dcrat | 01ffe9d6f323a1dafd7dbe75338596cb03cdbe970cdc964543ae03006c1ece85

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
22/03/2025, 19:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1df5615c53dd390e494c93dd90caada8678eb2fccdddaccf063e96fc3956abd6.exe
Size

1.6MB
MD5

e38a8ba2db5ea28f0f52d37b4a9d0d45
SHA1

eeb67e1eb72370ce24df9b82c6a7664176dfe064
SHA256

1df5615c53dd390e494c93dd90caada8678eb2fccdddaccf063e96fc3956abd6
SHA512

ee6f813b71c0c56c5794cb6b5ba48fdf527a9f0077aaf1a100e1f36c914e28bb6675f8ae90544ada72d0e315b436db8016dffe27467b6891cbbd1ef07d7b661e
SSDEEP

24576:qsm8JijftfWIqZpyh/X6bSmV2GKz1oncoiF9GFwUvpHk3tSfEybcswrJ4gOEGEk:qD8Jijt+xpS/ekYmLGdhEAf7bCcjE

Score

10^/10

dcrat execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 24 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4084	1760	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2644	1760	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4676	1760	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2472	1760	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3668	1760	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4808	1760	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2836	1760	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4000	1760	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2200	1760	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3960	1760	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3028	1760	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4356	1760	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	368	1760	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4092	1760	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1064	1760	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	840	1760	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4524	1760	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4360	1760	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2828	1760	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5112	1760	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2576	1760	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2904	1760	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1392	1760	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	664	1760	schtasks.exe	87

DCRat payload 3 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral8/memory/2192-1-0x00000000008E0000-0x0000000000A82000-memory.dmp	dcrat
behavioral8/files/0x00070000000240af-26.dat	dcrat
behavioral8/files/0x00090000000240ab-93.dat	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 9 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2296	powershell.exe
920	powershell.exe
4100	powershell.exe
5020	powershell.exe
3984	powershell.exe
4688	powershell.exe
2092	powershell.exe
4568	powershell.exe
1776	powershell.exe

Checks computer location settings 2 TTPs 16 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Control Panel\International\Geo\Nation	1df5615c53dd390e494c93dd90caada8678eb2fccdddaccf063e96fc3956abd6.exe
Key value queried	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Control Panel\International\Geo\Nation	csrss.exe

Executes dropped EXE 16 IoCs

pid	Process
2728	csrss.exe
3684	csrss.exe
4508	csrss.exe
3412	csrss.exe
2248	csrss.exe
432	csrss.exe
5044	csrss.exe
968	csrss.exe
3452	csrss.exe
4508	csrss.exe
2412	csrss.exe
3620	csrss.exe
3984	csrss.exe
3412	csrss.exe
2208	csrss.exe
3468	csrss.exe

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\RCX7A8A.tmp	1df5615c53dd390e494c93dd90caada8678eb2fccdddaccf063e96fc3956abd6.exe
File created	C:\Program Files\Windows NT\TableTextService\en-US\6ccacd8608530f	1df5615c53dd390e494c93dd90caada8678eb2fccdddaccf063e96fc3956abd6.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\upfc.exe	1df5615c53dd390e494c93dd90caada8678eb2fccdddaccf063e96fc3956abd6.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\ea1d8f6d871115	1df5615c53dd390e494c93dd90caada8678eb2fccdddaccf063e96fc3956abd6.exe
File opened for modification	C:\Program Files\Windows NT\TableTextService\en-US\RCX7040.tmp	1df5615c53dd390e494c93dd90caada8678eb2fccdddaccf063e96fc3956abd6.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\RCX7A1C.tmp	1df5615c53dd390e494c93dd90caada8678eb2fccdddaccf063e96fc3956abd6.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\upfc.exe	1df5615c53dd390e494c93dd90caada8678eb2fccdddaccf063e96fc3956abd6.exe
File created	C:\Program Files\Windows NT\TableTextService\en-US\Idle.exe	1df5615c53dd390e494c93dd90caada8678eb2fccdddaccf063e96fc3956abd6.exe
File opened for modification	C:\Program Files\Windows NT\TableTextService\en-US\Idle.exe	1df5615c53dd390e494c93dd90caada8678eb2fccdddaccf063e96fc3956abd6.exe
File opened for modification	C:\Program Files\Windows NT\TableTextService\en-US\RCX708F.tmp	1df5615c53dd390e494c93dd90caada8678eb2fccdddaccf063e96fc3956abd6.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\en-US\RCX7F22.tmp	1df5615c53dd390e494c93dd90caada8678eb2fccdddaccf063e96fc3956abd6.exe
File opened for modification	C:\Windows\en-US\Idle.exe	1df5615c53dd390e494c93dd90caada8678eb2fccdddaccf063e96fc3956abd6.exe
File created	C:\Windows\en-US\Idle.exe	1df5615c53dd390e494c93dd90caada8678eb2fccdddaccf063e96fc3956abd6.exe
File created	C:\Windows\en-US\6ccacd8608530f	1df5615c53dd390e494c93dd90caada8678eb2fccdddaccf063e96fc3956abd6.exe
File opened for modification	C:\Windows\en-US\RCX7F21.tmp	1df5615c53dd390e494c93dd90caada8678eb2fccdddaccf063e96fc3956abd6.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 16 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	1df5615c53dd390e494c93dd90caada8678eb2fccdddaccf063e96fc3956abd6.exe
Key created	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000_Classes\Local Settings	csrss.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 24 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4676	schtasks.exe
2472	schtasks.exe
4808	schtasks.exe
2200	schtasks.exe
3960	schtasks.exe
840	schtasks.exe
2904	schtasks.exe
1392	schtasks.exe
4524	schtasks.exe
5112	schtasks.exe
4356	schtasks.exe
368	schtasks.exe
4092	schtasks.exe
4084	schtasks.exe
3668	schtasks.exe
2836	schtasks.exe
2576	schtasks.exe
2644	schtasks.exe
4000	schtasks.exe
3028	schtasks.exe
1064	schtasks.exe
4360	schtasks.exe
2828	schtasks.exe
664	schtasks.exe

Suspicious behavior: EnumeratesProcesses 57 IoCs

pid	Process
2192	1df5615c53dd390e494c93dd90caada8678eb2fccdddaccf063e96fc3956abd6.exe
2192	1df5615c53dd390e494c93dd90caada8678eb2fccdddaccf063e96fc3956abd6.exe
2192	1df5615c53dd390e494c93dd90caada8678eb2fccdddaccf063e96fc3956abd6.exe
2192	1df5615c53dd390e494c93dd90caada8678eb2fccdddaccf063e96fc3956abd6.exe
2192	1df5615c53dd390e494c93dd90caada8678eb2fccdddaccf063e96fc3956abd6.exe
2192	1df5615c53dd390e494c93dd90caada8678eb2fccdddaccf063e96fc3956abd6.exe
2192	1df5615c53dd390e494c93dd90caada8678eb2fccdddaccf063e96fc3956abd6.exe
2192	1df5615c53dd390e494c93dd90caada8678eb2fccdddaccf063e96fc3956abd6.exe
2192	1df5615c53dd390e494c93dd90caada8678eb2fccdddaccf063e96fc3956abd6.exe
4688	powershell.exe
4688	powershell.exe
920	powershell.exe
920	powershell.exe
2092	powershell.exe
2092	powershell.exe
5020	powershell.exe
5020	powershell.exe
1776	powershell.exe
1776	powershell.exe
4568	powershell.exe
4568	powershell.exe
3984	powershell.exe
3984	powershell.exe
4100	powershell.exe
4100	powershell.exe
2296	powershell.exe
2296	powershell.exe
2296	powershell.exe
4688	powershell.exe
920	powershell.exe
2092	powershell.exe
5020	powershell.exe
4568	powershell.exe
1776	powershell.exe
4100	powershell.exe
3984	powershell.exe
2728	csrss.exe
2728	csrss.exe
3684	csrss.exe
4508	csrss.exe
3412	csrss.exe
2248	csrss.exe
2248	csrss.exe
432	csrss.exe
432	csrss.exe
5044	csrss.exe
968	csrss.exe
968	csrss.exe
3452	csrss.exe
4508	csrss.exe
2412	csrss.exe
3620	csrss.exe
3984	csrss.exe
3412	csrss.exe
2208	csrss.exe
2208	csrss.exe
3468	csrss.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: SeDebugPrivilege	2192	1df5615c53dd390e494c93dd90caada8678eb2fccdddaccf063e96fc3956abd6.exe
Token: SeDebugPrivilege	4688	powershell.exe
Token: SeDebugPrivilege	920	powershell.exe
Token: SeDebugPrivilege	2092	powershell.exe
Token: SeDebugPrivilege	5020	powershell.exe
Token: SeDebugPrivilege	1776	powershell.exe
Token: SeDebugPrivilege	4568	powershell.exe
Token: SeDebugPrivilege	3984	powershell.exe
Token: SeDebugPrivilege	4100	powershell.exe
Token: SeDebugPrivilege	2296	powershell.exe
Token: SeDebugPrivilege	2728	csrss.exe
Token: SeDebugPrivilege	3684	csrss.exe
Token: SeDebugPrivilege	4508	csrss.exe
Token: SeDebugPrivilege	3412	csrss.exe
Token: SeDebugPrivilege	2248	csrss.exe
Token: SeDebugPrivilege	432	csrss.exe
Token: SeDebugPrivilege	5044	csrss.exe
Token: SeDebugPrivilege	968	csrss.exe
Token: SeDebugPrivilege	3452	csrss.exe
Token: SeDebugPrivilege	4508	csrss.exe
Token: SeDebugPrivilege	2412	csrss.exe
Token: SeDebugPrivilege	3620	csrss.exe
Token: SeDebugPrivilege	3984	csrss.exe
Token: SeDebugPrivilege	3412	csrss.exe
Token: SeDebugPrivilege	2208	csrss.exe
Token: SeDebugPrivilege	3468	csrss.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 1776	2192	1df5615c53dd390e494c93dd90caada8678eb2fccdddaccf063e96fc3956abd6.exe	112
PID 2192 wrote to memory of 1776	2192	1df5615c53dd390e494c93dd90caada8678eb2fccdddaccf063e96fc3956abd6.exe	112
PID 2192 wrote to memory of 2296	2192	1df5615c53dd390e494c93dd90caada8678eb2fccdddaccf063e96fc3956abd6.exe	113
PID 2192 wrote to memory of 2296	2192	1df5615c53dd390e494c93dd90caada8678eb2fccdddaccf063e96fc3956abd6.exe	113
PID 2192 wrote to memory of 4688	2192	1df5615c53dd390e494c93dd90caada8678eb2fccdddaccf063e96fc3956abd6.exe	114
PID 2192 wrote to memory of 4688	2192	1df5615c53dd390e494c93dd90caada8678eb2fccdddaccf063e96fc3956abd6.exe	114
PID 2192 wrote to memory of 4568	2192	1df5615c53dd390e494c93dd90caada8678eb2fccdddaccf063e96fc3956abd6.exe	115
PID 2192 wrote to memory of 4568	2192	1df5615c53dd390e494c93dd90caada8678eb2fccdddaccf063e96fc3956abd6.exe	115
PID 2192 wrote to memory of 920	2192	1df5615c53dd390e494c93dd90caada8678eb2fccdddaccf063e96fc3956abd6.exe	116
PID 2192 wrote to memory of 920	2192	1df5615c53dd390e494c93dd90caada8678eb2fccdddaccf063e96fc3956abd6.exe	116
PID 2192 wrote to memory of 3984	2192	1df5615c53dd390e494c93dd90caada8678eb2fccdddaccf063e96fc3956abd6.exe	117
PID 2192 wrote to memory of 3984	2192	1df5615c53dd390e494c93dd90caada8678eb2fccdddaccf063e96fc3956abd6.exe	117
PID 2192 wrote to memory of 2092	2192	1df5615c53dd390e494c93dd90caada8678eb2fccdddaccf063e96fc3956abd6.exe	118
PID 2192 wrote to memory of 2092	2192	1df5615c53dd390e494c93dd90caada8678eb2fccdddaccf063e96fc3956abd6.exe	118
PID 2192 wrote to memory of 5020	2192	1df5615c53dd390e494c93dd90caada8678eb2fccdddaccf063e96fc3956abd6.exe	120
PID 2192 wrote to memory of 5020	2192	1df5615c53dd390e494c93dd90caada8678eb2fccdddaccf063e96fc3956abd6.exe	120
PID 2192 wrote to memory of 4100	2192	1df5615c53dd390e494c93dd90caada8678eb2fccdddaccf063e96fc3956abd6.exe	122
PID 2192 wrote to memory of 4100	2192	1df5615c53dd390e494c93dd90caada8678eb2fccdddaccf063e96fc3956abd6.exe	122
PID 2192 wrote to memory of 2728	2192	1df5615c53dd390e494c93dd90caada8678eb2fccdddaccf063e96fc3956abd6.exe	130
PID 2192 wrote to memory of 2728	2192	1df5615c53dd390e494c93dd90caada8678eb2fccdddaccf063e96fc3956abd6.exe	130
PID 2728 wrote to memory of 2004	2728	csrss.exe	134
PID 2728 wrote to memory of 2004	2728	csrss.exe	134
PID 2728 wrote to memory of 4380	2728	csrss.exe	135
PID 2728 wrote to memory of 4380	2728	csrss.exe	135
PID 2004 wrote to memory of 3684	2004	WScript.exe	137
PID 2004 wrote to memory of 3684	2004	WScript.exe	137
PID 3684 wrote to memory of 3488	3684	csrss.exe	139
PID 3684 wrote to memory of 3488	3684	csrss.exe	139
PID 3684 wrote to memory of 2196	3684	csrss.exe	140
PID 3684 wrote to memory of 2196	3684	csrss.exe	140
PID 3488 wrote to memory of 4508	3488	WScript.exe	142
PID 3488 wrote to memory of 4508	3488	WScript.exe	142
PID 4508 wrote to memory of 1228	4508	csrss.exe	143
PID 4508 wrote to memory of 1228	4508	csrss.exe	143
PID 4508 wrote to memory of 4044	4508	csrss.exe	144
PID 4508 wrote to memory of 4044	4508	csrss.exe	144
PID 1228 wrote to memory of 3412	1228	WScript.exe	147
PID 1228 wrote to memory of 3412	1228	WScript.exe	147
PID 3412 wrote to memory of 3644	3412	csrss.exe	148
PID 3412 wrote to memory of 3644	3412	csrss.exe	148
PID 3412 wrote to memory of 4292	3412	csrss.exe	149
PID 3412 wrote to memory of 4292	3412	csrss.exe	149
PID 3644 wrote to memory of 2248	3644	WScript.exe	152
PID 3644 wrote to memory of 2248	3644	WScript.exe	152
PID 2248 wrote to memory of 4492	2248	csrss.exe	155
PID 2248 wrote to memory of 4492	2248	csrss.exe	155
PID 2248 wrote to memory of 2240	2248	csrss.exe	156
PID 2248 wrote to memory of 2240	2248	csrss.exe	156
PID 4492 wrote to memory of 432	4492	WScript.exe	157
PID 4492 wrote to memory of 432	4492	WScript.exe	157
PID 432 wrote to memory of 2412	432	csrss.exe	162
PID 432 wrote to memory of 2412	432	csrss.exe	162
PID 432 wrote to memory of 4996	432	csrss.exe	163
PID 432 wrote to memory of 4996	432	csrss.exe	163
PID 2412 wrote to memory of 5044	2412	WScript.exe	164
PID 2412 wrote to memory of 5044	2412	WScript.exe	164
PID 5044 wrote to memory of 5060	5044	csrss.exe	165
PID 5044 wrote to memory of 5060	5044	csrss.exe	165
PID 5044 wrote to memory of 4828	5044	csrss.exe	166
PID 5044 wrote to memory of 4828	5044	csrss.exe	166
PID 5060 wrote to memory of 968	5060	WScript.exe	167
PID 5060 wrote to memory of 968	5060	WScript.exe	167
PID 968 wrote to memory of 4376	968	csrss.exe	168
PID 968 wrote to memory of 4376	968	csrss.exe	168

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\1df5615c53dd390e494c93dd90caada8678eb2fccdddaccf063e96fc3956abd6.exe
"C:\Users\Admin\AppData\Local\Temp\1df5615c53dd390e494c93dd90caada8678eb2fccdddaccf063e96fc3956abd6.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\1df5615c53dd390e494c93dd90caada8678eb2fccdddaccf063e96fc3956abd6.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1776
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows NT\TableTextService\en-US\Idle.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2296
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\d9c22b4eaa3c0b9c12c7\System.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4688
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\d9c22b4eaa3c0b9c12c7\Idle.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4568
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\dfe2e59cddd00040f555dab607351a1d\fontdrvhost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:920
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\upfc.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3984
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\csrss.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2092
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\en-US\Idle.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5020
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\dfe2e59cddd00040f555dab607351a1d\unsecapp.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4100
- C:\Recovery\WindowsRE\csrss.exe
  "C:\Recovery\WindowsRE\csrss.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2728
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e3d3ff15-519e-4bdf-8d30-d9c26cf0e094.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2004
  - - C:\Recovery\WindowsRE\csrss.exe
      C:\Recovery\WindowsRE\csrss.exe
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3684
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0ee6f9a1-6dd3-4046-90de-de6705a502fb.vbs"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3488
      - C:\Recovery\WindowsRE\csrss.exe
        
        C:\Recovery\WindowsRE\csrss.exe
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4508
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6fd4aba8-2926-44d7-8936-6a8cde27e91e.vbs"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:1228
        
        C:\Recovery\WindowsRE\csrss.exe
        
        C:\Recovery\WindowsRE\csrss.exe
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3412
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\801b0008-1a77-4467-8171-dbd5d3a90aaa.vbs"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:3644
        
        C:\Recovery\WindowsRE\csrss.exe
        
        C:\Recovery\WindowsRE\csrss.exe
        10⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2248
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1510800d-c269-4d22-bd28-38078836d632.vbs"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:4492
        
        C:\Recovery\WindowsRE\csrss.exe
        
        C:\Recovery\WindowsRE\csrss.exe
        12⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:432
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\eb216745-1482-4611-940a-88be68c4c091.vbs"
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:2412
        
        C:\Recovery\WindowsRE\csrss.exe
        
        C:\Recovery\WindowsRE\csrss.exe
        14⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5044
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\749ea99f-89a8-428c-b83a-c1f48e5fbaaa.vbs"
        15⤵
        Suspicious use of WriteProcessMemory
        
        PID:5060
        
        C:\Recovery\WindowsRE\csrss.exe
        
        C:\Recovery\WindowsRE\csrss.exe
        16⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:968
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\79200ef0-dfe7-4312-a48c-e110995b03b6.vbs"
        17⤵
        
        PID:4376
        
        C:\Recovery\WindowsRE\csrss.exe
        
        C:\Recovery\WindowsRE\csrss.exe
        18⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3452
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\401ecba3-503c-4c30-a465-9d9d997bb5e7.vbs"
        19⤵
        
        PID:4668
        
        C:\Recovery\WindowsRE\csrss.exe
        
        C:\Recovery\WindowsRE\csrss.exe
        20⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4508
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f8ba5fc0-5875-46e2-afd2-2a290ae9dd9d.vbs"
        21⤵
        
        PID:4524
        
        C:\Recovery\WindowsRE\csrss.exe
        
        C:\Recovery\WindowsRE\csrss.exe
        22⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2412
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\db254d04-f9ca-4ae8-adeb-2a11295d9ed0.vbs"
        23⤵
        
        PID:452
        
        C:\Recovery\WindowsRE\csrss.exe
        
        C:\Recovery\WindowsRE\csrss.exe
        24⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3620
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\10036296-14c0-4777-82c2-3077852f0de8.vbs"
        25⤵
        
        PID:5004
        
        C:\Recovery\WindowsRE\csrss.exe
        
        C:\Recovery\WindowsRE\csrss.exe
        26⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3984
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4b42d0c0-966e-4c1e-bb01-026c66f449d5.vbs"
        27⤵
        
        PID:4428
        
        C:\Recovery\WindowsRE\csrss.exe
        
        C:\Recovery\WindowsRE\csrss.exe
        28⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3412
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b33b03f1-937f-4958-bea2-d22192eed416.vbs"
        29⤵
        
        PID:3920
        
        C:\Recovery\WindowsRE\csrss.exe
        
        C:\Recovery\WindowsRE\csrss.exe
        30⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2208
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3d0ee952-034c-4ea7-b038-9bfe0abc96eb.vbs"
        31⤵
        
        PID:4544
        
        C:\Recovery\WindowsRE\csrss.exe
        
        C:\Recovery\WindowsRE\csrss.exe
        32⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3468
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\13607788-59c3-455d-86fe-b84fe5afa931.vbs"
        31⤵
        
        PID:1096
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3e971186-0b82-46fd-9856-1603488e4639.vbs"
        29⤵
        
        PID:4848
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f0a9a014-6994-4fce-8061-725621cd9ea0.vbs"
        27⤵
        
        PID:3036
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6b0ae12b-ef24-4578-943f-d38fc521154a.vbs"
        25⤵
        
        PID:4472
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d33fb1d3-d64f-4058-be5b-ba04a68ce5a9.vbs"
        23⤵
        
        PID:5108
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c62fed8d-55bd-4768-8324-d7e90193b43f.vbs"
        21⤵
        
        PID:1968
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\79890d76-2a9b-472e-a98e-195cde6ce034.vbs"
        19⤵
        
        PID:1684
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fd807abd-2e3e-48be-860d-8e10411467b2.vbs"
        17⤵
        
        PID:808
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e3bddb1a-fdb9-416b-b9d4-1deb635675ba.vbs"
        15⤵
        
        PID:4828
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fc57c2d1-a1b1-474a-86ec-203992837335.vbs"
        13⤵
        
        PID:4996
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2e471709-79d7-43fd-b662-f39a721fb7a7.vbs"
        11⤵
        
        PID:2240
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2e93eda1-4eb9-4efd-a406-bea936299ff7.vbs"
        9⤵
        
        PID:4292
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\581933b6-b03d-478f-aa0a-e1475b592654.vbs"
        7⤵
        
        PID:4044
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fab43574-5efc-433e-b37c-7c5dde496efc.vbs"
        5⤵
        
        PID:2196
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\223962fe-0873-4fa8-b4a9-fb9da90c536e.vbs"
    3⤵
    PID:4380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows NT\TableTextService\en-US\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files\Windows NT\TableTextService\en-US\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows NT\TableTextService\en-US\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 13 /tr "'C:\d9c22b4eaa3c0b9c12c7\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\d9c22b4eaa3c0b9c12c7\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 6 /tr "'C:\d9c22b4eaa3c0b9c12c7\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\d9c22b4eaa3c0b9c12c7\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\d9c22b4eaa3c0b9c12c7\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\d9c22b4eaa3c0b9c12c7\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\dfe2e59cddd00040f555dab607351a1d\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\dfe2e59cddd00040f555dab607351a1d\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\dfe2e59cddd00040f555dab607351a1d\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 5 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\upfc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:368

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 5 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\Windows\en-US\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Windows\en-US\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\Windows\en-US\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 12 /tr "'C:\dfe2e59cddd00040f555dab607351a1d\unsecapp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\dfe2e59cddd00040f555dab607351a1d\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 10 /tr "'C:\dfe2e59cddd00040f555dab607351a1d\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\upfc.exe

Filesize
1.6MB

MD5
e38a8ba2db5ea28f0f52d37b4a9d0d45

SHA1
eeb67e1eb72370ce24df9b82c6a7664176dfe064

SHA256
1df5615c53dd390e494c93dd90caada8678eb2fccdddaccf063e96fc3956abd6

SHA512
ee6f813b71c0c56c5794cb6b5ba48fdf527a9f0077aaf1a100e1f36c914e28bb6675f8ae90544ada72d0e315b436db8016dffe27467b6891cbbd1ef07d7b661e

Download Submit
C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\upfc.exe

Filesize
1.6MB

MD5
7fd3f9c02fbe85e6b17e9a6ee848f767

SHA1
b13571749846099e06401b2a3f71ee5db4a3a539

SHA256
6a2079ccf18d6d8bc4a8a9f01b5fe627f1f514cd439fd9df15d18ccc42206dd0

SHA512
74f9c3d83e616db06d570b716eca1e854c03ce13f4c2626b62a768d5193828f1a7019f1bb62366e20d385cb27ed23e5e4a9e46d1e79d096f37c99977fe8317bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\csrss.exe.log

Filesize
1KB

MD5
3690a1c3b695227a38625dcf27bd6dac

SHA1
c2ed91e98b120681182904fa2c7cd504e5c4b2f5

SHA256
2ca8df156dba033c5b3ae4009e3be14dcdc6b9be53588055efd0864a1ab8ff73

SHA512
15ebfe05c0317f844e957ac02842a60b01f00ddca981e888e547056d0e30c97829bc4a2a46ce43034b3346f7cf5406c7c41c2a830f0abc47c8d2fd2ef00cb2c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
643f98db244717856667bfd771e9db1c

SHA1
5434950e3506ae0cca216690c8fb5d2b38dd591d

SHA256
5e01aecf68e759cce4264330c3b7bc5b30b0d6c17718e558543c87530cf78256

SHA512
886d498dfce303f191b32d7001197aad7bd5eec12b5885ef620be32750902da2369536b10f451e712380bd7b420c051447b998d42f53ffae9b6a358c4db66a44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
1641de9a10da75d35edf03caa25212c1

SHA1
af73f64f8ce476c8e4eb56bb40426552d34c1ca8

SHA256
5fbacccb41dad88018fad178d824e1dc4cdc48e08032d374ac88d37c88ee60c2

SHA512
7123f9d69a0930a5143e442893cb2711bd9fd911f50e00f7b651ff8d448b78541ea0fa5f36452ad30e4c90ebfd1b1cc51e97422d6649089ec6b9f783ee6101e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
82da496008a09abc336bf9adbe6453dd

SHA1
a57df6c2432c6bf7ab549a4333e636f9d9dfebd2

SHA256
69def38d01c34269e4e7be79130fc62befb01815c783fef6d4dc116672306810

SHA512
86d1efaf512d5ffc0af6a4508e63ffaa646971192762461957c0a544e77f9f24bbd0576927a6a996a87f147bcd6562bdc27a57caac6aad64354f485a7a7a7197

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
35be6e176d67a5af3e24a7f54b4a9574

SHA1
900bbb3f3f8a9d38a4e548b4ba60838a9eae41b9

SHA256
c0be8fe9bbed3f82068a8179a28fadfcaef8a524818f34b87b59b5e1b2cae1c7

SHA512
09d15913b88d2eb7529d661c5bb2ee20eef0a7df92b5eaaadb2ebc70ad68d9c38b341b148ac058c895b7f85a54d703c3543b043d8d2a3f0536d21d3c7ebbe15f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
7cfa57226f15f18e8c29720a8a6efc8b

SHA1
fef3b41b9715cd37a0bb9ab323fc9aa62158d55b

SHA256
53d11cfbf4bbedac6a4963cbe63d8f500f1cfd159e1b9c24149c855d3be188eb

SHA512
d6ea186fa684b2ca04eb5d9292a5d60b4d22f03205eb0bbe51c8715e1312e2179bc6da60c7763cb7663cd967fc761b9bd8d9949b009e2e6cba51883a167d1820

Download Submit
C:\Users\Admin\AppData\Local\Temp\0ee6f9a1-6dd3-4046-90de-de6705a502fb.vbs

Filesize
707B

MD5
59fa5dbfbfd05d7f862d1c39d5096ed9

SHA1
dc1c9038970d98d858fb21c10a34f71bf4e17af4

SHA256
ac60b57a65e33703748c3fc44d481335033bfee2982c67bc00a747f3bf21d1cb

SHA512
b92e263f2a8194fd2dad4afb734886c2e38bbc01f602632ed9650c0335f3904bac76f3040daaf50a11a2f418e33363abaebdfb164b0d6c8ff6619fe0208ae920

Download Submit
C:\Users\Admin\AppData\Local\Temp\10036296-14c0-4777-82c2-3077852f0de8.vbs

Filesize
707B

MD5
2050c8dc263c16d3852e3d72cc2ac55f

SHA1
8660818a819e636d2d27e5eab429422d5f034988

SHA256
0d27625da9bcce7e88b26c511fd1b07afc3d42f32a8ad48b088bc9a35d3dc9ec

SHA512
024d6b127cb509e2a30151807240c2cb896ee1925a5ec00d44b1c473fd03812197f6baa1f30e356600d513517abf69d68bc4b57e8a12c9b299b986db77030c4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\1510800d-c269-4d22-bd28-38078836d632.vbs

Filesize
707B

MD5
bea7d1b89f516afb28d11f784faea92f

SHA1
b68db8e9a5b414359bd1d99f070cc921d8ea6dbf

SHA256
428d81d839acf0c268da07e4ff2a6c165a5e8c1e551c513cdcb15a07823f5417

SHA512
64663fc7655dd92f2dd323432ff8bcbdd53a2b69497b336216de86fd97124b5dc9e3ada46d2113ecd9468214080859db8cd9065ea65a2b8994ffa9aec53ee1f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\223962fe-0873-4fa8-b4a9-fb9da90c536e.vbs

Filesize
483B

MD5
31db4cf0fb94de23011ed13671f67929

SHA1
ed335cdcb5ac9bce1d59f2486701c803174cc91d

SHA256
02680d0a1ae4bbcdb152e10c1146476ea1d999593d7efdecea28a6e98ce8f168

SHA512
7c2dfa6e387d0b03ef46b822640c0b1cc38a4b12624ded8e1cd58dd3d14da88eecd918611cba9b616730495f1832663d2fe4478b78042cf067bb0c8d034ad5bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\4b42d0c0-966e-4c1e-bb01-026c66f449d5.vbs

Filesize
707B

MD5
11c5de917c70642b274b48f6de7f98c5

SHA1
a4ad068aa56312cb3963dec5b9622a1e2aa4ddd7

SHA256
0d775265b779738df306f061385eebb0656a6e66c68db7d70ca26325f7f52111

SHA512
51ac5637d07784f21a5e7c9e78893f9c1837e87313cdf08e9c0998434bb71b630686497f5184dfb1091779e7490632b6c5ba48ba63df1fbecb30a406ac9dd3d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\6fd4aba8-2926-44d7-8936-6a8cde27e91e.vbs

Filesize
707B

MD5
714c77f6f9ba8584629c3d97e1df2eb6

SHA1
fed77a15d65ebe9261d5e54ee690de35fd95853b

SHA256
3cf31a0dc78780448dec8b20807a957ed2312cd25432a63afff0128bac5333f5

SHA512
e3e13804aedd6733b4ffe87137c8b7631ce3c0306be11ea950bfe55e98a4334844e520509f3b58e159e133ace96dd64ca3d10fa44379bf1361e6e03325f799f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\749ea99f-89a8-428c-b83a-c1f48e5fbaaa.vbs

Filesize
707B

MD5
20aca60f5ff6c15dff38063c52594b50

SHA1
02d9f4a1465235bc5f33306d4c4669317a47533c

SHA256
6cefaf4bd7226c25ecfddf9bd7fd454dcc7b6b594723b7d0d7920412654089fa

SHA512
c45e81fb0d6eb8985299b9e773c666ab272d30dc1d12e138b19d2caa6d3a6459a050b2ebe7a2d7e62f38abc76b01ec1e8455cb353a3169fb999b38337d8cb441

Download Submit
C:\Users\Admin\AppData\Local\Temp\79200ef0-dfe7-4312-a48c-e110995b03b6.vbs

Filesize
706B

MD5
b5a4aa7b9ede463a89e76a032fec5cf3

SHA1
5469375f48e04e8b54084aebe37ea5a317e012d2

SHA256
9045ef85b723bd88e9cb39d1d9419a2433d42492d29b3dad2dec4fc9a1b5d51b

SHA512
40ffa86329aa31148d86671cc74148fab6fe8e3d015a0480d7c20d7ee9e376f878d8239bb2bc75e2c0afcffb2c25cca8d216cfc862dc3935a351ec407570337c

Download Submit
C:\Users\Admin\AppData\Local\Temp\801b0008-1a77-4467-8171-dbd5d3a90aaa.vbs

Filesize
707B

MD5
b1d4353d9fd37e37f476fc2586932670

SHA1
8b78025261d0598e760fb61149fac73df2384f02

SHA256
109c84ce8476f1c2ff666adbed750bba05986ddcfde2fcf0aa394fd8168cba99

SHA512
d2360b07cfbcee7f4cdcfdba917a8cf5caa605d4e9ef0834b3e57ffa1f3a46ecd9b651ed29dc5559a92fef5596413752cfa1d92def063d58379feff0a0fa2689

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4laimshe.bm0.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\db254d04-f9ca-4ae8-adeb-2a11295d9ed0.vbs

Filesize
707B

MD5
aac3b0da6282faa9a7dfcbee941cda2f

SHA1
d8f49d8881b5b32c49ed7e070e4fb7fe512f09d4

SHA256
3e37e1478f716564aa0dd4600aea679a94518e8c67b4d7640ec96f9300a7466c

SHA512
f9ac0a96ac22ccd8a0aa0fefc052f9c479e9f541460736d2decfca5e07bdcb93ef46526eeefe213d528173c692f5a285800090b779d6bb24e52274e9ab6712ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\e3d3ff15-519e-4bdf-8d30-d9c26cf0e094.vbs

Filesize
707B

MD5
7721ec2a9d837c64345d71d8f1e93021

SHA1
19fa781e0ac58884a58e7d5640a186eb01778a6b

SHA256
79699818872e1d27da8b0ed2d9df9cff0e41542611aec87264e0e50d80dc6d30

SHA512
e7af215c97671024e7c0e5fde0d6dde6a070f978f50db18ab4916c6e2bdcb2ed099ec61009e3b1c5805662970744d31741df7e19d79df53cb2ce87191a1e13d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\eb216745-1482-4611-940a-88be68c4c091.vbs

Filesize
706B

MD5
b511dc4ec7b5aa670e8ed9ca1cab9e44

SHA1
a62fb8a3db9dc8e2c04e2baf2a08d8fb5c406b39

SHA256
d2fcd88c3c229993771ed475d9d9deffd9714da0f9e4a7b829131d7f7393880e

SHA512
ef40483967e4e8c91b5db4e9b7893c6be5e3f7448cd3be402fba34370a6f599de7e75d2508ff6e33896e5be2ed07a6f3b2a63990d1fca579e2c5cf22f139927f

Download Submit
memory/2192-14-0x000000001BF50000-0x000000001BF58000-memory.dmp

Filesize
32KB

Download
memory/2192-10-0x000000001B6F0000-0x000000001B6FC000-memory.dmp

Filesize
48KB

Download
memory/2192-17-0x000000001BF70000-0x000000001BF7C000-memory.dmp

Filesize
48KB

Download
memory/2192-15-0x000000001BF60000-0x000000001BF68000-memory.dmp

Filesize
32KB

Download
memory/2192-16-0x000000001C070000-0x000000001C07A000-memory.dmp

Filesize
40KB

Download
memory/2192-12-0x000000001B770000-0x000000001B77A000-memory.dmp

Filesize
40KB

Download
memory/2192-11-0x000000001B760000-0x000000001B76C000-memory.dmp

Filesize
48KB

Download
memory/2192-272-0x00007FFD9A9F0000-0x00007FFD9B4B1000-memory.dmp

Filesize
10.8MB

Download
memory/2192-9-0x000000001B6E0000-0x000000001B6E8000-memory.dmp

Filesize
32KB

Download
memory/2192-13-0x000000001BF40000-0x000000001BF4E000-memory.dmp

Filesize
56KB

Download
memory/2192-8-0x000000001B700000-0x000000001B710000-memory.dmp

Filesize
64KB

Download
memory/2192-6-0x000000001B6C0000-0x000000001B6D6000-memory.dmp

Filesize
88KB

Download
memory/2192-7-0x000000001B5A0000-0x000000001B5A8000-memory.dmp

Filesize
32KB

Download
memory/2192-4-0x000000001B710000-0x000000001B760000-memory.dmp

Filesize
320KB

Download
memory/2192-1-0x00000000008E0000-0x0000000000A82000-memory.dmp

Filesize
1.6MB

Download
memory/2192-5-0x000000001B590000-0x000000001B5A0000-memory.dmp

Filesize
64KB

Download
memory/2192-3-0x000000001B570000-0x000000001B58C000-memory.dmp

Filesize
112KB

Download
memory/2192-0-0x00007FFD9A9F3000-0x00007FFD9A9F5000-memory.dmp

Filesize
8KB

Download
memory/2192-2-0x00007FFD9A9F0000-0x00007FFD9B4B1000-memory.dmp

Filesize
10.8MB

Download
memory/4688-188-0x00000190F5200000-0x00000190F5222000-memory.dmp

Filesize
136KB

Download