Users\Admin\Desktop\lsass.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\Desktop\lsass.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\Idle.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:8

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Idle.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\Idle.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 11 /tr "'C:\agentDhcpSvc\WaaSMedicAgent.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgent" /sc ONLOGON /tr "'C:\agentDhcpSvc\WaaSMedicAgent.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 13 /tr "'C:\agentDhcpSvc\WaaSMedicAgent.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\OfficeClickToRun.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2424

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:2524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\agentDhcpSvc\dwm.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\agentDhcpSvc\dwm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 8 /tr "'C:\agentDhcpSvc\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'C:\Users\Admin\Desktop\System.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Users\Admin\Desktop\System.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\Desktop\System.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:936

C:\Users\Admin\Desktop\Hypersave.exe
"C:\Users\Admin\Desktop\Hypersave.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1416
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\agentDhcpSvc\pi9IuiLHWNaL.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4784
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\agentDhcpSvc\gbli075iaSnGi986a4C8TH704K.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2936
  - - C:\agentDhcpSvc\Hypersaves.exe
      "C:\agentDhcpSvc\Hypersaves.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:3720

C:\Users\Admin\Desktop\Hypersave.exe
"C:\Users\Admin\Desktop\Hypersave.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4124
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\agentDhcpSvc\pi9IuiLHWNaL.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4980
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\agentDhcpSvc\gbli075iaSnGi986a4C8TH704K.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2152
  - - C:\agentDhcpSvc\Hypersaves.exe
      "C:\agentDhcpSvc\Hypersaves.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:5080

C:\Users\Admin\Desktop\Hypersave.exe
"C:\Users\Admin\Desktop\Hypersave.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3404
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\agentDhcpSvc\pi9IuiLHWNaL.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4612
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\agentDhcpSvc\gbli075iaSnGi986a4C8TH704K.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5116
  - - C:\agentDhcpSvc\Hypersaves.exe
      "C:\agentDhcpSvc\Hypersaves.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:3912

C:\Users\Admin\Desktop\Hypersave.exe
"C:\Users\Admin\Desktop\Hypersave.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1444
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\agentDhcpSvc\pi9IuiLHWNaL.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1164
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\agentDhcpSvc\gbli075iaSnGi986a4C8TH704K.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2920
  - - C:\agentDhcpSvc\Hypersaves.exe
      "C:\agentDhcpSvc\Hypersaves.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:5004

C:\Users\Admin\Desktop\Hypersave.exe
"C:\Users\Admin\Desktop\Hypersave.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\agentDhcpSvc\pi9IuiLHWNaL.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1788
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\agentDhcpSvc\gbli075iaSnGi986a4C8TH704K.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4720
  - - C:\agentDhcpSvc\Hypersaves.exe
      "C:\agentDhcpSvc\Hypersaves.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:380
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\7aE3SvgsUV.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1544
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:3904
      - C:\Program Files\Java\jre-1.8\lib\security\fontdrvhost.exe
        
        "C:\Program Files\Java\jre-1.8\lib\security\fontdrvhost.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2524

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\agentDhcpSvc\explorer.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\agentDhcpSvc\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\agentDhcpSvc\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:2908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4896

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Idle.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\Idle.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\Program Files\Java\jre-1.8\lib\security\fontdrvhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files\Java\jre-1.8\lib\security\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\Program Files\Java\jre-1.8\lib\security\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:2388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4296

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 13 /tr "'C:\Users\Public\Downloads\sihost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Users\Public\Downloads\sihost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 8 /tr "'C:\Users\Public\Downloads\sihost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Users\Default User\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Default User\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 8 /tr "'C:\agentDhcpSvc\Registry.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2124

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\agentDhcpSvc\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3232

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 8 /tr "'C:\agentDhcpSvc\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:3924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\Users\Default\Templates\explorer.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Users\Default\Templates\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:2948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 9 /tr "'C:\Users\Default\Templates\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:2304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:1592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- DcRat
PID:4484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:4324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "HypersavesH" /sc MINUTE /mo 8 /tr "'C:\Users\Default User\Hypersaves.exe'" /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:3640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Hypersaves" /sc ONLOGON /tr "'C:\Users\Default User\Hypersaves.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:3868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "HypersavesH" /sc MINUTE /mo 11 /tr "'C:\Users\Default User\Hypersaves.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:3168

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Mail\SppExtComObj.exe'" /f
1⤵
- DcRat
PID:4340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:5060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Mail\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:1724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery