dcrat | ce63ae9069832ff3b0f2eb76b384c40cd8b70987280d4cc07559493a2b5c04ff

Analysis

max time kernel
150s
max time network
152s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22/03/2025, 06:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4e248cce2fb9b5f155ca62d21c6e9da7.exe
Size

1.6MB
MD5

4e248cce2fb9b5f155ca62d21c6e9da7
SHA1

c5eab96ba2a3310bcb3cef05918a38efe5cfad86
SHA256

74c882cb1bc2e8f293c67a7c9a2bcc0c37e0aafa6fd173b1990b5ba667befe86
SHA512

958763f40b1371177b4cffa09701a600948f3126e6ac4d041a08e11f903f51f3beccd7a9ad9cd9b20cbc443310af573ac2fbb396c21f8d61fb05324553c0bb23
SSDEEP

24576:Ksm8JijftfWIqZpyh/X6bSmV2GKz1oncoiF9GFwUvpHk3tSfEybcswrJ4gOEGEk:KD8Jijt+xpS/ekYmLGdhEAf7bCcjE

Score

10^/10

dcrat execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 36 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2636	2980	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2528	2980	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2572	2980	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2984	2980	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2324	2980	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1680	2980	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	572	2980	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	856	2980	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1632	2980	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2584	2980	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2816	2980	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2840	2980	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1720	2980	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1204	2980	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2012	2980	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1700	2980	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1672	2980	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2360	2980	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2000	2980	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1820	2980	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1864	2980	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2468	2980	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2464	2980	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1628	2980	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1088	2980	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2700	2980	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2832	2980	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3020	2980	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3000	2980	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2432	2980	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2180	2980	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2112	2980	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	376	2980	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2888	2980	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1216	2980	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	444	2980	schtasks.exe	30

DCRat payload 11 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral31/memory/2668-1-0x00000000010D0000-0x0000000001272000-memory.dmp	dcrat
behavioral31/files/0x000500000001922c-25.dat	dcrat
behavioral31/files/0x0007000000019284-78.dat	dcrat
behavioral31/files/0x0008000000019263-145.dat	dcrat
behavioral31/files/0x0009000000019353-177.dat	dcrat
behavioral31/memory/2244-258-0x0000000001160000-0x0000000001302000-memory.dmp	dcrat
behavioral31/memory/2104-302-0x00000000003D0000-0x0000000000572000-memory.dmp	dcrat
behavioral31/memory/2172-314-0x0000000000820000-0x00000000009C2000-memory.dmp	dcrat
behavioral31/memory/1860-326-0x0000000001100000-0x00000000012A2000-memory.dmp	dcrat
behavioral31/memory/2828-349-0x00000000000F0000-0x0000000000292000-memory.dmp	dcrat
behavioral31/memory/856-361-0x00000000009D0000-0x0000000000B72000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 13 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
484	powershell.exe
776	powershell.exe
988	powershell.exe
1924	powershell.exe
2624	powershell.exe
2820	powershell.exe
2792	powershell.exe
304	powershell.exe
892	powershell.exe
1856	powershell.exe
2580	powershell.exe
2656	powershell.exe
2532	powershell.exe

Executes dropped EXE 10 IoCs

pid	Process
2244	4e248cce2fb9b5f155ca62d21c6e9da7.exe
2528	4e248cce2fb9b5f155ca62d21c6e9da7.exe
572	4e248cce2fb9b5f155ca62d21c6e9da7.exe
2476	4e248cce2fb9b5f155ca62d21c6e9da7.exe
2104	4e248cce2fb9b5f155ca62d21c6e9da7.exe
2172	4e248cce2fb9b5f155ca62d21c6e9da7.exe
1860	4e248cce2fb9b5f155ca62d21c6e9da7.exe
2004	4e248cce2fb9b5f155ca62d21c6e9da7.exe
2828	4e248cce2fb9b5f155ca62d21c6e9da7.exe
856	4e248cce2fb9b5f155ca62d21c6e9da7.exe

Drops file in Program Files directory 25 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Windows Mail\de-DE\RCX6BF7.tmp	4e248cce2fb9b5f155ca62d21c6e9da7.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\en-US\RCX70DB.tmp	4e248cce2fb9b5f155ca62d21c6e9da7.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\csrss.exe	4e248cce2fb9b5f155ca62d21c6e9da7.exe
File created	C:\Program Files\Microsoft Games\Solitaire\it-IT\spoolsv.exe	4e248cce2fb9b5f155ca62d21c6e9da7.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\de-DE\RCX6BF8.tmp	4e248cce2fb9b5f155ca62d21c6e9da7.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\de-DE\OSPPSVC.exe	4e248cce2fb9b5f155ca62d21c6e9da7.exe
File opened for modification	C:\Program Files\Microsoft Games\Solitaire\it-IT\RCX6E6A.tmp	4e248cce2fb9b5f155ca62d21c6e9da7.exe
File opened for modification	C:\Program Files\Microsoft Games\Hearts\RCX734D.tmp	4e248cce2fb9b5f155ca62d21c6e9da7.exe
File opened for modification	C:\Program Files\Microsoft Games\Hearts\audiodg.exe	4e248cce2fb9b5f155ca62d21c6e9da7.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\csrss.exe	4e248cce2fb9b5f155ca62d21c6e9da7.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\886983d96e3d3e	4e248cce2fb9b5f155ca62d21c6e9da7.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\en-US\8d2d10ed9fba80	4e248cce2fb9b5f155ca62d21c6e9da7.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RCX62FA.tmp	4e248cce2fb9b5f155ca62d21c6e9da7.exe
File opened for modification	C:\Program Files\Microsoft Games\Solitaire\it-IT\RCX6E69.tmp	4e248cce2fb9b5f155ca62d21c6e9da7.exe
File opened for modification	C:\Program Files\Microsoft Games\Solitaire\it-IT\spoolsv.exe	4e248cce2fb9b5f155ca62d21c6e9da7.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\en-US\4e248cce2fb9b5f155ca62d21c6e9da7.exe	4e248cce2fb9b5f155ca62d21c6e9da7.exe
File opened for modification	C:\Program Files\Microsoft Games\Hearts\RCX734E.tmp	4e248cce2fb9b5f155ca62d21c6e9da7.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RCX62F9.tmp	4e248cce2fb9b5f155ca62d21c6e9da7.exe
File created	C:\Program Files (x86)\Windows Mail\de-DE\OSPPSVC.exe	4e248cce2fb9b5f155ca62d21c6e9da7.exe
File created	C:\Program Files (x86)\Windows Mail\de-DE\1610b97d3ab4a7	4e248cce2fb9b5f155ca62d21c6e9da7.exe
File created	C:\Program Files\Microsoft Games\Solitaire\it-IT\f3b6ecef712a24	4e248cce2fb9b5f155ca62d21c6e9da7.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\en-US\4e248cce2fb9b5f155ca62d21c6e9da7.exe	4e248cce2fb9b5f155ca62d21c6e9da7.exe
File created	C:\Program Files\Microsoft Games\Hearts\audiodg.exe	4e248cce2fb9b5f155ca62d21c6e9da7.exe
File created	C:\Program Files\Microsoft Games\Hearts\42af1c969fbb7b	4e248cce2fb9b5f155ca62d21c6e9da7.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\en-US\RCX70DC.tmp	4e248cce2fb9b5f155ca62d21c6e9da7.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\schemas\TSWorkSpace\csrss.exe	4e248cce2fb9b5f155ca62d21c6e9da7.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.Transactions.Bridge.Dtc\smss.exe	4e248cce2fb9b5f155ca62d21c6e9da7.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.Transactions.Bridge.Dtc\69ddcba757bf72	4e248cce2fb9b5f155ca62d21c6e9da7.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.Transactions.Bridge.Dtc\RCX7551.tmp	4e248cce2fb9b5f155ca62d21c6e9da7.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.Transactions.Bridge.Dtc\RCX75C0.tmp	4e248cce2fb9b5f155ca62d21c6e9da7.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.Transactions.Bridge.Dtc\smss.exe	4e248cce2fb9b5f155ca62d21c6e9da7.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 36 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2636	schtasks.exe
2528	schtasks.exe
2572	schtasks.exe
1680	schtasks.exe
2012	schtasks.exe
1820	schtasks.exe
2464	schtasks.exe
1088	schtasks.exe
2360	schtasks.exe
2000	schtasks.exe
2468	schtasks.exe
1628	schtasks.exe
2432	schtasks.exe
2180	schtasks.exe
2112	schtasks.exe
444	schtasks.exe
376	schtasks.exe
2984	schtasks.exe
1632	schtasks.exe
2840	schtasks.exe
1216	schtasks.exe
2324	schtasks.exe
1204	schtasks.exe
2888	schtasks.exe
856	schtasks.exe
2816	schtasks.exe
1864	schtasks.exe
2700	schtasks.exe
2832	schtasks.exe
3000	schtasks.exe
572	schtasks.exe
2584	schtasks.exe
1720	schtasks.exe
1700	schtasks.exe
3020	schtasks.exe
1672	schtasks.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
2668	4e248cce2fb9b5f155ca62d21c6e9da7.exe
2668	4e248cce2fb9b5f155ca62d21c6e9da7.exe
2668	4e248cce2fb9b5f155ca62d21c6e9da7.exe
2656	powershell.exe
1924	powershell.exe
484	powershell.exe
776	powershell.exe
2820	powershell.exe
2532	powershell.exe
2624	powershell.exe
988	powershell.exe
1856	powershell.exe
304	powershell.exe
892	powershell.exe
2580	powershell.exe
2792	powershell.exe
2244	4e248cce2fb9b5f155ca62d21c6e9da7.exe
2528	4e248cce2fb9b5f155ca62d21c6e9da7.exe
572	4e248cce2fb9b5f155ca62d21c6e9da7.exe
2476	4e248cce2fb9b5f155ca62d21c6e9da7.exe
2104	4e248cce2fb9b5f155ca62d21c6e9da7.exe
2172	4e248cce2fb9b5f155ca62d21c6e9da7.exe
1860	4e248cce2fb9b5f155ca62d21c6e9da7.exe
2004	4e248cce2fb9b5f155ca62d21c6e9da7.exe
2828	4e248cce2fb9b5f155ca62d21c6e9da7.exe
856	4e248cce2fb9b5f155ca62d21c6e9da7.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeDebugPrivilege	2668	4e248cce2fb9b5f155ca62d21c6e9da7.exe
Token: SeDebugPrivilege	2656	powershell.exe
Token: SeDebugPrivilege	1924	powershell.exe
Token: SeDebugPrivilege	484	powershell.exe
Token: SeDebugPrivilege	776	powershell.exe
Token: SeDebugPrivilege	2820	powershell.exe
Token: SeDebugPrivilege	2532	powershell.exe
Token: SeDebugPrivilege	2624	powershell.exe
Token: SeDebugPrivilege	988	powershell.exe
Token: SeDebugPrivilege	1856	powershell.exe
Token: SeDebugPrivilege	304	powershell.exe
Token: SeDebugPrivilege	892	powershell.exe
Token: SeDebugPrivilege	2580	powershell.exe
Token: SeDebugPrivilege	2792	powershell.exe
Token: SeDebugPrivilege	2244	4e248cce2fb9b5f155ca62d21c6e9da7.exe
Token: SeDebugPrivilege	2528	4e248cce2fb9b5f155ca62d21c6e9da7.exe
Token: SeDebugPrivilege	572	4e248cce2fb9b5f155ca62d21c6e9da7.exe
Token: SeDebugPrivilege	2476	4e248cce2fb9b5f155ca62d21c6e9da7.exe
Token: SeDebugPrivilege	2104	4e248cce2fb9b5f155ca62d21c6e9da7.exe
Token: SeDebugPrivilege	2172	4e248cce2fb9b5f155ca62d21c6e9da7.exe
Token: SeDebugPrivilege	1860	4e248cce2fb9b5f155ca62d21c6e9da7.exe
Token: SeDebugPrivilege	2004	4e248cce2fb9b5f155ca62d21c6e9da7.exe
Token: SeDebugPrivilege	2828	4e248cce2fb9b5f155ca62d21c6e9da7.exe
Token: SeDebugPrivilege	856	4e248cce2fb9b5f155ca62d21c6e9da7.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2668 wrote to memory of 304	2668	4e248cce2fb9b5f155ca62d21c6e9da7.exe	67
PID 2668 wrote to memory of 304	2668	4e248cce2fb9b5f155ca62d21c6e9da7.exe	67
PID 2668 wrote to memory of 304	2668	4e248cce2fb9b5f155ca62d21c6e9da7.exe	67
PID 2668 wrote to memory of 484	2668	4e248cce2fb9b5f155ca62d21c6e9da7.exe	68
PID 2668 wrote to memory of 484	2668	4e248cce2fb9b5f155ca62d21c6e9da7.exe	68
PID 2668 wrote to memory of 484	2668	4e248cce2fb9b5f155ca62d21c6e9da7.exe	68
PID 2668 wrote to memory of 776	2668	4e248cce2fb9b5f155ca62d21c6e9da7.exe	69
PID 2668 wrote to memory of 776	2668	4e248cce2fb9b5f155ca62d21c6e9da7.exe	69
PID 2668 wrote to memory of 776	2668	4e248cce2fb9b5f155ca62d21c6e9da7.exe	69
PID 2668 wrote to memory of 988	2668	4e248cce2fb9b5f155ca62d21c6e9da7.exe	70
PID 2668 wrote to memory of 988	2668	4e248cce2fb9b5f155ca62d21c6e9da7.exe	70
PID 2668 wrote to memory of 988	2668	4e248cce2fb9b5f155ca62d21c6e9da7.exe	70
PID 2668 wrote to memory of 892	2668	4e248cce2fb9b5f155ca62d21c6e9da7.exe	71
PID 2668 wrote to memory of 892	2668	4e248cce2fb9b5f155ca62d21c6e9da7.exe	71
PID 2668 wrote to memory of 892	2668	4e248cce2fb9b5f155ca62d21c6e9da7.exe	71
PID 2668 wrote to memory of 1924	2668	4e248cce2fb9b5f155ca62d21c6e9da7.exe	72
PID 2668 wrote to memory of 1924	2668	4e248cce2fb9b5f155ca62d21c6e9da7.exe	72
PID 2668 wrote to memory of 1924	2668	4e248cce2fb9b5f155ca62d21c6e9da7.exe	72
PID 2668 wrote to memory of 1856	2668	4e248cce2fb9b5f155ca62d21c6e9da7.exe	73
PID 2668 wrote to memory of 1856	2668	4e248cce2fb9b5f155ca62d21c6e9da7.exe	73
PID 2668 wrote to memory of 1856	2668	4e248cce2fb9b5f155ca62d21c6e9da7.exe	73
PID 2668 wrote to memory of 2624	2668	4e248cce2fb9b5f155ca62d21c6e9da7.exe	74
PID 2668 wrote to memory of 2624	2668	4e248cce2fb9b5f155ca62d21c6e9da7.exe	74
PID 2668 wrote to memory of 2624	2668	4e248cce2fb9b5f155ca62d21c6e9da7.exe	74
PID 2668 wrote to memory of 2580	2668	4e248cce2fb9b5f155ca62d21c6e9da7.exe	75
PID 2668 wrote to memory of 2580	2668	4e248cce2fb9b5f155ca62d21c6e9da7.exe	75
PID 2668 wrote to memory of 2580	2668	4e248cce2fb9b5f155ca62d21c6e9da7.exe	75
PID 2668 wrote to memory of 2820	2668	4e248cce2fb9b5f155ca62d21c6e9da7.exe	76
PID 2668 wrote to memory of 2820	2668	4e248cce2fb9b5f155ca62d21c6e9da7.exe	76
PID 2668 wrote to memory of 2820	2668	4e248cce2fb9b5f155ca62d21c6e9da7.exe	76
PID 2668 wrote to memory of 2656	2668	4e248cce2fb9b5f155ca62d21c6e9da7.exe	77
PID 2668 wrote to memory of 2656	2668	4e248cce2fb9b5f155ca62d21c6e9da7.exe	77
PID 2668 wrote to memory of 2656	2668	4e248cce2fb9b5f155ca62d21c6e9da7.exe	77
PID 2668 wrote to memory of 2532	2668	4e248cce2fb9b5f155ca62d21c6e9da7.exe	78
PID 2668 wrote to memory of 2532	2668	4e248cce2fb9b5f155ca62d21c6e9da7.exe	78
PID 2668 wrote to memory of 2532	2668	4e248cce2fb9b5f155ca62d21c6e9da7.exe	78
PID 2668 wrote to memory of 2792	2668	4e248cce2fb9b5f155ca62d21c6e9da7.exe	79
PID 2668 wrote to memory of 2792	2668	4e248cce2fb9b5f155ca62d21c6e9da7.exe	79
PID 2668 wrote to memory of 2792	2668	4e248cce2fb9b5f155ca62d21c6e9da7.exe	79
PID 2668 wrote to memory of 2380	2668	4e248cce2fb9b5f155ca62d21c6e9da7.exe	93
PID 2668 wrote to memory of 2380	2668	4e248cce2fb9b5f155ca62d21c6e9da7.exe	93
PID 2668 wrote to memory of 2380	2668	4e248cce2fb9b5f155ca62d21c6e9da7.exe	93
PID 2380 wrote to memory of 1756	2380	cmd.exe	95
PID 2380 wrote to memory of 1756	2380	cmd.exe	95
PID 2380 wrote to memory of 1756	2380	cmd.exe	95
PID 2380 wrote to memory of 2244	2380	cmd.exe	96
PID 2380 wrote to memory of 2244	2380	cmd.exe	96
PID 2380 wrote to memory of 2244	2380	cmd.exe	96
PID 2244 wrote to memory of 2684	2244	4e248cce2fb9b5f155ca62d21c6e9da7.exe	97
PID 2244 wrote to memory of 2684	2244	4e248cce2fb9b5f155ca62d21c6e9da7.exe	97
PID 2244 wrote to memory of 2684	2244	4e248cce2fb9b5f155ca62d21c6e9da7.exe	97
PID 2244 wrote to memory of 2452	2244	4e248cce2fb9b5f155ca62d21c6e9da7.exe	98
PID 2244 wrote to memory of 2452	2244	4e248cce2fb9b5f155ca62d21c6e9da7.exe	98
PID 2244 wrote to memory of 2452	2244	4e248cce2fb9b5f155ca62d21c6e9da7.exe	98
PID 2684 wrote to memory of 2528	2684	WScript.exe	99
PID 2684 wrote to memory of 2528	2684	WScript.exe	99
PID 2684 wrote to memory of 2528	2684	WScript.exe	99
PID 2528 wrote to memory of 1636	2528	4e248cce2fb9b5f155ca62d21c6e9da7.exe	101
PID 2528 wrote to memory of 1636	2528	4e248cce2fb9b5f155ca62d21c6e9da7.exe	101
PID 2528 wrote to memory of 1636	2528	4e248cce2fb9b5f155ca62d21c6e9da7.exe	101
PID 2528 wrote to memory of 1920	2528	4e248cce2fb9b5f155ca62d21c6e9da7.exe	102
PID 2528 wrote to memory of 1920	2528	4e248cce2fb9b5f155ca62d21c6e9da7.exe	102
PID 2528 wrote to memory of 1920	2528	4e248cce2fb9b5f155ca62d21c6e9da7.exe	102
PID 1636 wrote to memory of 572	1636	WScript.exe	103

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\4e248cce2fb9b5f155ca62d21c6e9da7.exe
"C:\Users\Admin\AppData\Local\Temp\4e248cce2fb9b5f155ca62d21c6e9da7.exe"
1⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2668
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\4e248cce2fb9b5f155ca62d21c6e9da7.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:304
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\csrss.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:484
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\AppData\Roaming\smss.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:776
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\csrss.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:988
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\OSPPSVC.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:892
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Mail\de-DE\OSPPSVC.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1924
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Microsoft Games\Solitaire\it-IT\spoolsv.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1856
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Photo Viewer\en-US\4e248cce2fb9b5f155ca62d21c6e9da7.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2624
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Microsoft Games\Hearts\audiodg.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2580
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.Transactions.Bridge.Dtc\smss.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2820
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\dllhost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2656
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\winlogon.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2532
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\sppsvc.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2792
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\mto9DLwMv4.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2380
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:1756
- - C:\Program Files (x86)\Windows Photo Viewer\en-US\4e248cce2fb9b5f155ca62d21c6e9da7.exe
    "C:\Program Files (x86)\Windows Photo Viewer\en-US\4e248cce2fb9b5f155ca62d21c6e9da7.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2244
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\eaae96bf-57c9-4729-b0ae-02462f5eee30.vbs"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2684
    - - C:\Program Files (x86)\Windows Photo Viewer\en-US\4e248cce2fb9b5f155ca62d21c6e9da7.exe
        
        "C:\Program Files (x86)\Windows Photo Viewer\en-US\4e248cce2fb9b5f155ca62d21c6e9da7.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2528
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9fbc233f-3836-45c8-9263-55de77442e22.vbs"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1636
        
        C:\Program Files (x86)\Windows Photo Viewer\en-US\4e248cce2fb9b5f155ca62d21c6e9da7.exe
        
        "C:\Program Files (x86)\Windows Photo Viewer\en-US\4e248cce2fb9b5f155ca62d21c6e9da7.exe"
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:572
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4237ce29-a420-4c95-9ff6-3e21ebc3212c.vbs"
        8⤵
        
        PID:2116
        
        C:\Program Files (x86)\Windows Photo Viewer\en-US\4e248cce2fb9b5f155ca62d21c6e9da7.exe
        
        "C:\Program Files (x86)\Windows Photo Viewer\en-US\4e248cce2fb9b5f155ca62d21c6e9da7.exe"
        9⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2476
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f89dae86-bf43-4175-b00a-152f4a493565.vbs"
        10⤵
        
        PID:1708
        
        C:\Program Files (x86)\Windows Photo Viewer\en-US\4e248cce2fb9b5f155ca62d21c6e9da7.exe
        
        "C:\Program Files (x86)\Windows Photo Viewer\en-US\4e248cce2fb9b5f155ca62d21c6e9da7.exe"
        11⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2104
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\97e87b94-d6bd-4fef-8a08-148b1c0d39ed.vbs"
        12⤵
        
        PID:2280
        
        C:\Program Files (x86)\Windows Photo Viewer\en-US\4e248cce2fb9b5f155ca62d21c6e9da7.exe
        
        "C:\Program Files (x86)\Windows Photo Viewer\en-US\4e248cce2fb9b5f155ca62d21c6e9da7.exe"
        13⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2172
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\836e652d-e808-408a-9dc1-b337fa44b98e.vbs"
        14⤵
        
        PID:2020
        
        C:\Program Files (x86)\Windows Photo Viewer\en-US\4e248cce2fb9b5f155ca62d21c6e9da7.exe
        
        "C:\Program Files (x86)\Windows Photo Viewer\en-US\4e248cce2fb9b5f155ca62d21c6e9da7.exe"
        15⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1860
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5337e518-80d2-43c8-99fb-461ade211a4a.vbs"
        16⤵
        
        PID:1804
        
        C:\Program Files (x86)\Windows Photo Viewer\en-US\4e248cce2fb9b5f155ca62d21c6e9da7.exe
        
        "C:\Program Files (x86)\Windows Photo Viewer\en-US\4e248cce2fb9b5f155ca62d21c6e9da7.exe"
        17⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2004
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a795375d-fa25-4c91-a530-2eb0c6f0ef02.vbs"
        18⤵
        
        PID:2228
        
        C:\Program Files (x86)\Windows Photo Viewer\en-US\4e248cce2fb9b5f155ca62d21c6e9da7.exe
        
        "C:\Program Files (x86)\Windows Photo Viewer\en-US\4e248cce2fb9b5f155ca62d21c6e9da7.exe"
        19⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2828
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ce0c98e2-8144-4814-99e0-ebd0fe0567f2.vbs"
        20⤵
        
        PID:2796
        
        C:\Program Files (x86)\Windows Photo Viewer\en-US\4e248cce2fb9b5f155ca62d21c6e9da7.exe
        
        "C:\Program Files (x86)\Windows Photo Viewer\en-US\4e248cce2fb9b5f155ca62d21c6e9da7.exe"
        21⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:856
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\64748840-1031-41f3-bfc1-7e2ddc2f1037.vbs"
        22⤵
        
        PID:940
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\02d2492a-15f8-438b-b111-b5316da805e1.vbs"
        22⤵
        
        PID:1672
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\968c17f1-e000-4943-a9e2-16d9c1f61395.vbs"
        20⤵
        
        PID:2560
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0466a76d-93f9-44f5-9fef-2c5b7388ff52.vbs"
        18⤵
        
        PID:352
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f5de3023-bbfa-4266-8d36-e3206f40a430.vbs"
        16⤵
        
        PID:2656
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\792c0fdb-22a7-4ef2-baee-42dad343b853.vbs"
        14⤵
        
        PID:2680
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\da1e9675-6744-4d15-9e8c-4f1860d069e5.vbs"
        12⤵
        
        PID:308
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b8ed7ea9-b6cc-4130-b142-894284965d5d.vbs"
        10⤵
        
        PID:884
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\99ef4ddb-bef8-47aa-96d7-361c97b12023.vbs"
        8⤵
        
        PID:1084
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e8dc9ce6-e5d1-4da3-b0e7-6bd1f5ffc8cd.vbs"
        6⤵
        
        PID:1920
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c83f1582-e5e6-4e91-a1e3-44f4250cf12b.vbs"
      4⤵
      PID:2452

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 8 /tr "'C:\Users\Default\AppData\Roaming\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Users\Default\AppData\Roaming\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\Users\Default\AppData\Roaming\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 5 /tr "'C:\Users\Default User\OSPPSVC.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Users\Default User\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 7 /tr "'C:\Users\Default User\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Mail\de-DE\OSPPSVC.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\de-DE\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1204

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Mail\de-DE\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 13 /tr "'C:\Program Files\Microsoft Games\Solitaire\it-IT\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files\Microsoft Games\Solitaire\it-IT\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 7 /tr "'C:\Program Files\Microsoft Games\Solitaire\it-IT\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "4e248cce2fb9b5f155ca62d21c6e9da74" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Photo Viewer\en-US\4e248cce2fb9b5f155ca62d21c6e9da7.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "4e248cce2fb9b5f155ca62d21c6e9da7" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\en-US\4e248cce2fb9b5f155ca62d21c6e9da7.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "4e248cce2fb9b5f155ca62d21c6e9da74" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Photo Viewer\en-US\4e248cce2fb9b5f155ca62d21c6e9da7.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 5 /tr "'C:\Program Files\Microsoft Games\Hearts\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Program Files\Microsoft Games\Hearts\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 13 /tr "'C:\Program Files\Microsoft Games\Hearts\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.Transactions.Bridge.Dtc\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.Transactions.Bridge.Dtc\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 5 /tr "'C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.Transactions.Bridge.Dtc\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Users\Default User\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Default User\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Users\Default User\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2180

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Users\Admin\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Windows Mail\de-DE\OSPPSVC.exe

Filesize
1.6MB

MD5
4e248cce2fb9b5f155ca62d21c6e9da7

SHA1
c5eab96ba2a3310bcb3cef05918a38efe5cfad86

SHA256
74c882cb1bc2e8f293c67a7c9a2bcc0c37e0aafa6fd173b1990b5ba667befe86

SHA512
958763f40b1371177b4cffa09701a600948f3126e6ac4d041a08e11f903f51f3beccd7a9ad9cd9b20cbc443310af573ac2fbb396c21f8d61fb05324553c0bb23

Download Submit
C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\csrss.exe

Filesize
1.6MB

MD5
d7c9ecc29c7899b2607c51b1d26ef5e7

SHA1
a7863926600f1c92c652b91d4476236258393ed5

SHA256
aeecffc3654352020e44e9de217146d0316a7733535a8c73212762939828cc31

SHA512
64b4cd8534b83b49696324ed004e66facfc10ea8dacf69a9a353609f3837f25478cda2895497519f173b540ece9190d7ddccf4e5214718603275444388675537

Download Submit
C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\sppsvc.exe

Filesize
1.6MB

MD5
82d2c69302d6f7f36637cf2d1baeb411

SHA1
4c7df0727f30bcb8e93575ae86dd4e912b7f83ba

SHA256
0f151d48a0632fbe18e36f9d163051ce731415a5ba792f92ffbf9ae6d91607e9

SHA512
f28a16d07cc6988d674161c39bf5e18df3cc2be15b93f63b8cfb896431c79f11896f78baf484eb60212384ecb2a2502d57d8129da86da54348bb99b8f34ea2eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\4237ce29-a420-4c95-9ff6-3e21ebc3212c.vbs

Filesize
761B

MD5
7673007ed53f1f38d93975636a8a8527

SHA1
238a34970ac06234b4ec77c6f0fc60ae27a429e2

SHA256
aceb97c8968eea93d07f85f857b5e71aac78f8e3de2c0e036d2632847aa550dd

SHA512
a023036e3d94dc0d2c9dda3412b9c9258549ff121ba37d458de4d6d667a6be1780aba9a49404852120a2613b8e05c1679e57e27e80fab0e61a04dbfe4eab48b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\5337e518-80d2-43c8-99fb-461ade211a4a.vbs

Filesize
762B

MD5
1471ed458317d3c23bde3d0f34052750

SHA1
c6eb96ce822fa4d7a168c72d20283294647be325

SHA256
1016db4ce2efff3055be8142f7a7eb4b3788cd05cc6ba077d4000016f9ad7d44

SHA512
c90c262139548472fda03df05620881cf733def0d1ddcaf95cf1eee6e64a64a6cac6040f8ed4f0efd15f72c64a9e73f744fe3294dc10e6fbd62acff0bb9a1d38

Download Submit
C:\Users\Admin\AppData\Local\Temp\64748840-1031-41f3-bfc1-7e2ddc2f1037.vbs

Filesize
761B

MD5
ff4c20d7fc12cabfc5e94edffb89f529

SHA1
175af326ff660fc9cbec61e479c9dd495ca078de

SHA256
343601605768ae2ed77fa7ac402827e0b45b9fc71b707be2bc6584588c94113b

SHA512
e805029724ecbecace26c5a45c7de97dec5775e4c10a0263cee5310acc202e9958b0a75e3712acfb6af9d4d31a0604e70269599a36d56831722efee8015dcb0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\836e652d-e808-408a-9dc1-b337fa44b98e.vbs

Filesize
762B

MD5
c88ee039f277f8623bc8401617a2c711

SHA1
a1a04be94c96bd96e85eabad5226e99dcd73fece

SHA256
d150d63c30dd9c5769ecee16deb426d2fea4a5dd5e506f2259ab657ba87fbe07

SHA512
2571b0b7aa5e1da977d0480deb57003cd9ab8a748c5e02469ea4203fb1e8666504eae9ad28e8158716b16fa62aeafd3c24d94d1da6ae7f29338ada3927c62c02

Download Submit
C:\Users\Admin\AppData\Local\Temp\97e87b94-d6bd-4fef-8a08-148b1c0d39ed.vbs

Filesize
762B

MD5
6d6bcbb14d5a8206251cfacf61a0bd5b

SHA1
679f0eb6020c2dac32048148741816f01edf6bea

SHA256
981369d42c8231d91676b6aa62e7c9e26d07dd1ed04eb56e6e11c9aff6e8f09b

SHA512
87bc8b1966462a0e0407e6f86d5452a62999607a06fd77963c6f58720066efe933bce2b11143e7c1a430c4b7a406f61b3d953646810d49df8373f19180356217

Download Submit
C:\Users\Admin\AppData\Local\Temp\9fbc233f-3836-45c8-9263-55de77442e22.vbs

Filesize
762B

MD5
2f9fe89568c5614ae723f63202def088

SHA1
23c89399af026cf6bf0d6c7118c3b792590db651

SHA256
19611582c96dcf2b84b4c8b7efa5250dd9ffce3da54e49bf0ed1810777178635

SHA512
a609aad3e6edf48238d988b5f911a79ce3cf7627d13d06dd1e873138c0fa8b983ebb5c54d87c238719be05aa98bea92283546c3f11bd114019694cc2853650a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\a795375d-fa25-4c91-a530-2eb0c6f0ef02.vbs

Filesize
762B

MD5
0126113d80de493fdf01359563066547

SHA1
bb135d94b14372517b48da13081b2770c3aaa4e9

SHA256
557b0355b7e94b54e36e7ae3d0a1f82972e7154a9f01a98deb8c9f37d9a2b48d

SHA512
6e271c11b19c7bef3ec42baf7b0dae30a190b09c06c3ea36a77dd5c9e9e86cf106eb59471eac36fc6b871a1ac65e66db90a0be0d1dc148717196f489582a6ec3

Download Submit
C:\Users\Admin\AppData\Local\Temp\c83f1582-e5e6-4e91-a1e3-44f4250cf12b.vbs

Filesize
538B

MD5
2b63d43c0edbc7aefd84212d4b98ca1d

SHA1
ff1cb3dc92f6593309359d887a5370c68d608152

SHA256
d257b619e50975f6350dd2cfc541a710b7992d3e79a3f0f087532f8a9fec4dae

SHA512
d21bdd0274d0325f6576b8611ee6a474efaced1bb28d1f77385976c9cc4990f6f6eac1d4f2832eb0959471a2b8e92d4cc4fb589839afb538542bfd16df26b42c

Download Submit
C:\Users\Admin\AppData\Local\Temp\ce0c98e2-8144-4814-99e0-ebd0fe0567f2.vbs

Filesize
762B

MD5
0160bcfe74ddfc2621ce3c917bc9fede

SHA1
b9787dc4f0749c6772de900605405279b3bc4879

SHA256
b0c443395ff8d162eaa2d129e60da0c8db90e57bb9d97049da9d6f4f633e5c94

SHA512
7ea7f28b14f55f8364d2f32f9b2842d06e7cafa0305307654bbece3b40f032a3308d35668e8293b7cd23aed3a0d0b978e0cd1d90ac538c73fb3ce1f4987e5af3

Download Submit
C:\Users\Admin\AppData\Local\Temp\eaae96bf-57c9-4729-b0ae-02462f5eee30.vbs

Filesize
762B

MD5
4a2603267a588c7696cac84e1f47a407

SHA1
7f56e2d2d2af6f936bceec0138f21a3055aa285e

SHA256
71cedc208c288bd48590eb5e734badc8e4f9ef4b93c7826d55872bc2c36f29dd

SHA512
ddadbf98af3b42ebef5a742f773f153226c985daa504e13dd6f2fc8e08c20183236996f2fa379f61981e9f9fb138d0a1b3db36ee04b522cc8d98847a18754e4c

Download Submit
C:\Users\Admin\AppData\Local\Temp\f89dae86-bf43-4175-b00a-152f4a493565.vbs

Filesize
762B

MD5
a67556588d655473074a49082806fe0f

SHA1
a0025eb2fe281a215b88fde7b3f6376b9c11c54e

SHA256
c60eceb0d1c7c241df3a64ee149116ed18ad8eb74e0ca026687bd3ca7887055e

SHA512
d0be3910fcc5be3ad9ec1a692ecbc94584438321eb5cd9ea12259df5b1f04d01372d94fd250d54db511aa04a13ff65c71e324d190fec0b6793fdba41ee07df0e

Download Submit
C:\Users\Admin\AppData\Local\Temp\mto9DLwMv4.bat

Filesize
251B

MD5
16948cb1c376337ac2325940eafcfe2c

SHA1
ab16be9f3c06af959e6031ea75bf6b3e16dd76d0

SHA256
ebe3bf03c1d0819530a7b6bffc94c4d6db49923af27eaa330c0130884c90b0c2

SHA512
6798828b53441838357c25593c8607ad151f94f819bc391c3e44419410fe184657705a51eb0c592d2f5db6b7c7811b10443714155715319b0f25514112ed4243

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\C1JV4V8BDNYMWNTWBCXG.temp

Filesize
7KB

MD5
ecc2305d3af93fe55388c6d84baa5449

SHA1
0fdceafa349044071cabc4f6388d06bdf419bc05

SHA256
0df1d89660cdeaef127ec8ca809f5123475ff4875197849db5ad0d421bba0d59

SHA512
a297f9fd269153741cf5b479aab1cce346bd38c6a6509d4b825709266aad99f7506f2afbbecfc2dd1e7a2fa5b9b104fad4d9c0ec7ff291bb4477cecf73b6225f

Download Submit
C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.Transactions.Bridge.Dtc\smss.exe

Filesize
1.6MB

MD5
ac60174accef0bbc6e8e0f4f944cfe2d

SHA1
12cbbbfd15603485b1c29e4d29ef7cd58331a0a0

SHA256
cea6fbd92e36007d8ca719381ccb27a5ff3c3dc50779584d6b6a0fe54e402aff

SHA512
a3d729649b84cd948728e820902d1627f32f38336adfbef2be35623fbd290d9d69660cf988b01d0b3d516c7b4ee96ae7f957c9c1793bb9096617aa67fe96ad68

Download Submit
memory/856-361-0x00000000009D0000-0x0000000000B72000-memory.dmp

Filesize
1.6MB

Download
memory/1860-326-0x0000000001100000-0x00000000012A2000-memory.dmp

Filesize
1.6MB

Download
memory/2104-302-0x00000000003D0000-0x0000000000572000-memory.dmp

Filesize
1.6MB

Download
memory/2172-314-0x0000000000820000-0x00000000009C2000-memory.dmp

Filesize
1.6MB

Download
memory/2244-258-0x0000000001160000-0x0000000001302000-memory.dmp

Filesize
1.6MB

Download
memory/2656-198-0x0000000002890000-0x0000000002898000-memory.dmp

Filesize
32KB

Download
memory/2656-193-0x000000001B550000-0x000000001B832000-memory.dmp

Filesize
2.9MB

Download
memory/2668-9-0x000000001A790000-0x000000001A79C000-memory.dmp

Filesize
48KB

Download
memory/2668-0-0x000007FEF5A23000-0x000007FEF5A24000-memory.dmp

Filesize
4KB

Download
memory/2668-11-0x000000001A950000-0x000000001A95A000-memory.dmp

Filesize
40KB

Download
memory/2668-16-0x000000001A9A0000-0x000000001A9AC000-memory.dmp

Filesize
48KB

Download
memory/2668-13-0x000000001A970000-0x000000001A978000-memory.dmp

Filesize
32KB

Download
memory/2668-14-0x000000001A980000-0x000000001A988000-memory.dmp

Filesize
32KB

Download
memory/2668-12-0x000000001A960000-0x000000001A96E000-memory.dmp

Filesize
56KB

Download
memory/2668-10-0x000000001A940000-0x000000001A94C000-memory.dmp

Filesize
48KB

Download
memory/2668-15-0x000000001A990000-0x000000001A99A000-memory.dmp

Filesize
40KB

Download
memory/2668-209-0x000007FEF5A20000-0x000007FEF640C000-memory.dmp

Filesize
9.9MB

Download
memory/2668-8-0x0000000000BE0000-0x0000000000BE8000-memory.dmp

Filesize
32KB

Download
memory/2668-183-0x000007FEF5A23000-0x000007FEF5A24000-memory.dmp

Filesize
4KB

Download
memory/2668-7-0x000000001A7A0000-0x000000001A7B0000-memory.dmp

Filesize
64KB

Download
memory/2668-6-0x00000000003F0000-0x00000000003F8000-memory.dmp

Filesize
32KB

Download
memory/2668-5-0x0000000000A40000-0x0000000000A56000-memory.dmp

Filesize
88KB

Download
memory/2668-4-0x00000000003D0000-0x00000000003E0000-memory.dmp

Filesize
64KB

Download
memory/2668-1-0x00000000010D0000-0x0000000001272000-memory.dmp

Filesize
1.6MB

Download
memory/2668-3-0x0000000000A20000-0x0000000000A3C000-memory.dmp

Filesize
112KB

Download
memory/2668-2-0x000007FEF5A20000-0x000007FEF640C000-memory.dmp

Filesize
9.9MB

Download
memory/2828-349-0x00000000000F0000-0x0000000000292000-memory.dmp

Filesize
1.6MB

Download