dcrat | 1364e3f0b350e7b83a82e9d75745a14b1d88ee737583dcf3450ec719fadf6ad8

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
22/03/2025, 06:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

09b5a73b30c3c0c56d3b973a837a6284.exe
Size

885KB
MD5

09b5a73b30c3c0c56d3b973a837a6284
SHA1

2684da78d21f04c153436304950448a41e989f69
SHA256

0993169c4eec852201fcf3719983b5a00a356111c2ad86b89b293ef157a2e712
SHA512

49ecb467a265f962e9634e3cad074e95534e8389673c9dd70cbe738677b9770878c088273d22cc4303b4a54b8f4acf876b504d4e0ce1b09b8b7a8ab12a639dc3
SSDEEP

12288:clNE5VnZuh+ZIlXJBH5SP2I/lwvDT77/wOKsV42i3GULVaHeopyyx:clNCv6XJ5BClaXfD9vUha+u

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 64 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4896	3672	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5116	3672	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5168	3672	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	336	3672	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5508	3672	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4924	3672	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5260	3672	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4984	3672	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3536	3672	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3868	3672	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5732	3672	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3260	3672	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4756	3672	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3408	3672	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2248	3672	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4944	3672	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5024	3672	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3640	3672	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3508	3672	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3876	3672	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3556	3672	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4472	3672	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1992	3672	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3464	3672	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2120	3672	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1252	3672	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5988	3672	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5792	3672	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1548	3672	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2380	3672	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5940	3672	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3920	3672	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	216	3672	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3932	3672	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1396	3672	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2688	3672	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1944	3672	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4044	3672	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2540	3672	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5148	3672	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3004	3672	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2860	3672	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5332	3672	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5868	3672	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	408	3672	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5816	3672	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3852	3672	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2260	3672	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5180	3672	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	872	3672	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3040	3672	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3524	3672	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2524	3672	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5284	3672	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4316	3672	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	668	3672	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3768	3672	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6044	3672	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5324	3672	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4456	3672	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4480	3672	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5108	3672	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3376	3672	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2192	3672	schtasks.exe	87

DCRat payload 6 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral12/memory/4820-1-0x0000000000BB0000-0x0000000000C94000-memory.dmp	dcrat
behavioral12/files/0x00070000000242da-19.dat	dcrat
behavioral12/files/0x000d0000000242d0-116.dat	dcrat
behavioral12/files/0x000f000000024178-251.dat	dcrat
behavioral12/files/0x0009000000024329-308.dat	dcrat
behavioral12/files/0x000700000002432b-319.dat	dcrat

Checks computer location settings 2 TTPs 17 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation	taskhostw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation	taskhostw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation	taskhostw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation	taskhostw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation	09b5a73b30c3c0c56d3b973a837a6284.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation	taskhostw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation	taskhostw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation	taskhostw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation	taskhostw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation	taskhostw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation	taskhostw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation	taskhostw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation	taskhostw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation	09b5a73b30c3c0c56d3b973a837a6284.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation	taskhostw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation	taskhostw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation	taskhostw.exe

Executes dropped EXE 15 IoCs

pid	Process
4320	taskhostw.exe
956	taskhostw.exe
3688	taskhostw.exe
4964	taskhostw.exe
3952	taskhostw.exe
2676	taskhostw.exe
1156	taskhostw.exe
4692	taskhostw.exe
4960	taskhostw.exe
4880	taskhostw.exe
3776	taskhostw.exe
6080	taskhostw.exe
5768	taskhostw.exe
4436	taskhostw.exe
3860	taskhostw.exe

Drops file in Program Files directory 40 IoCs

description	ioc	Process
File created	C:\Program Files\VideoLAN\VLC\smss.exe	09b5a73b30c3c0c56d3b973a837a6284.exe
File created	C:\Program Files (x86)\Google\sppsvc.exe	09b5a73b30c3c0c56d3b973a837a6284.exe
File created	C:\Program Files\edge_BITS_4632_1040431193\cc11b995f2a76d	09b5a73b30c3c0c56d3b973a837a6284.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\it-IT\RCX85A6.tmp	09b5a73b30c3c0c56d3b973a837a6284.exe
File created	C:\Program Files\MsEdgeCrashpad\unsecapp.exe	09b5a73b30c3c0c56d3b973a837a6284.exe
File created	C:\Program Files (x86)\Google\0a1fd5f707cd16	09b5a73b30c3c0c56d3b973a837a6284.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\it-IT\RCX85A5.tmp	09b5a73b30c3c0c56d3b973a837a6284.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\RCX8749.tmp	09b5a73b30c3c0c56d3b973a837a6284.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\eddb19405b7ce1	09b5a73b30c3c0c56d3b973a837a6284.exe
File created	C:\Program Files\edge_BITS_4596_1110536658\System.exe	09b5a73b30c3c0c56d3b973a837a6284.exe
File created	C:\Program Files\MsEdgeCrashpad\29c1c3cc0f7685	09b5a73b30c3c0c56d3b973a837a6284.exe
File opened for modification	C:\Program Files\edge_BITS_4596_1110536658\RCX8B53.tmp	09b5a73b30c3c0c56d3b973a837a6284.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\RCX8B8B.tmp	09b5a73b30c3c0c56d3b973a837a6284.exe
File created	C:\Program Files (x86)\Common Files\Oracle\5b884080fd4f94	09b5a73b30c3c0c56d3b973a837a6284.exe
File created	C:\Program Files (x86)\Internet Explorer\it-IT\66fc9ff0ee96c2	09b5a73b30c3c0c56d3b973a837a6284.exe
File created	C:\Program Files\edge_BITS_4632_1040431193\winlogon.exe	09b5a73b30c3c0c56d3b973a837a6284.exe
File opened for modification	C:\Program Files\Windows Media Player\de-DE\RCX8711.tmp	09b5a73b30c3c0c56d3b973a837a6284.exe
File opened for modification	C:\Program Files\WindowsPowerShell\RCX8B65.tmp	09b5a73b30c3c0c56d3b973a837a6284.exe
File opened for modification	C:\Program Files (x86)\Google\RCX865E.tmp	09b5a73b30c3c0c56d3b973a837a6284.exe
File created	C:\Program Files\WindowsPowerShell\TextInputHost.exe	09b5a73b30c3c0c56d3b973a837a6284.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\RCX8B31.tmp	09b5a73b30c3c0c56d3b973a837a6284.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\RCX8515.tmp	09b5a73b30c3c0c56d3b973a837a6284.exe
File created	C:\Program Files (x86)\Internet Explorer\it-IT\sihost.exe	09b5a73b30c3c0c56d3b973a837a6284.exe
File opened for modification	C:\Program Files\edge_BITS_4632_1040431193\RCX8735.tmp	09b5a73b30c3c0c56d3b973a837a6284.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\RCX8B41.tmp	09b5a73b30c3c0c56d3b973a837a6284.exe
File created	C:\Program Files\Windows Media Player\de-DE\sppsvc.exe	09b5a73b30c3c0c56d3b973a837a6284.exe
File opened for modification	C:\Program Files\edge_BITS_4632_1040431193\RCX8734.tmp	09b5a73b30c3c0c56d3b973a837a6284.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\RCX8B9C.tmp	09b5a73b30c3c0c56d3b973a837a6284.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\RCX8748.tmp	09b5a73b30c3c0c56d3b973a837a6284.exe
File created	C:\Program Files\VideoLAN\VLC\69ddcba757bf72	09b5a73b30c3c0c56d3b973a837a6284.exe
File created	C:\Program Files (x86)\Common Files\Oracle\fontdrvhost.exe	09b5a73b30c3c0c56d3b973a837a6284.exe
File created	C:\Program Files\Windows Media Player\de-DE\0a1fd5f707cd16	09b5a73b30c3c0c56d3b973a837a6284.exe
File opened for modification	C:\Program Files\Windows Media Player\de-DE\RCX8712.tmp	09b5a73b30c3c0c56d3b973a837a6284.exe
File created	C:\Program Files\WindowsPowerShell\22eafd247d37c3	09b5a73b30c3c0c56d3b973a837a6284.exe
File opened for modification	C:\Program Files\edge_BITS_4596_1110536658\RCX8B42.tmp	09b5a73b30c3c0c56d3b973a837a6284.exe
File opened for modification	C:\Program Files\WindowsPowerShell\RCX8B54.tmp	09b5a73b30c3c0c56d3b973a837a6284.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\RCX8505.tmp	09b5a73b30c3c0c56d3b973a837a6284.exe
File opened for modification	C:\Program Files (x86)\Google\RCX865D.tmp	09b5a73b30c3c0c56d3b973a837a6284.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\backgroundTaskHost.exe	09b5a73b30c3c0c56d3b973a837a6284.exe
File created	C:\Program Files\edge_BITS_4596_1110536658\27d1bcfc3c54e0	09b5a73b30c3c0c56d3b973a837a6284.exe

Drops file in Windows directory 17 IoCs

description	ioc	Process
File created	C:\Windows\uk-UA\09b5a73b30c3c0c56d3b973a837a6284.exe	09b5a73b30c3c0c56d3b973a837a6284.exe
File created	C:\Windows\Registration\CRMLog\sihost.exe	09b5a73b30c3c0c56d3b973a837a6284.exe
File opened for modification	C:\Windows\Registration\CRMLog\RCX86ED.tmp	09b5a73b30c3c0c56d3b973a837a6284.exe
File created	C:\Windows\Web\4K\backgroundTaskHost.exe	09b5a73b30c3c0c56d3b973a837a6284.exe
File created	C:\Windows\Web\4K\eddb19405b7ce1	09b5a73b30c3c0c56d3b973a837a6284.exe
File created	C:\Windows\Fonts\OfficeClickToRun.exe	09b5a73b30c3c0c56d3b973a837a6284.exe
File created	C:\Windows\Fonts\e6c9b481da804f	09b5a73b30c3c0c56d3b973a837a6284.exe
File opened for modification	C:\Windows\Fonts\RCX8BAC.tmp	09b5a73b30c3c0c56d3b973a837a6284.exe
File created	C:\Windows\uk-UA\8a5a5505a8f0b2	09b5a73b30c3c0c56d3b973a837a6284.exe
File created	C:\Windows\schemas\EAPMethods\RuntimeBroker.exe	09b5a73b30c3c0c56d3b973a837a6284.exe
File opened for modification	C:\Windows\Web\4K\RCX8B2F.tmp	09b5a73b30c3c0c56d3b973a837a6284.exe
File opened for modification	C:\Windows\Fonts\RCX8BAD.tmp	09b5a73b30c3c0c56d3b973a837a6284.exe
File created	C:\Windows\Registration\CRMLog\66fc9ff0ee96c2	09b5a73b30c3c0c56d3b973a837a6284.exe
File opened for modification	C:\Windows\Registration\CRMLog\RCX86EE.tmp	09b5a73b30c3c0c56d3b973a837a6284.exe
File opened for modification	C:\Windows\Web\4K\RCX8B30.tmp	09b5a73b30c3c0c56d3b973a837a6284.exe
File opened for modification	C:\Windows\uk-UA\RCX8626.tmp	09b5a73b30c3c0c56d3b973a837a6284.exe
File opened for modification	C:\Windows\uk-UA\RCX8627.tmp	09b5a73b30c3c0c56d3b973a837a6284.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000_Classes\Local Settings	taskhostw.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 64 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4044	schtasks.exe
3040	schtasks.exe
6044	schtasks.exe
3376	schtasks.exe
4960	schtasks.exe
5176	schtasks.exe
4756	schtasks.exe
4472	schtasks.exe
4456	schtasks.exe
216	schtasks.exe
668	schtasks.exe
5600	schtasks.exe
4944	schtasks.exe
5868	schtasks.exe
2260	schtasks.exe
4480	schtasks.exe
4992	schtasks.exe
3064	schtasks.exe
2444	schtasks.exe
3128	schtasks.exe
5148	schtasks.exe
5024	schtasks.exe
3004	schtasks.exe
5180	schtasks.exe
2192	schtasks.exe
2344	schtasks.exe
3132	schtasks.exe
5116	schtasks.exe
5168	schtasks.exe
3408	schtasks.exe
3852	schtasks.exe
5284	schtasks.exe
4316	schtasks.exe
5064	schtasks.exe
5200	schtasks.exe
2380	schtasks.exe
4756	schtasks.exe
1632	schtasks.exe
1380	schtasks.exe
3856	schtasks.exe
3260	schtasks.exe
2248	schtasks.exe
2860	schtasks.exe
872	schtasks.exe
5732	schtasks.exe
3640	schtasks.exe
3508	schtasks.exe
3464	schtasks.exe
1944	schtasks.exe
5816	schtasks.exe
5324	schtasks.exe
5108	schtasks.exe
4924	schtasks.exe
1548	schtasks.exe
5940	schtasks.exe
4732	schtasks.exe
5116	schtasks.exe
4848	schtasks.exe
468	schtasks.exe
5260	schtasks.exe
3868	schtasks.exe
1992	schtasks.exe
2120	schtasks.exe
1396	schtasks.exe

Suspicious behavior: EnumeratesProcesses 25 IoCs

pid	Process
4820	09b5a73b30c3c0c56d3b973a837a6284.exe
4820	09b5a73b30c3c0c56d3b973a837a6284.exe
4820	09b5a73b30c3c0c56d3b973a837a6284.exe
4592	09b5a73b30c3c0c56d3b973a837a6284.exe
4592	09b5a73b30c3c0c56d3b973a837a6284.exe
4592	09b5a73b30c3c0c56d3b973a837a6284.exe
4320	taskhostw.exe
956	taskhostw.exe
3688	taskhostw.exe
4964	taskhostw.exe
4964	taskhostw.exe
3952	taskhostw.exe
3952	taskhostw.exe
2676	taskhostw.exe
2676	taskhostw.exe
1156	taskhostw.exe
4692	taskhostw.exe
4960	taskhostw.exe
4880	taskhostw.exe
3776	taskhostw.exe
6080	taskhostw.exe
5768	taskhostw.exe
4436	taskhostw.exe
4436	taskhostw.exe
3860	taskhostw.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeDebugPrivilege	4820	09b5a73b30c3c0c56d3b973a837a6284.exe
Token: SeDebugPrivilege	4592	09b5a73b30c3c0c56d3b973a837a6284.exe
Token: SeDebugPrivilege	4320	taskhostw.exe
Token: SeDebugPrivilege	956	taskhostw.exe
Token: SeDebugPrivilege	3688	taskhostw.exe
Token: SeDebugPrivilege	4964	taskhostw.exe
Token: SeDebugPrivilege	3952	taskhostw.exe
Token: SeDebugPrivilege	2676	taskhostw.exe
Token: SeDebugPrivilege	1156	taskhostw.exe
Token: SeDebugPrivilege	4692	taskhostw.exe
Token: SeDebugPrivilege	4960	taskhostw.exe
Token: SeDebugPrivilege	4880	taskhostw.exe
Token: SeDebugPrivilege	3776	taskhostw.exe
Token: SeDebugPrivilege	6080	taskhostw.exe
Token: SeDebugPrivilege	5768	taskhostw.exe
Token: SeDebugPrivilege	4436	taskhostw.exe
Token: SeDebugPrivilege	3860	taskhostw.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4820 wrote to memory of 4592	4820	09b5a73b30c3c0c56d3b973a837a6284.exe	145
PID 4820 wrote to memory of 4592	4820	09b5a73b30c3c0c56d3b973a837a6284.exe	145
PID 4592 wrote to memory of 4320	4592	09b5a73b30c3c0c56d3b973a837a6284.exe	181
PID 4592 wrote to memory of 4320	4592	09b5a73b30c3c0c56d3b973a837a6284.exe	181
PID 4320 wrote to memory of 2012	4320	taskhostw.exe	183
PID 4320 wrote to memory of 2012	4320	taskhostw.exe	183
PID 4320 wrote to memory of 3032	4320	taskhostw.exe	184
PID 4320 wrote to memory of 3032	4320	taskhostw.exe	184
PID 2012 wrote to memory of 956	2012	WScript.exe	187
PID 2012 wrote to memory of 956	2012	WScript.exe	187
PID 956 wrote to memory of 2804	956	taskhostw.exe	188
PID 956 wrote to memory of 2804	956	taskhostw.exe	188
PID 956 wrote to memory of 1824	956	taskhostw.exe	189
PID 956 wrote to memory of 1824	956	taskhostw.exe	189
PID 2804 wrote to memory of 3688	2804	WScript.exe	191
PID 2804 wrote to memory of 3688	2804	WScript.exe	191
PID 3688 wrote to memory of 3900	3688	taskhostw.exe	192
PID 3688 wrote to memory of 3900	3688	taskhostw.exe	192
PID 3688 wrote to memory of 4808	3688	taskhostw.exe	193
PID 3688 wrote to memory of 4808	3688	taskhostw.exe	193
PID 3900 wrote to memory of 4964	3900	WScript.exe	196
PID 3900 wrote to memory of 4964	3900	WScript.exe	196
PID 4964 wrote to memory of 2948	4964	taskhostw.exe	199
PID 4964 wrote to memory of 2948	4964	taskhostw.exe	199
PID 4964 wrote to memory of 2640	4964	taskhostw.exe	200
PID 4964 wrote to memory of 2640	4964	taskhostw.exe	200
PID 2948 wrote to memory of 3952	2948	WScript.exe	205
PID 2948 wrote to memory of 3952	2948	WScript.exe	205
PID 3952 wrote to memory of 836	3952	taskhostw.exe	206
PID 3952 wrote to memory of 836	3952	taskhostw.exe	206
PID 3952 wrote to memory of 4060	3952	taskhostw.exe	207
PID 3952 wrote to memory of 4060	3952	taskhostw.exe	207
PID 836 wrote to memory of 2676	836	WScript.exe	208
PID 836 wrote to memory of 2676	836	WScript.exe	208
PID 2676 wrote to memory of 3184	2676	taskhostw.exe	209
PID 2676 wrote to memory of 3184	2676	taskhostw.exe	209
PID 2676 wrote to memory of 556	2676	taskhostw.exe	210
PID 2676 wrote to memory of 556	2676	taskhostw.exe	210
PID 3184 wrote to memory of 1156	3184	WScript.exe	211
PID 3184 wrote to memory of 1156	3184	WScript.exe	211
PID 1156 wrote to memory of 3356	1156	taskhostw.exe	212
PID 1156 wrote to memory of 3356	1156	taskhostw.exe	212
PID 1156 wrote to memory of 2024	1156	taskhostw.exe	213
PID 1156 wrote to memory of 2024	1156	taskhostw.exe	213
PID 3356 wrote to memory of 4692	3356	WScript.exe	215
PID 3356 wrote to memory of 4692	3356	WScript.exe	215
PID 4692 wrote to memory of 2652	4692	taskhostw.exe	216
PID 4692 wrote to memory of 2652	4692	taskhostw.exe	216
PID 4692 wrote to memory of 2616	4692	taskhostw.exe	217
PID 4692 wrote to memory of 2616	4692	taskhostw.exe	217
PID 2652 wrote to memory of 4960	2652	WScript.exe	218
PID 2652 wrote to memory of 4960	2652	WScript.exe	218
PID 4960 wrote to memory of 2776	4960	taskhostw.exe	219
PID 4960 wrote to memory of 2776	4960	taskhostw.exe	219
PID 4960 wrote to memory of 5096	4960	taskhostw.exe	220
PID 4960 wrote to memory of 5096	4960	taskhostw.exe	220
PID 2776 wrote to memory of 4880	2776	WScript.exe	221
PID 2776 wrote to memory of 4880	2776	WScript.exe	221
PID 4880 wrote to memory of 1668	4880	taskhostw.exe	222
PID 4880 wrote to memory of 1668	4880	taskhostw.exe	222
PID 4880 wrote to memory of 868	4880	taskhostw.exe	223
PID 4880 wrote to memory of 868	4880	taskhostw.exe	223
PID 1668 wrote to memory of 3776	1668	WScript.exe	224
PID 1668 wrote to memory of 3776	1668	WScript.exe	224

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\09b5a73b30c3c0c56d3b973a837a6284.exe
"C:\Users\Admin\AppData\Local\Temp\09b5a73b30c3c0c56d3b973a837a6284.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4820
- C:\Users\Admin\AppData\Local\Temp\09b5a73b30c3c0c56d3b973a837a6284.exe
  "C:\Users\Admin\AppData\Local\Temp\09b5a73b30c3c0c56d3b973a837a6284.exe"
  2⤵
  - Checks computer location settings
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4592
- - C:\Users\Default User\taskhostw.exe
    "C:\Users\Default User\taskhostw.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4320
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\34beb988-d62d-481b-8701-af8f554ea196.vbs"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2012
    - - C:\Users\Default User\taskhostw.exe
        
        "C:\Users\Default User\taskhostw.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:956
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6fe742dd-8605-406c-8cc0-3ad2760b8467.vbs"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2804
        
        C:\Users\Default User\taskhostw.exe
        
        "C:\Users\Default User\taskhostw.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3688
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0420a320-7f8c-4777-ab69-412839852026.vbs"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:3900
        
        C:\Users\Default User\taskhostw.exe
        
        "C:\Users\Default User\taskhostw.exe"
        9⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4964
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e7c562ee-eb29-4099-aa51-ec50ed884972.vbs"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:2948
        
        C:\Users\Default User\taskhostw.exe
        
        "C:\Users\Default User\taskhostw.exe"
        11⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3952
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4ef9142c-3991-4737-b082-a87846a9c97c.vbs"
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:836
        
        C:\Users\Default User\taskhostw.exe
        
        "C:\Users\Default User\taskhostw.exe"
        13⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2676
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\165d6593-94c9-44df-bcda-b6311cb145bd.vbs"
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:3184
        
        C:\Users\Default User\taskhostw.exe
        
        "C:\Users\Default User\taskhostw.exe"
        15⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1156
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\559fccfc-7d9c-46fc-99c6-0716d052c63e.vbs"
        16⤵
        Suspicious use of WriteProcessMemory
        
        PID:3356
        
        C:\Users\Default User\taskhostw.exe
        
        "C:\Users\Default User\taskhostw.exe"
        17⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4692
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\79eb34b4-ab23-4ef2-a493-69c58f826630.vbs"
        18⤵
        Suspicious use of WriteProcessMemory
        
        PID:2652
        
        C:\Users\Default User\taskhostw.exe
        
        "C:\Users\Default User\taskhostw.exe"
        19⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4960
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c228f233-a315-4426-b4f6-d074557d9f86.vbs"
        20⤵
        Suspicious use of WriteProcessMemory
        
        PID:2776
        
        C:\Users\Default User\taskhostw.exe
        
        "C:\Users\Default User\taskhostw.exe"
        21⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4880
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0116a54f-cde5-49c5-bb06-9deb42413173.vbs"
        22⤵
        Suspicious use of WriteProcessMemory
        
        PID:1668
        
        C:\Users\Default User\taskhostw.exe
        
        "C:\Users\Default User\taskhostw.exe"
        23⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3776
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\70b1156a-c299-40f6-82b7-56b71647bfe9.vbs"
        24⤵
        
        PID:4628
        
        C:\Users\Default User\taskhostw.exe
        
        "C:\Users\Default User\taskhostw.exe"
        25⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:6080
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d386238e-4eda-4008-a61e-a763c466a077.vbs"
        26⤵
        
        PID:5500
        
        C:\Users\Default User\taskhostw.exe
        
        "C:\Users\Default User\taskhostw.exe"
        27⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5768
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b91cc0af-9483-4f32-a4db-11ce4ad73123.vbs"
        28⤵
        
        PID:4484
        
        C:\Users\Default User\taskhostw.exe
        
        "C:\Users\Default User\taskhostw.exe"
        29⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4436
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f2b9e98b-0d1c-406d-a962-a4a2ba16daa5.vbs"
        30⤵
        
        PID:412
        
        C:\Users\Default User\taskhostw.exe
        
        "C:\Users\Default User\taskhostw.exe"
        31⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3860
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d6ed8848-bba9-4ed9-9b53-9fc56a53db2a.vbs"
        32⤵
        
        PID:5660
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0b48e6aa-45d7-4bac-9aad-10e5e6fe9b9c.vbs"
        32⤵
        
        PID:432
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\976d1134-f8b2-4518-8c23-d49be5b01c76.vbs"
        30⤵
        
        PID:3160
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f18cbc71-21cb-43b6-b804-bbb84dc0d937.vbs"
        28⤵
        
        PID:396
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\914572c1-4354-4f6d-9a20-7f6e4c730d88.vbs"
        26⤵
        
        PID:6008
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9428a980-e94a-423d-a9a7-34cfcb4aecef.vbs"
        24⤵
        
        PID:5364
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d64124fb-05e7-42ec-9e6c-d4b18d06ff65.vbs"
        22⤵
        
        PID:868
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5ec29d3a-813a-4412-a0fc-d064c67f29e3.vbs"
        20⤵
        
        PID:5096
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c7a55999-4ad8-439a-85cd-0798372d961b.vbs"
        18⤵
        
        PID:2616
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e91763d9-81f2-4725-b4ed-f009b0128d2d.vbs"
        16⤵
        
        PID:2024
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\84f239c6-992a-4fa5-8272-4711eadf2788.vbs"
        14⤵
        
        PID:556
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5da27376-51cc-4330-883e-8778b27dbfb8.vbs"
        12⤵
        
        PID:4060
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cf9fe372-076d-4669-b149-3e456b731c0a.vbs"
        10⤵
        
        PID:2640
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8d2d4b19-3693-459f-a8f3-fa06e5c388b8.vbs"
        8⤵
        
        PID:4808
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4f1f86ca-bb59-41ba-88e3-975799ab13c9.vbs"
        6⤵
        
        PID:1824
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\756d57ac-e52d-459a-862a-45f4f0c15594.vbs"
      4⤵
      PID:3032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 5 /tr "'C:\2f3e0199fccb3f72e8a39924edc6a781\upfc.exe'" /f
1⤵
- Process spawned unexpected child process
PID:4896

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\2f3e0199fccb3f72e8a39924edc6a781\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 6 /tr "'C:\2f3e0199fccb3f72e8a39924edc6a781\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5168

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 11 /tr "'C:\2f3e0199fccb3f72e8a39924edc6a781\backgroundTaskHost.exe'" /f
1⤵
- Process spawned unexpected child process
PID:336

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\2f3e0199fccb3f72e8a39924edc6a781\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:5508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 6 /tr "'C:\2f3e0199fccb3f72e8a39924edc6a781\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Common Files\Oracle\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5260

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\Oracle\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:4984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Common Files\Oracle\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:3536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 14 /tr "'C:\2f3e0199fccb3f72e8a39924edc6a781\backgroundTaskHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\2f3e0199fccb3f72e8a39924edc6a781\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 7 /tr "'C:\2f3e0199fccb3f72e8a39924edc6a781\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3260

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Internet Explorer\it-IT\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\it-IT\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Internet Explorer\it-IT\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 9 /tr "'C:\2f3e0199fccb3f72e8a39924edc6a781\unsecapp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\2f3e0199fccb3f72e8a39924edc6a781\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 10 /tr "'C:\2f3e0199fccb3f72e8a39924edc6a781\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "09b5a73b30c3c0c56d3b973a837a62840" /sc MINUTE /mo 5 /tr "'C:\Windows\uk-UA\09b5a73b30c3c0c56d3b973a837a6284.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "09b5a73b30c3c0c56d3b973a837a6284" /sc ONLOGON /tr "'C:\Windows\uk-UA\09b5a73b30c3c0c56d3b973a837a6284.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:3876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "09b5a73b30c3c0c56d3b973a837a62840" /sc MINUTE /mo 5 /tr "'C:\Windows\uk-UA\09b5a73b30c3c0c56d3b973a837a6284.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:3556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Admin\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 12 /tr "'C:\34c553de294c1d56d0a800105b\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2120

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\34c553de294c1d56d0a800105b\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:1252

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 14 /tr "'C:\34c553de294c1d56d0a800105b\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:5988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
PID:5792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Google\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:3920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Google\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\2f3e0199fccb3f72e8a39924edc6a781\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
PID:3932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\2f3e0199fccb3f72e8a39924edc6a781\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\2f3e0199fccb3f72e8a39924edc6a781\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:2688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 13 /tr "'C:\Windows\Registration\CRMLog\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Windows\Registration\CRMLog\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 13 /tr "'C:\Windows\Registration\CRMLog\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:2540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 10 /tr "'C:\2f3e0199fccb3f72e8a39924edc6a781\upfc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5148

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\2f3e0199fccb3f72e8a39924edc6a781\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 9 /tr "'C:\2f3e0199fccb3f72e8a39924edc6a781\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Media Player\de-DE\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
PID:5332

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files\Windows Media Player\de-DE\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Media Player\de-DE\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 7 /tr "'C:\2f3e0199fccb3f72e8a39924edc6a781\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\2f3e0199fccb3f72e8a39924edc6a781\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\2f3e0199fccb3f72e8a39924edc6a781\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2260

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 12 /tr "'C:\Program Files\edge_BITS_4632_1040431193\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5180

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files\edge_BITS_4632_1040431193\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'C:\Program Files\edge_BITS_4632_1040431193\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\2f3e0199fccb3f72e8a39924edc6a781\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
PID:3524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\2f3e0199fccb3f72e8a39924edc6a781\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:2524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\2f3e0199fccb3f72e8a39924edc6a781\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 5 /tr "'C:\Program Files\VideoLAN\VLC\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\VLC\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 6 /tr "'C:\Program Files\VideoLAN\VLC\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:3768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 14 /tr "'C:\2f3e0199fccb3f72e8a39924edc6a781\upfc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\2f3e0199fccb3f72e8a39924edc6a781\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 9 /tr "'C:\2f3e0199fccb3f72e8a39924edc6a781\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4456

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\34c553de294c1d56d0a800105b\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\34c553de294c1d56d0a800105b\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\34c553de294c1d56d0a800105b\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 13 /tr "'C:\Windows\Web\4K\backgroundTaskHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2192

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Windows\Web\4K\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:4732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 6 /tr "'C:\Windows\Web\4K\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:2344

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\backgroundTaskHost.exe'" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:5064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:5116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:4960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 6 /tr "'C:\Program Files\edge_BITS_4596_1110536658\System.exe'" /f
1⤵
PID:1120

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files\edge_BITS_4596_1110536658\System.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:4848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 12 /tr "'C:\Program Files\edge_BITS_4596_1110536658\System.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:4992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 9 /tr "'C:\Program Files\WindowsPowerShell\TextInputHost.exe'" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:5200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Program Files\WindowsPowerShell\TextInputHost.exe'" /rl HIGHEST /f
1⤵
PID:4984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 11 /tr "'C:\Program Files\WindowsPowerShell\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:5176

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\System.exe'" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:3132

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\System.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\System.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:3064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\2f3e0199fccb3f72e8a39924edc6a781\fontdrvhost.exe'" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:4756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\2f3e0199fccb3f72e8a39924edc6a781\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:5600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\2f3e0199fccb3f72e8a39924edc6a781\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
PID:3408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\taskhostw.exe'" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:2444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Users\Default User\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:1632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 9 /tr "'C:\Users\Default User\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:1380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 6 /tr "'C:\Program Files\MsEdgeCrashpad\unsecapp.exe'" /f
1⤵
PID:5892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Program Files\MsEdgeCrashpad\unsecapp.exe'" /rl HIGHEST /f
1⤵
PID:3600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 5 /tr "'C:\Program Files\MsEdgeCrashpad\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:3128

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 14 /tr "'C:\Windows\Fonts\OfficeClickToRun.exe'" /f
1⤵
PID:3924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Windows\Fonts\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:3856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 12 /tr "'C:\Windows\Fonts\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
PID:2640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\2f3e0199fccb3f72e8a39924edc6a781\5b884080fd4f94

Filesize
282B

MD5
434bb6e97ac755226712ceea114a6f4f

SHA1
6fc863b2f802baf9df4f279050677c6ef344c9e1

SHA256
999853782563e41fed3cdcc4886bfe9efa70b008107f52d7d39ea175ccd8f6bb

SHA512
a47c9f4da03f355321e3423e4780ab6c9a4add73441c2b27132e706c599292631b9b23fd319671ca4ce23e40638e6a815fc664787d368639fde0ce382188513a

Download Submit
C:\2f3e0199fccb3f72e8a39924edc6a781\RCX8625.tmp

Filesize
885KB

MD5
2b089cd8a8608a8035f2afaadb37d506

SHA1
2bc339a454e09a14ca59411964d4c642853d4c4b

SHA256
dc6f7e8c00c463832f28529eba455d4f40efaae1aed95c3a400d5421e3f65e97

SHA512
fd50caeeb409cab20bfcb32a4e8c55f75df9e5ef916595ae2886cda5088edf3b0f90fbb8a2bcfbe2155ee2fb1b64e0e0796739f2a5f84785ef47ed06183f21b6

Download Submit
C:\2f3e0199fccb3f72e8a39924edc6a781\ea1d8f6d871115

Filesize
470B

MD5
c343fdb67f444f063e1383e6f3d4944c

SHA1
aa4ac828755445b340b98ff28b7954b039d40f1a

SHA256
7b4134a94833d220d2d21de387ab748e80e1eee634abb45d06b46436244f77e7

SHA512
a3d35df755e7d3a4c4ccb9cf5a6087527681e3face82370f029ecda5aa8fe4e02a9d667acdc7f16146108eaecbc12f0e7afa32f4ac11750166a8504bec4fc096

Download Submit
C:\34c553de294c1d56d0a800105b\RCX8B1D.tmp

Filesize
885KB

MD5
31bfb9d4fb63a71434f74798bb0de3c2

SHA1
7ee0a75b3191e8fd5eb8087a00327ec4f751b175

SHA256
868f72b8a9f4fd6156762a455850af431a60c41d5d541bb4c71f4f4e41b99490

SHA512
d4f7f5377bc8cad95c468e19eb32e1ce40c2f7129f0e8cea19e34c0dd03300290e803e6067607bb03de6307e08031587ca2b109556559b01106a808dc44704b0

Download Submit
C:\Program Files (x86)\Internet Explorer\it-IT\sihost.exe

Filesize
885KB

MD5
09b5a73b30c3c0c56d3b973a837a6284

SHA1
2684da78d21f04c153436304950448a41e989f69

SHA256
0993169c4eec852201fcf3719983b5a00a356111c2ad86b89b293ef157a2e712

SHA512
49ecb467a265f962e9634e3cad074e95534e8389673c9dd70cbe738677b9770878c088273d22cc4303b4a54b8f4acf876b504d4e0ce1b09b8b7a8ab12a639dc3

Download Submit
C:\Program Files\VideoLAN\VLC\RCX8748.tmp

Filesize
885KB

MD5
2aefdac75cd615be49c77253d9cff7ef

SHA1
fa31b160be8bd79a7c6a4ce094773eed9f46fef5

SHA256
d77e1ccb29f84f4c03216512783e654690df1b6944a19883f2ad9bd9837158a1

SHA512
51929bcc554a9048b86cb8f764f1bc427524062a7c12abe8a3b2367a325e58087217cb367641156782e0afc257f482b79bc4beea5746cf2b7a4a3466f68aee66

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\09b5a73b30c3c0c56d3b973a837a6284.exe.log

Filesize
1KB

MD5
7800fca2323a4130444c572374a030f4

SHA1
40c9b8e0e5e7d72a5293f4010f2ccf21e637b4aa

SHA256
29f5645ac14353ac460858f52c856548f3aeb144b09eef672a6b4849bafe742e

SHA512
c8a7ad930b8c07007c7a67d8c32a2a4a401dcc34ab966e0e80901655fcbe1f5c95b72a195e6381b1de56c2c987eeab093d8e89891bec9e9684785c5d824b3554

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\taskhostw.exe.log

Filesize
1KB

MD5
3690a1c3b695227a38625dcf27bd6dac

SHA1
c2ed91e98b120681182904fa2c7cd504e5c4b2f5

SHA256
2ca8df156dba033c5b3ae4009e3be14dcdc6b9be53588055efd0864a1ab8ff73

SHA512
15ebfe05c0317f844e957ac02842a60b01f00ddca981e888e547056d0e30c97829bc4a2a46ce43034b3346f7cf5406c7c41c2a830f0abc47c8d2fd2ef00cb2c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\0116a54f-cde5-49c5-bb06-9deb42413173.vbs

Filesize
711B

MD5
042e0d2b9cdff0ebcd1cb59752115467

SHA1
96b1efde9b9002a9aeb362ab2f0e61e27a1e4375

SHA256
e8ea580bcaddca5b0219425ef87910d2fff70beecef3fb07a526e674f917a469

SHA512
ed51a7de1a7da16b81e4fe540a9a8ace5d6c463a8cb9df866f9831a05d028f7c0ee14171e09bc6bc1e6ecc7724877e0846988f2b5f886ddc5653017951a6337f

Download Submit
C:\Users\Admin\AppData\Local\Temp\0420a320-7f8c-4777-ab69-412839852026.vbs

Filesize
711B

MD5
04f5ff3115cd6c6869552a0be480c1aa

SHA1
cd6e05faee31dd10adda8385ac3e78bc589422ed

SHA256
19879b382301ac78546e5b58c697dc409d6f826dbb35385c1c20ef16df91aa4e

SHA512
10ca18bbaacea5a6eaa9b1b2ed48a356c37079d86f373fb8f756edc3fb67d1b0aca45bf09bae569cddf32c35825fdf5fdb20bff422547534336af2ca20ab0bdc

Download Submit
C:\Users\Admin\AppData\Local\Temp\165d6593-94c9-44df-bcda-b6311cb145bd.vbs

Filesize
711B

MD5
2e484fe71fcf5a008987c60fc32761f9

SHA1
9aa95d6ca70eef3abe077a86d8194ee6e9d71123

SHA256
95c92d91c9d3685f63c5b3ad2940491af7c745c39402fa9438aeb5bc93472a24

SHA512
667deb05e8431408dbc72924ecf1cbe336226f9c65321cb71a83e56043d83d1ffae2c1e6966f32cff5bbaa9b0a57c039257a210a71cef158d5fa965b1517bbf2

Download Submit
C:\Users\Admin\AppData\Local\Temp\34beb988-d62d-481b-8701-af8f554ea196.vbs

Filesize
711B

MD5
a1f08ff518554f37a0757b05592408d9

SHA1
a2e098bc3a8541c23bddd2557c2a4609aa336b2d

SHA256
eaead14b8940d66f2ebdfa59311164e68405e688061365adbe5f36e0ff6f6ae2

SHA512
887706cb08520f113ed919a0003d97fa2108de5f873d89cdd0beb80511fe584299ae16ec0b129c8103f7287884f830ded6e4d0b3768f8e83a03f4cf29fda4001

Download Submit
C:\Users\Admin\AppData\Local\Temp\4ef9142c-3991-4737-b082-a87846a9c97c.vbs

Filesize
711B

MD5
6653730c34fc9ea82f10a8dc9fb539dd

SHA1
f9481cecc67ac6c008e4161bb573a5f2fea3433e

SHA256
562937cf06509c6f768df051aa2d6dcc9bb8b961a261bfc1f8b38aff4475b208

SHA512
ba9202bd206a47ad28babd4b9f7d90297f48a38f7a8585531180dd13cd19ff8b69a138e54c381369a3938c8a50a42d6703ace8ad3b6f4a6f8986b3e6881b2d07

Download Submit
C:\Users\Admin\AppData\Local\Temp\559fccfc-7d9c-46fc-99c6-0716d052c63e.vbs

Filesize
711B

MD5
b4a1d1cb85533c6b8e545c3dc9ffdc48

SHA1
c4cd2e0b922830b9286cb1076d34b712329ea0ce

SHA256
c738e6248424f202829f7293ec5c04ea2bc060b6255ea4247a79974031ba0205

SHA512
36bb5c555a204de38b5c55e458b55cebf6fea2310a8204113242855a097847ba4bb8ec76bff89aafb8d4b43334359c695763340d4c1be0c553e44d8ee38b098a

Download Submit
C:\Users\Admin\AppData\Local\Temp\6fe742dd-8605-406c-8cc0-3ad2760b8467.vbs

Filesize
710B

MD5
e94548f9336c3c07b02dd9584c7a6bb3

SHA1
ece7e918db3bd640b7d7714fb6c35187e09ad686

SHA256
25b93635400117c2392797f2667c3db5028c70c998f1dbe41247fb45f43fd0f8

SHA512
c5da44581f32e58187494701d1f30c7c50ad2c5d4b6602bd753e5a6fc097c5ebdd6370b8e0a99a5ec713889127fdef1a8334cde0e14c766aec60b5badb1cc076

Download Submit
C:\Users\Admin\AppData\Local\Temp\70b1156a-c299-40f6-82b7-56b71647bfe9.vbs

Filesize
711B

MD5
26b67a07389df68f5b40fb9d3f1ceb23

SHA1
6045de88b1e3d529d55fd8ec7299d6491df00b28

SHA256
72e61426ae2c05ae9f82747ebb17efae9004a97e1f321fa056c3660e06dfd576

SHA512
8f58047d3338e82ca97604ccd1c741499a8e05ed9b1dec8bacd43b11dfd84229334dad56757e6572652e2d172ba65ddd491dab82b1aead8ab474db990e222d9c

Download Submit
C:\Users\Admin\AppData\Local\Temp\756d57ac-e52d-459a-862a-45f4f0c15594.vbs

Filesize
487B

MD5
cec6aabeb88f05bc5607f1b7d1545073

SHA1
5fa27e41eb3486165ac374f78e20e2f27f5a349a

SHA256
ba74caed4b1cd48d3b040aa9440a7e7a00d4f06730bdc4dcce455944d64c813e

SHA512
07e0c4ca9263e36288b378fd730679172d658ce1390fbe7d02f67196a5761aee7ecbfe1b0d77f0c08a8de0c670cfb067801dd8035a76973e74cfd199fdd1f281

Download Submit
C:\Users\Admin\AppData\Local\Temp\79eb34b4-ab23-4ef2-a493-69c58f826630.vbs

Filesize
711B

MD5
ab5d1c6c3dfb86dda97104e25d98896a

SHA1
433f482861cfca65ec35d58fec1ad79ccd8382ea

SHA256
dfa1bf56a26e2791fe6a43ca4210be40d9ac1b61d9748ac726e3ec95ee8110be

SHA512
5343a260397079a883bdabeeb3650aae7a9d2fd61091895a92641a1619c2bca4f1a91ca9808c97475b19d51498f52cd003fa9182ff2ba33d317ea642e5478354

Download Submit
C:\Users\Admin\AppData\Local\Temp\b91cc0af-9483-4f32-a4db-11ce4ad73123.vbs

Filesize
711B

MD5
d65986821498744e7b808911189f6503

SHA1
2403eafdf6f8f68054ecddfcd222747cfb4bc1e7

SHA256
e6e38f4e093906cf3b66d13e7c7b1f72833088e89b494bfa0efd164dfa7ae794

SHA512
faa6f6aa4bdca0e425434356c6fcc3ac1a1d8926fcc7feccc393e45f498fd65768ea25440d88f837889d168b3cc87756f71514a57d6c6b59d2ee4475d6884f48

Download Submit
C:\Users\Admin\AppData\Local\Temp\c228f233-a315-4426-b4f6-d074557d9f86.vbs

Filesize
711B

MD5
e84be684a6475cf8dabb1322cd618e19

SHA1
bf82cfd6c2f25177c44e06a66784b47ec3da15a2

SHA256
82788d7ccb81538cf98230ad2d957792ddc6d1205c7a210c771b19e4419bce78

SHA512
08bf85522cf788071565fbf09ba450729d897eebe378406345ad7d3ea8e361ba85848dde9edebfe3f6bd2e3358f59b77cbde765b30cf0da4f440e8ba9c2af46b

Download Submit
C:\Users\Admin\AppData\Local\Temp\d386238e-4eda-4008-a61e-a763c466a077.vbs

Filesize
711B

MD5
926208dd8b260302e3601423a43f527f

SHA1
4e0a9bcd3500d82fc7fae82f8c9fb38341126413

SHA256
3150c109cf73960ea17668d77c354e0b6e27814bdfe98cbb3a8b8db0a98a89ff

SHA512
bdbaebb4ede79a35d8f2d5867b115b179397e847fab3a3c19fdbb2fa0a25bd78d12c03dd9c4f0a555b8db8aabd08396e35187c8fb98758b2072e45f066f7c20b

Download Submit
C:\Users\Admin\AppData\Local\Temp\e7c562ee-eb29-4099-aa51-ec50ed884972.vbs

Filesize
711B

MD5
f8ad3593963b5176610f2c62aca36c1b

SHA1
924c600f1bae2ca4c15bd3d52cc69ad0b13547e9

SHA256
2bbfb37faab43ed21df3ac1bf03ae481b27e3c9778ae7ca9bb7a1fdf2de38730

SHA512
a515e24c8ac173a62ba3adf3ca66e352b399234f2d44fa24043474322cc3d855cdb2cf1593087bfadf0fff08fba25a5dd196271f1d7ee8569582b02a8d218f03

Download Submit
C:\Users\Admin\AppData\Local\Temp\f2b9e98b-0d1c-406d-a962-a4a2ba16daa5.vbs

Filesize
711B

MD5
6dcc682cd95637c70a736db5be57db86

SHA1
e45dcc0b350beead271795027980b3d8e09b1fec

SHA256
6c6aefd886becd6e4e00db11ef34a693818b877fc2c0f9c110952238db18335c

SHA512
70537a9c8bc4f71ff6f6ea6759c04300bc8d5d26eea2f8106396d0d71986365dcb9f049eb2fc0e7393d07f18bbcbe72251401ae4cb09f82a4ba1e16288263fcd

Download Submit
C:\Windows\Web\4K\RCX8B2F.tmp

Filesize
885KB

MD5
aa1341cf8caf369b29626a9502ce5d1b

SHA1
61c96e2aef2b9966cf780fcb6d1f8275e3a47be5

SHA256
d623fba815c6a9da4c54daf98b944e442242151003235128e745334fef75343f

SHA512
2302dc2f1574fb8f426da80fb307e4887011191f3dcb5da58ec2578d01994cf093b96d07fee0409bb4f88a2ab33904c798634b232a1243386081cb025b3cd2c1

Download Submit
memory/3776-551-0x000000001C1E0000-0x000000001C2E2000-memory.dmp

Filesize
1.0MB

Download
memory/3952-482-0x000000001BEB0000-0x000000001BFB2000-memory.dmp

Filesize
1.0MB

Download
memory/4820-4-0x000000001BE90000-0x000000001BEE0000-memory.dmp

Filesize
320KB

Download
memory/4820-2-0x00007FFB58C60000-0x00007FFB59721000-memory.dmp

Filesize
10.8MB

Download
memory/4820-262-0x00007FFB58C60000-0x00007FFB59721000-memory.dmp

Filesize
10.8MB

Download
memory/4820-3-0x0000000001470000-0x000000000148C000-memory.dmp

Filesize
112KB

Download
memory/4820-0-0x00007FFB58C63000-0x00007FFB58C65000-memory.dmp

Filesize
8KB

Download
memory/4820-6-0x0000000002DF0000-0x0000000002E06000-memory.dmp

Filesize
88KB

Download
memory/4820-10-0x0000000002E40000-0x0000000002E4C000-memory.dmp

Filesize
48KB

Download
memory/4820-5-0x00000000014A0000-0x00000000014B0000-memory.dmp

Filesize
64KB

Download
memory/4820-9-0x0000000002E30000-0x0000000002E38000-memory.dmp

Filesize
32KB

Download
memory/4820-1-0x0000000000BB0000-0x0000000000C94000-memory.dmp

Filesize
912KB

Download
memory/4820-7-0x0000000002E10000-0x0000000002E1A000-memory.dmp

Filesize
40KB

Download
memory/4820-8-0x0000000002E20000-0x0000000002E2E000-memory.dmp

Filesize
56KB

Download
memory/4880-539-0x000000001C090000-0x000000001C192000-memory.dmp

Filesize
1.0MB

Download
memory/4960-527-0x000000001B8C0000-0x000000001B9C2000-memory.dmp

Filesize
1.0MB

Download