dcrat | 01ffe9d6f323a1dafd7dbe75338596cb03cdbe970cdc964543ae03006c1ece85

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22/03/2025, 19:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1f0343adab1970d928320ce2aa587fd3.exe
Size

1.6MB
MD5

1f0343adab1970d928320ce2aa587fd3
SHA1

e9ba72eefebbc990b9d87fdc6c900ba0ab4160b8
SHA256

9543bb2076f9b8c0d465689514dfc89f7cddc872620b5158cff2e2fa270963c4
SHA512

c6ae66f4ee2e2307da2176d9ea1e8a57ee96c59a15c633d8ca618cc4c167744063fa189d03eb134e1789ad544cef426e1b6da8c61dd1785888b204f84cdc316c
SSDEEP

24576:qsm8JijftfWIqZpyh/X6bSmV2GKz1oncoiF9GFwUvpHk3tSfEybcswrJ4gOEGEk:qD8Jijt+xpS/ekYmLGdhEAf7bCcjE

Score

10^/10

dcrat execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 57 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2112	2104	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2664	2104	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2800	2104	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2692	2104	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2540	2104	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2852	2104	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2560	2104	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2440	2104	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2708	2104	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2588	2104	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2552	2104	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2608	2104	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2584	2104	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3040	2104	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2264	2104	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2324	2104	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	708	2104	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	304	2104	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1992	2104	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1592	2104	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2484	2104	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1968	2104	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1704	2104	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2316	2104	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1720	2104	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1684	2104	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1944	2104	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1812	2104	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2744	2104	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2736	2104	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1208	2104	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2880	2104	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	352	2104	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	624	2104	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	444	2104	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2776	2104	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1560	2104	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1788	2104	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	276	2104	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1660	2104	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2012	2104	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1520	2104	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2144	2104	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2764	2104	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1804	2104	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	332	2104	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2200	2104	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2100	2104	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2260	2104	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2148	2104	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	936	2104	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2432	2104	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	784	2104	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1536	2104	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2924	2104	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2436	2104	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2392	2104	schtasks.exe	30

DCRat payload 9 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral19/memory/3060-1-0x0000000000290000-0x0000000000432000-memory.dmp	dcrat
behavioral19/files/0x000500000001a44b-25.dat	dcrat
behavioral19/files/0x000800000001a377-123.dat	dcrat
behavioral19/files/0x000b00000001a4ae-160.dat	dcrat
behavioral19/files/0x000900000001a4ee-206.dat	dcrat
behavioral19/files/0x000a00000001a4fd-242.dat	dcrat
behavioral19/files/0x000800000001a4ff-251.dat	dcrat
behavioral19/files/0x000600000001a518-275.dat	dcrat
behavioral19/memory/2768-337-0x0000000000E30000-0x0000000000FD2000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 20 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1236	powershell.exe
2412	powershell.exe
1108	powershell.exe
2288	powershell.exe
2144	powershell.exe
2416	powershell.exe
2928	powershell.exe
1804	powershell.exe
444	powershell.exe
2396	powershell.exe
2520	powershell.exe
2604	powershell.exe
2152	powershell.exe
1532	powershell.exe
2400	powershell.exe
2392	powershell.exe
1564	powershell.exe
1812	powershell.exe
892	powershell.exe
1528	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
2768	csrss.exe

Drops file in Program Files directory 25 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\logs\RCXEBF3.tmp	1f0343adab1970d928320ce2aa587fd3.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\886983d96e3d3e	1f0343adab1970d928320ce2aa587fd3.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\csrss.exe	1f0343adab1970d928320ce2aa587fd3.exe
File opened for modification	C:\Program Files (x86)\Google\RCXD7E5.tmp	1f0343adab1970d928320ce2aa587fd3.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\hrtfs\dllhost.exe	1f0343adab1970d928320ce2aa587fd3.exe
File opened for modification	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\csrss.exe	1f0343adab1970d928320ce2aa587fd3.exe
File created	C:\Program Files\VideoLAN\VLC\hrtfs\dllhost.exe	1f0343adab1970d928320ce2aa587fd3.exe
File created	C:\Program Files\VideoLAN\VLC\hrtfs\5940a34987c991	1f0343adab1970d928320ce2aa587fd3.exe
File created	C:\Program Files\Windows Photo Viewer\es-ES\winlogon.exe	1f0343adab1970d928320ce2aa587fd3.exe
File created	C:\Program Files\Windows Photo Viewer\es-ES\cc11b995f2a76d	1f0343adab1970d928320ce2aa587fd3.exe
File opened for modification	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\RCXD08F.tmp	1f0343adab1970d928320ce2aa587fd3.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\logs\csrss.exe	1f0343adab1970d928320ce2aa587fd3.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\hrtfs\RCXEDF8.tmp	1f0343adab1970d928320ce2aa587fd3.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\csrss.exe	1f0343adab1970d928320ce2aa587fd3.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\886983d96e3d3e	1f0343adab1970d928320ce2aa587fd3.exe
File opened for modification	C:\Program Files (x86)\Google\RCXD777.tmp	1f0343adab1970d928320ce2aa587fd3.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\logs\RCXEBF4.tmp	1f0343adab1970d928320ce2aa587fd3.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\hrtfs\RCXEE66.tmp	1f0343adab1970d928320ce2aa587fd3.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\es-ES\RCXF2FB.tmp	1f0343adab1970d928320ce2aa587fd3.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\es-ES\RCXF2FC.tmp	1f0343adab1970d928320ce2aa587fd3.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\es-ES\winlogon.exe	1f0343adab1970d928320ce2aa587fd3.exe
File created	C:\Program Files (x86)\Google\dwm.exe	1f0343adab1970d928320ce2aa587fd3.exe
File created	C:\Program Files (x86)\Google\6cb0b6c459d5d3	1f0343adab1970d928320ce2aa587fd3.exe
File opened for modification	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\RCXD08E.tmp	1f0343adab1970d928320ce2aa587fd3.exe
File opened for modification	C:\Program Files (x86)\Google\dwm.exe	1f0343adab1970d928320ce2aa587fd3.exe

Drops file in Windows directory 26 IoCs

description	ioc	Process
File opened for modification	C:\Windows\RemotePackages\RemoteApps\RCXDC0D.tmp	1f0343adab1970d928320ce2aa587fd3.exe
File opened for modification	C:\Windows\Migration\WTR\RCXE084.tmp	1f0343adab1970d928320ce2aa587fd3.exe
File opened for modification	C:\Windows\PCHEALTH\ERRORREP\QHEADLES\RCXE568.tmp	1f0343adab1970d928320ce2aa587fd3.exe
File opened for modification	C:\Windows\PCHEALTH\ERRORREP\QHEADLES\RCXE569.tmp	1f0343adab1970d928320ce2aa587fd3.exe
File opened for modification	C:\Windows\BitLockerDiscoveryVolumeContents\RCXF06A.tmp	1f0343adab1970d928320ce2aa587fd3.exe
File created	C:\Windows\Migration\WTR\Idle.exe	1f0343adab1970d928320ce2aa587fd3.exe
File created	C:\Windows\Migration\WTR\6ccacd8608530f	1f0343adab1970d928320ce2aa587fd3.exe
File opened for modification	C:\Windows\RemotePackages\RemoteApps\RCXDC0E.tmp	1f0343adab1970d928320ce2aa587fd3.exe
File opened for modification	C:\Windows\RemotePackages\RemoteApps\smss.exe	1f0343adab1970d928320ce2aa587fd3.exe
File opened for modification	C:\Windows\AppPatch\en-US\services.exe	1f0343adab1970d928320ce2aa587fd3.exe
File opened for modification	C:\Windows\PCHEALTH\ERRORREP\QHEADLES\csrss.exe	1f0343adab1970d928320ce2aa587fd3.exe
File opened for modification	C:\Windows\BitLockerDiscoveryVolumeContents\RCXF0D8.tmp	1f0343adab1970d928320ce2aa587fd3.exe
File created	C:\Windows\AppPatch\en-US\services.exe	1f0343adab1970d928320ce2aa587fd3.exe
File created	C:\Windows\AppPatch\en-US\c5b4cb5e9653cc	1f0343adab1970d928320ce2aa587fd3.exe
File created	C:\Windows\PCHEALTH\ERRORREP\QHEADLES\csrss.exe	1f0343adab1970d928320ce2aa587fd3.exe
File created	C:\Windows\BitLockerDiscoveryVolumeContents\smss.exe	1f0343adab1970d928320ce2aa587fd3.exe
File created	C:\Windows\BitLockerDiscoveryVolumeContents\69ddcba757bf72	1f0343adab1970d928320ce2aa587fd3.exe
File opened for modification	C:\Windows\AppPatch\en-US\RCXDE12.tmp	1f0343adab1970d928320ce2aa587fd3.exe
File opened for modification	C:\Windows\Migration\WTR\Idle.exe	1f0343adab1970d928320ce2aa587fd3.exe
File opened for modification	C:\Windows\BitLockerDiscoveryVolumeContents\smss.exe	1f0343adab1970d928320ce2aa587fd3.exe
File created	C:\Windows\RemotePackages\RemoteApps\69ddcba757bf72	1f0343adab1970d928320ce2aa587fd3.exe
File created	C:\Windows\PCHEALTH\ERRORREP\QHEADLES\886983d96e3d3e	1f0343adab1970d928320ce2aa587fd3.exe
File opened for modification	C:\Windows\AppPatch\en-US\RCXDE80.tmp	1f0343adab1970d928320ce2aa587fd3.exe
File opened for modification	C:\Windows\Migration\WTR\RCXE085.tmp	1f0343adab1970d928320ce2aa587fd3.exe
File created	C:\Windows\RemotePackages\RemoteApps\smss.exe	1f0343adab1970d928320ce2aa587fd3.exe
File created	C:\Windows\CSC\v2.0.6\wininit.exe	1f0343adab1970d928320ce2aa587fd3.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 57 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2736	schtasks.exe
2560	schtasks.exe
784	schtasks.exe
2552	schtasks.exe
1704	schtasks.exe
2744	schtasks.exe
352	schtasks.exe
2608	schtasks.exe
2540	schtasks.exe
2200	schtasks.exe
2924	schtasks.exe
2484	schtasks.exe
444	schtasks.exe
2012	schtasks.exe
2260	schtasks.exe
2588	schtasks.exe
2584	schtasks.exe
2112	schtasks.exe
2852	schtasks.exe
1560	schtasks.exe
2148	schtasks.exe
1804	schtasks.exe
2692	schtasks.exe
304	schtasks.exe
624	schtasks.exe
2776	schtasks.exe
276	schtasks.exe
1992	schtasks.exe
1968	schtasks.exe
1720	schtasks.exe
1660	schtasks.exe
1520	schtasks.exe
2436	schtasks.exe
1944	schtasks.exe
936	schtasks.exe
2432	schtasks.exe
2324	schtasks.exe
1592	schtasks.exe
708	schtasks.exe
2316	schtasks.exe
1812	schtasks.exe
1208	schtasks.exe
2880	schtasks.exe
2264	schtasks.exe
2144	schtasks.exe
2764	schtasks.exe
332	schtasks.exe
1536	schtasks.exe
2664	schtasks.exe
1788	schtasks.exe
2100	schtasks.exe
2392	schtasks.exe
2440	schtasks.exe
2800	schtasks.exe
2708	schtasks.exe
3040	schtasks.exe
1684	schtasks.exe

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
3060	1f0343adab1970d928320ce2aa587fd3.exe
2152	powershell.exe
1108	powershell.exe
2604	powershell.exe
892	powershell.exe
1804	powershell.exe
2928	powershell.exe
2392	powershell.exe
2144	powershell.exe
1528	powershell.exe
2400	powershell.exe
2416	powershell.exe
2288	powershell.exe
1236	powershell.exe
1812	powershell.exe
1564	powershell.exe
1532	powershell.exe
444	powershell.exe
2412	powershell.exe
2520	powershell.exe
2396	powershell.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	3060	1f0343adab1970d928320ce2aa587fd3.exe
Token: SeDebugPrivilege	2152	powershell.exe
Token: SeDebugPrivilege	1108	powershell.exe
Token: SeDebugPrivilege	2604	powershell.exe
Token: SeDebugPrivilege	892	powershell.exe
Token: SeDebugPrivilege	1804	powershell.exe
Token: SeDebugPrivilege	2928	powershell.exe
Token: SeDebugPrivilege	2392	powershell.exe
Token: SeDebugPrivilege	2144	powershell.exe
Token: SeDebugPrivilege	1528	powershell.exe
Token: SeDebugPrivilege	2400	powershell.exe
Token: SeDebugPrivilege	2416	powershell.exe
Token: SeDebugPrivilege	2768	csrss.exe
Token: SeDebugPrivilege	2288	powershell.exe
Token: SeDebugPrivilege	1236	powershell.exe
Token: SeDebugPrivilege	1812	powershell.exe
Token: SeDebugPrivilege	1564	powershell.exe
Token: SeDebugPrivilege	1532	powershell.exe
Token: SeDebugPrivilege	444	powershell.exe
Token: SeDebugPrivilege	2412	powershell.exe
Token: SeDebugPrivilege	2520	powershell.exe
Token: SeDebugPrivilege	2396	powershell.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 3060 wrote to memory of 1804	3060	1f0343adab1970d928320ce2aa587fd3.exe	89
PID 3060 wrote to memory of 1804	3060	1f0343adab1970d928320ce2aa587fd3.exe	89
PID 3060 wrote to memory of 1804	3060	1f0343adab1970d928320ce2aa587fd3.exe	89
PID 3060 wrote to memory of 2604	3060	1f0343adab1970d928320ce2aa587fd3.exe	90
PID 3060 wrote to memory of 2604	3060	1f0343adab1970d928320ce2aa587fd3.exe	90
PID 3060 wrote to memory of 2604	3060	1f0343adab1970d928320ce2aa587fd3.exe	90
PID 3060 wrote to memory of 1812	3060	1f0343adab1970d928320ce2aa587fd3.exe	91
PID 3060 wrote to memory of 1812	3060	1f0343adab1970d928320ce2aa587fd3.exe	91
PID 3060 wrote to memory of 1812	3060	1f0343adab1970d928320ce2aa587fd3.exe	91
PID 3060 wrote to memory of 2928	3060	1f0343adab1970d928320ce2aa587fd3.exe	92
PID 3060 wrote to memory of 2928	3060	1f0343adab1970d928320ce2aa587fd3.exe	92
PID 3060 wrote to memory of 2928	3060	1f0343adab1970d928320ce2aa587fd3.exe	92
PID 3060 wrote to memory of 892	3060	1f0343adab1970d928320ce2aa587fd3.exe	94
PID 3060 wrote to memory of 892	3060	1f0343adab1970d928320ce2aa587fd3.exe	94
PID 3060 wrote to memory of 892	3060	1f0343adab1970d928320ce2aa587fd3.exe	94
PID 3060 wrote to memory of 2152	3060	1f0343adab1970d928320ce2aa587fd3.exe	96
PID 3060 wrote to memory of 2152	3060	1f0343adab1970d928320ce2aa587fd3.exe	96
PID 3060 wrote to memory of 2152	3060	1f0343adab1970d928320ce2aa587fd3.exe	96
PID 3060 wrote to memory of 1108	3060	1f0343adab1970d928320ce2aa587fd3.exe	98
PID 3060 wrote to memory of 1108	3060	1f0343adab1970d928320ce2aa587fd3.exe	98
PID 3060 wrote to memory of 1108	3060	1f0343adab1970d928320ce2aa587fd3.exe	98
PID 3060 wrote to memory of 1528	3060	1f0343adab1970d928320ce2aa587fd3.exe	100
PID 3060 wrote to memory of 1528	3060	1f0343adab1970d928320ce2aa587fd3.exe	100
PID 3060 wrote to memory of 1528	3060	1f0343adab1970d928320ce2aa587fd3.exe	100
PID 3060 wrote to memory of 444	3060	1f0343adab1970d928320ce2aa587fd3.exe	102
PID 3060 wrote to memory of 444	3060	1f0343adab1970d928320ce2aa587fd3.exe	102
PID 3060 wrote to memory of 444	3060	1f0343adab1970d928320ce2aa587fd3.exe	102
PID 3060 wrote to memory of 1532	3060	1f0343adab1970d928320ce2aa587fd3.exe	104
PID 3060 wrote to memory of 1532	3060	1f0343adab1970d928320ce2aa587fd3.exe	104
PID 3060 wrote to memory of 1532	3060	1f0343adab1970d928320ce2aa587fd3.exe	104
PID 3060 wrote to memory of 2396	3060	1f0343adab1970d928320ce2aa587fd3.exe	106
PID 3060 wrote to memory of 2396	3060	1f0343adab1970d928320ce2aa587fd3.exe	106
PID 3060 wrote to memory of 2396	3060	1f0343adab1970d928320ce2aa587fd3.exe	106
PID 3060 wrote to memory of 2288	3060	1f0343adab1970d928320ce2aa587fd3.exe	107
PID 3060 wrote to memory of 2288	3060	1f0343adab1970d928320ce2aa587fd3.exe	107
PID 3060 wrote to memory of 2288	3060	1f0343adab1970d928320ce2aa587fd3.exe	107
PID 3060 wrote to memory of 2400	3060	1f0343adab1970d928320ce2aa587fd3.exe	108
PID 3060 wrote to memory of 2400	3060	1f0343adab1970d928320ce2aa587fd3.exe	108
PID 3060 wrote to memory of 2400	3060	1f0343adab1970d928320ce2aa587fd3.exe	108
PID 3060 wrote to memory of 2144	3060	1f0343adab1970d928320ce2aa587fd3.exe	109
PID 3060 wrote to memory of 2144	3060	1f0343adab1970d928320ce2aa587fd3.exe	109
PID 3060 wrote to memory of 2144	3060	1f0343adab1970d928320ce2aa587fd3.exe	109
PID 3060 wrote to memory of 2520	3060	1f0343adab1970d928320ce2aa587fd3.exe	110
PID 3060 wrote to memory of 2520	3060	1f0343adab1970d928320ce2aa587fd3.exe	110
PID 3060 wrote to memory of 2520	3060	1f0343adab1970d928320ce2aa587fd3.exe	110
PID 3060 wrote to memory of 2416	3060	1f0343adab1970d928320ce2aa587fd3.exe	111
PID 3060 wrote to memory of 2416	3060	1f0343adab1970d928320ce2aa587fd3.exe	111
PID 3060 wrote to memory of 2416	3060	1f0343adab1970d928320ce2aa587fd3.exe	111
PID 3060 wrote to memory of 2392	3060	1f0343adab1970d928320ce2aa587fd3.exe	112
PID 3060 wrote to memory of 2392	3060	1f0343adab1970d928320ce2aa587fd3.exe	112
PID 3060 wrote to memory of 2392	3060	1f0343adab1970d928320ce2aa587fd3.exe	112
PID 3060 wrote to memory of 1236	3060	1f0343adab1970d928320ce2aa587fd3.exe	113
PID 3060 wrote to memory of 1236	3060	1f0343adab1970d928320ce2aa587fd3.exe	113
PID 3060 wrote to memory of 1236	3060	1f0343adab1970d928320ce2aa587fd3.exe	113
PID 3060 wrote to memory of 1564	3060	1f0343adab1970d928320ce2aa587fd3.exe	114
PID 3060 wrote to memory of 1564	3060	1f0343adab1970d928320ce2aa587fd3.exe	114
PID 3060 wrote to memory of 1564	3060	1f0343adab1970d928320ce2aa587fd3.exe	114
PID 3060 wrote to memory of 2412	3060	1f0343adab1970d928320ce2aa587fd3.exe	115
PID 3060 wrote to memory of 2412	3060	1f0343adab1970d928320ce2aa587fd3.exe	115
PID 3060 wrote to memory of 2412	3060	1f0343adab1970d928320ce2aa587fd3.exe	115
PID 3060 wrote to memory of 2768	3060	1f0343adab1970d928320ce2aa587fd3.exe	129
PID 3060 wrote to memory of 2768	3060	1f0343adab1970d928320ce2aa587fd3.exe	129
PID 3060 wrote to memory of 2768	3060	1f0343adab1970d928320ce2aa587fd3.exe	129

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\1f0343adab1970d928320ce2aa587fd3.exe
"C:\Users\Admin\AppData\Local\Temp\1f0343adab1970d928320ce2aa587fd3.exe"
1⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3060
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\1f0343adab1970d928320ce2aa587fd3.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1804
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\1f0343adab1970d928320ce2aa587fd3.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2604
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\explorer.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1812
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\csrss.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2928
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\lsm.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:892
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Application Data\Idle.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2152
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Google\dwm.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1108
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\sppsvc.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1528
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\RemotePackages\RemoteApps\smss.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:444
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\AppPatch\en-US\services.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1532
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Migration\WTR\Idle.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2396
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Music\Sample Music\wininit.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2288
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\PCHEALTH\ERRORREP\QHEADLES\csrss.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2400
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\csrss.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2144
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\lsm.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2520
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Mozilla Maintenance Service\logs\csrss.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2416
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\VideoLAN\VLC\hrtfs\dllhost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2392
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\BitLockerDiscoveryVolumeContents\smss.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1236
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Photo Viewer\es-ES\winlogon.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1564
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\smss.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2412
- C:\Users\Admin\csrss.exe
  "C:\Users\Admin\csrss.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "1f0343adab1970d928320ce2aa587fd31" /sc MINUTE /mo 8 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\1f0343adab1970d928320ce2aa587fd3.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "1f0343adab1970d928320ce2aa587fd3" /sc ONLOGON /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\1f0343adab1970d928320ce2aa587fd3.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "1f0343adab1970d928320ce2aa587fd31" /sc MINUTE /mo 5 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\1f0343adab1970d928320ce2aa587fd3.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2440

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 14 /tr "'C:\Users\Admin\Application Data\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Users\Admin\Application Data\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\Application Data\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2264

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Google\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Google\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\Windows\RemotePackages\RemoteApps\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\RemotePackages\RemoteApps\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 14 /tr "'C:\Windows\RemotePackages\RemoteApps\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 7 /tr "'C:\Windows\AppPatch\en-US\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Windows\AppPatch\en-US\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 8 /tr "'C:\Windows\AppPatch\en-US\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 9 /tr "'C:\Windows\Migration\WTR\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Windows\Migration\WTR\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 8 /tr "'C:\Windows\Migration\WTR\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 8 /tr "'C:\Users\Public\Music\Sample Music\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Users\Public\Music\Sample Music\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\Users\Public\Music\Sample Music\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Windows\PCHEALTH\ERRORREP\QHEADLES\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\PCHEALTH\ERRORREP\QHEADLES\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Windows\PCHEALTH\ERRORREP\QHEADLES\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Admin\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1788

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:276

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\MSOCache\All Users\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\Program Files\VideoLAN\VLC\hrtfs\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:332

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\VLC\hrtfs\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Program Files\VideoLAN\VLC\hrtfs\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2100

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 7 /tr "'C:\Windows\BitLockerDiscoveryVolumeContents\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2260

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\BitLockerDiscoveryVolumeContents\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2148

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 14 /tr "'C:\Windows\BitLockerDiscoveryVolumeContents\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Photo Viewer\es-ES\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\es-ES\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Photo Viewer\es-ES\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\MSOCache\All Users\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\smss.exe

Filesize
1.6MB

MD5
7cf3868371834ed71faab526f3a70472

SHA1
fb311147e04e8d20886d0f91c96d9a22b18c199e

SHA256
b339b9477b2a4feeaf5f31d2b7c4bb2cd50118cd7ca1e900077fb8a07aa4a199

SHA512
265105dc3e18c8e5b11dd50564f7d6d6a9925e8d7f798bb612c51b30b66dbc63a813eb87e8601373c25c79e9e362eca6415a31303f12e3bbbf27969090967ac2

Download Submit
C:\Program Files (x86)\Google\dwm.exe

Filesize
1.6MB

MD5
f37f5603d3ba79fbbc6870b02a73af28

SHA1
c390f2982fc42f1dac36382f34438f6f7f527798

SHA256
2a7a857800a743e42de9a58c00bdff289be96f2816781370a4928791bd3a507c

SHA512
8b04d244324800f51e869dc05524f378e12bccd1ef0320075338863b08d8c5aed74cfee65e5dc83538f75512001d2e53f95986016805628df572559870a532a1

Download Submit
C:\Program Files\VideoLAN\VLC\hrtfs\dllhost.exe

Filesize
1.6MB

MD5
b6e034680a835e9437a855d03a50b4b6

SHA1
605f47dd04b3b20152471177e16d1377578b9762

SHA256
b66397b96b0d76d4ae906b78d633e7eb6f42eb551f57b341313308d943a4c515

SHA512
5636428f0232f969d6bae4178d64bdfcfbb5f57a5701257ddcef348be81eb465b229588c6e3d9d1d1359ac2bdf8d36e95f6fbca5c684dd0efe2fa2971d1a7e94

Download Submit
C:\Users\Admin\AppData\Roaming\Idle.exe

Filesize
1.6MB

MD5
1f0343adab1970d928320ce2aa587fd3

SHA1
e9ba72eefebbc990b9d87fdc6c900ba0ab4160b8

SHA256
9543bb2076f9b8c0d465689514dfc89f7cddc872620b5158cff2e2fa270963c4

SHA512
c6ae66f4ee2e2307da2176d9ea1e8a57ee96c59a15c633d8ca618cc4c167744063fa189d03eb134e1789ad544cef426e1b6da8c61dd1785888b204f84cdc316c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
a33ea51da39b44ff0cc9e7e91d4c3963

SHA1
df4d79a63f645b439bd872d61e7d81157432e338

SHA256
aecf6d1132d19e8c2ecc50f6ffcdea4e7b89516f187731281218f081055ba229

SHA512
f3dd095ccc519f29850702cd45af24dec9d7be403a65f597e46fc3998da039f5d9db89e23db3d5d4be524ba56da717736eb0cc67e49bb2fac455bbd555b41c2b

Download Submit
C:\Users\Admin\csrss.exe

Filesize
1.6MB

MD5
cb5562132f9bb7edeca23914b321982b

SHA1
72129988c93faf490d08a7436bf7db25a7a74390

SHA256
bbbb073ec63efcc3c5706ed0c993948897d7ba2aa151f20ab53f1ca80f365974

SHA512
9ba9fefc0155cb12a82d74e22d6e90cb6826119d6527ff12b1e045fe263823555c794b07f720b107775cb8b4384158c054d7ae94718b56286f9f9bc1f582eb6a

Download Submit
C:\Windows\AppPatch\en-US\services.exe

Filesize
1.6MB

MD5
ccd4e5e66c7f097cc152dc6a3992b408

SHA1
da060920072fc880409df483f8c6dc3d26d6cc6a

SHA256
24a9d25727a2fd44b90f6df5ce1b03dd80379a0b90c1e104f87d6d45ccca9de6

SHA512
bdc765ebff3349c8550310a199ea101d1dd84071c6a8c2673436082d0ae44e7ae9166c2a8f92aba069a6e3513f9b00bd1983dc07a55e8b1a4ef1c2bcf41714c3

Download Submit
C:\Windows\BitLockerDiscoveryVolumeContents\smss.exe

Filesize
1.6MB

MD5
ff39c6853ba67df71d892c266df1741c

SHA1
5c4cfe2332307d7e1d62121e5551539caf108717

SHA256
0b5817ce11624a71e58ff172b59b8194b83a6c2064ac2ef92faca48a9e461161

SHA512
3210bb636d8e6b245ee9c0539e28ccfc7a56f23c8b5dbe39cfd2e969646e12a70e9fafb8b79c4b4a9107359ff1d6eb45935340d70f74fb0ee2f23da163b447f0

Download Submit
memory/2152-295-0x000000001B5D0000-0x000000001B8B2000-memory.dmp

Filesize
2.9MB

Download
memory/2152-310-0x00000000028E0000-0x00000000028E8000-memory.dmp

Filesize
32KB

Download
memory/2768-337-0x0000000000E30000-0x0000000000FD2000-memory.dmp

Filesize
1.6MB

Download
memory/3060-6-0x00000000004B0000-0x00000000004B8000-memory.dmp

Filesize
32KB

Download
memory/3060-203-0x000007FEF5B63000-0x000007FEF5B64000-memory.dmp

Filesize
4KB

Download
memory/3060-13-0x0000000000560000-0x0000000000568000-memory.dmp

Filesize
32KB

Download
memory/3060-14-0x0000000000570000-0x0000000000578000-memory.dmp

Filesize
32KB

Download
memory/3060-15-0x0000000000580000-0x000000000058A000-memory.dmp

Filesize
40KB

Download
memory/3060-16-0x0000000000590000-0x000000000059C000-memory.dmp

Filesize
48KB

Download
memory/3060-11-0x0000000000540000-0x000000000054A000-memory.dmp

Filesize
40KB

Download
memory/3060-10-0x0000000000530000-0x000000000053C000-memory.dmp

Filesize
48KB

Download
memory/3060-9-0x00000000004E0000-0x00000000004EC000-memory.dmp

Filesize
48KB

Download
memory/3060-12-0x0000000000550000-0x000000000055E000-memory.dmp

Filesize
56KB

Download
memory/3060-8-0x00000000004C0000-0x00000000004C8000-memory.dmp

Filesize
32KB

Download
memory/3060-221-0x000007FEF5B60000-0x000007FEF654C000-memory.dmp

Filesize
9.9MB

Download
memory/3060-0-0x000007FEF5B63000-0x000007FEF5B64000-memory.dmp

Filesize
4KB

Download
memory/3060-7-0x00000000004D0000-0x00000000004E0000-memory.dmp

Filesize
64KB

Download
memory/3060-5-0x0000000000270000-0x0000000000286000-memory.dmp

Filesize
88KB

Download
memory/3060-4-0x0000000000260000-0x0000000000270000-memory.dmp

Filesize
64KB

Download
memory/3060-3-0x0000000000240000-0x000000000025C000-memory.dmp

Filesize
112KB

Download
memory/3060-2-0x000007FEF5B60000-0x000007FEF654C000-memory.dmp

Filesize
9.9MB

Download
memory/3060-1-0x0000000000290000-0x0000000000432000-memory.dmp

Filesize
1.6MB

Download
memory/3060-347-0x000007FEF5B60000-0x000007FEF654C000-memory.dmp

Filesize
9.9MB

Download