dcrat | 3c5d4007aabc7835b586d15313645af2e823dfad1d487cad46453dc3474e2693

Analysis

max time kernel
150s
max time network
157s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
22/03/2025, 20:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
Size 1.6MB
Sample250322-zaqppszvbx
SHA256 86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12
MD5 522b3cc9b8e0565c5a2eb2d40b7a9513
SHA1 86d71ba007afecc0f28e9815086992099a13f2c4
SHA512 a22e86028dc923064c045563341d3c144f9d3473935c8ebecf54e2a6ab4afb5b21d2cc0a80f92dc96ceb294dbbf2a33ebc48122079acb62f9ec140230e3e6c73
SSDEEP 24576:qsm8JijftfWIqZpyh/X6bSmV2GKz1oncoiF9GFwUvpHk3tSfEybcswrJ4gOEGEk:qD8Jijt+xpS/ekYmLGdhEAf7bCcjE
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 42 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2804	2808	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2948	2808	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2080	2808	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2840	2808	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2876	2808	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2408	2808	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2660	2808	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2604	2808	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2640	2808	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3024	2808	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2060	2808	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1640	2808	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1796	2808	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2432	2808	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2512	2808	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1372	2808	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1324	2808	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1360	2808	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1696	2808	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1924	2808	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1980	2808	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1172	2808	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2648	2808	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	996	2808	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1256	2808	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2068	2808	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1104	2808	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2076	2808	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1572	2808	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2028	2808	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2788	2808	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2928	2808	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	652	2808	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1656	2808	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	940	2808	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1960	2808	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2220	2808	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1748	2808	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1028	2808	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1004	2808	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1824	2808	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	920	2808	schtasks.exe	30

DCRat payload 7 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral25/memory/2092-1-0x0000000000F70000-0x0000000001112000-memory.dmp	dcrat
behavioral25/files/0x000500000001a4c3-25.dat	dcrat
behavioral25/memory/908-302-0x00000000001B0000-0x0000000000352000-memory.dmp	dcrat
behavioral25/memory/2508-313-0x00000000002E0000-0x0000000000482000-memory.dmp	dcrat
behavioral25/memory/3068-325-0x0000000000B40000-0x0000000000CE2000-memory.dmp	dcrat
behavioral25/memory/568-337-0x0000000001370000-0x0000000001512000-memory.dmp	dcrat
behavioral25/memory/2824-393-0x00000000003C0000-0x0000000000562000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 15 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
608	powershell.exe
2060	powershell.exe
1976	powershell.exe
2516	powershell.exe
2496	powershell.exe
2668	powershell.exe
2708	powershell.exe
1796	powershell.exe
2392	powershell.exe
2032	powershell.exe
2432	powershell.exe
1296	powershell.exe
2672	powershell.exe
1696	powershell.exe
2088	powershell.exe

Executes dropped EXE 9 IoCs

pid	Process
908	Idle.exe
2508	Idle.exe
3068	Idle.exe
568	Idle.exe
1148	Idle.exe
2680	Idle.exe
1500	Idle.exe
2016	Idle.exe
2824	Idle.exe

Drops file in Program Files directory 15 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Media Player\ja-JP\winlogon.exe	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
File created	C:\Program Files (x86)\Windows Media Player\ja-JP\cc11b995f2a76d	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
File created	C:\Program Files (x86)\Microsoft Office\Stationery\1033\6ccacd8608530f	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\RCXE7C5.tmp	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\audiodg.exe	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\42af1c969fbb7b	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\RCXE7C4.tmp	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\ja-JP\RCXEE40.tmp	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Stationery\1033\RCXFD5B.tmp	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Stationery\1033\RCXFD5C.tmp	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\audiodg.exe	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\ja-JP\RCXEE41.tmp	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\ja-JP\winlogon.exe	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Stationery\1033\Idle.exe	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
File created	C:\Program Files (x86)\Microsoft Office\Stationery\1033\Idle.exe	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe

Drops file in Windows directory 26 IoCs

description	ioc	Process
File created	C:\Windows\Offline Web Pages\WmiPrvSE.exe	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
File created	C:\Windows\Branding\ShellBrd\6cb0b6c459d5d3	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
File opened for modification	C:\Windows\Offline Web Pages\RCXE5C0.tmp	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
File opened for modification	C:\Windows\Help\Windows\ja-JP\RCXF0B2.tmp	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
File opened for modification	C:\Windows\Help\Windows\ja-JP\WmiPrvSE.exe	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
File opened for modification	C:\Windows\Resources\Themes\Aero\en-US\RCXF2C7.tmp	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
File opened for modification	C:\Windows\Resources\Themes\Aero\en-US\winlogon.exe	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
File created	C:\Windows\Offline Web Pages\24dbde2999530e	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
File created	C:\Windows\Help\Windows\ja-JP\24dbde2999530e	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
File created	C:\Windows\Resources\Themes\Aero\en-US\winlogon.exe	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
File created	C:\Windows\Resources\Themes\Aero\en-US\cc11b995f2a76d	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
File created	C:\Windows\Branding\ShellBrd\dwm.exe	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
File created	C:\Windows\addins\System.exe	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
File opened for modification	C:\Windows\addins\RCX164.tmp	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
File opened for modification	C:\Windows\addins\RCX165.tmp	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-m..c-oracle-driver-dll_31bf3856ad364e35_6.1.7601.17514_none_6b16a37ea1353bb1\Idle.exe	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
File opened for modification	C:\Windows\Offline Web Pages\WmiPrvSE.exe	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
File created	C:\Windows\Help\Windows\ja-JP\WmiPrvSE.exe	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
File opened for modification	C:\Windows\Help\Windows\ja-JP\RCXF0B3.tmp	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
File opened for modification	C:\Windows\Resources\Themes\Aero\en-US\RCXF2C6.tmp	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
File opened for modification	C:\Windows\Branding\ShellBrd\RCXF73D.tmp	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
File opened for modification	C:\Windows\Branding\ShellBrd\RCXF73E.tmp	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
File created	C:\Windows\addins\27d1bcfc3c54e0	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
File opened for modification	C:\Windows\Offline Web Pages\RCXE5BF.tmp	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
File opened for modification	C:\Windows\Branding\ShellBrd\dwm.exe	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
File opened for modification	C:\Windows\addins\System.exe	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 42 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2080	schtasks.exe
2840	schtasks.exe
1372	schtasks.exe
1696	schtasks.exe
2220	schtasks.exe
1028	schtasks.exe
2804	schtasks.exe
2876	schtasks.exe
2060	schtasks.exe
1256	schtasks.exe
1104	schtasks.exe
2788	schtasks.exe
940	schtasks.exe
1960	schtasks.exe
2948	schtasks.exe
2432	schtasks.exe
2068	schtasks.exe
652	schtasks.exe
1004	schtasks.exe
920	schtasks.exe
3024	schtasks.exe
1640	schtasks.exe
1324	schtasks.exe
1360	schtasks.exe
1572	schtasks.exe
1656	schtasks.exe
1980	schtasks.exe
996	schtasks.exe
1824	schtasks.exe
2512	schtasks.exe
2648	schtasks.exe
2028	schtasks.exe
2408	schtasks.exe
2660	schtasks.exe
2640	schtasks.exe
1796	schtasks.exe
2928	schtasks.exe
1748	schtasks.exe
2604	schtasks.exe
1924	schtasks.exe
1172	schtasks.exe
2076	schtasks.exe

Suspicious behavior: EnumeratesProcesses 29 IoCs

pid	Process
2092	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
2092	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
2092	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
2092	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
2092	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
2088	powershell.exe
608	powershell.exe
2496	powershell.exe
2392	powershell.exe
2708	powershell.exe
1976	powershell.exe
1696	powershell.exe
2668	powershell.exe
1296	powershell.exe
2032	powershell.exe
2060	powershell.exe
2516	powershell.exe
2672	powershell.exe
2432	powershell.exe
1796	powershell.exe
908	Idle.exe
2508	Idle.exe
3068	Idle.exe
568	Idle.exe
1148	Idle.exe
2680	Idle.exe
1500	Idle.exe
2016	Idle.exe
2824	Idle.exe

Suspicious use of AdjustPrivilegeToken 25 IoCs

description	pid	Process
Token: SeDebugPrivilege	2092	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
Token: SeDebugPrivilege	2088	powershell.exe
Token: SeDebugPrivilege	608	powershell.exe
Token: SeDebugPrivilege	2496	powershell.exe
Token: SeDebugPrivilege	2392	powershell.exe
Token: SeDebugPrivilege	2708	powershell.exe
Token: SeDebugPrivilege	1976	powershell.exe
Token: SeDebugPrivilege	1696	powershell.exe
Token: SeDebugPrivilege	2668	powershell.exe
Token: SeDebugPrivilege	1296	powershell.exe
Token: SeDebugPrivilege	2032	powershell.exe
Token: SeDebugPrivilege	2060	powershell.exe
Token: SeDebugPrivilege	2672	powershell.exe
Token: SeDebugPrivilege	2516	powershell.exe
Token: SeDebugPrivilege	2432	powershell.exe
Token: SeDebugPrivilege	1796	powershell.exe
Token: SeDebugPrivilege	908	Idle.exe
Token: SeDebugPrivilege	2508	Idle.exe
Token: SeDebugPrivilege	3068	Idle.exe
Token: SeDebugPrivilege	568	Idle.exe
Token: SeDebugPrivilege	1148	Idle.exe
Token: SeDebugPrivilege	2680	Idle.exe
Token: SeDebugPrivilege	1500	Idle.exe
Token: SeDebugPrivilege	2016	Idle.exe
Token: SeDebugPrivilege	2824	Idle.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 2032	2092	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe	74
PID 2092 wrote to memory of 2032	2092	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe	74
PID 2092 wrote to memory of 2032	2092	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe	74
PID 2092 wrote to memory of 2432	2092	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe	75
PID 2092 wrote to memory of 2432	2092	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe	75
PID 2092 wrote to memory of 2432	2092	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe	75
PID 2092 wrote to memory of 2708	2092	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe	76
PID 2092 wrote to memory of 2708	2092	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe	76
PID 2092 wrote to memory of 2708	2092	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe	76
PID 2092 wrote to memory of 1296	2092	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe	77
PID 2092 wrote to memory of 1296	2092	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe	77
PID 2092 wrote to memory of 1296	2092	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe	77
PID 2092 wrote to memory of 1796	2092	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe	78
PID 2092 wrote to memory of 1796	2092	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe	78
PID 2092 wrote to memory of 1796	2092	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe	78
PID 2092 wrote to memory of 2668	2092	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe	80
PID 2092 wrote to memory of 2668	2092	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe	80
PID 2092 wrote to memory of 2668	2092	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe	80
PID 2092 wrote to memory of 2672	2092	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe	81
PID 2092 wrote to memory of 2672	2092	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe	81
PID 2092 wrote to memory of 2672	2092	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe	81
PID 2092 wrote to memory of 608	2092	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe	82
PID 2092 wrote to memory of 608	2092	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe	82
PID 2092 wrote to memory of 608	2092	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe	82
PID 2092 wrote to memory of 2392	2092	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe	84
PID 2092 wrote to memory of 2392	2092	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe	84
PID 2092 wrote to memory of 2392	2092	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe	84
PID 2092 wrote to memory of 2060	2092	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe	85
PID 2092 wrote to memory of 2060	2092	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe	85
PID 2092 wrote to memory of 2060	2092	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe	85
PID 2092 wrote to memory of 2496	2092	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe	86
PID 2092 wrote to memory of 2496	2092	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe	86
PID 2092 wrote to memory of 2496	2092	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe	86
PID 2092 wrote to memory of 2088	2092	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe	88
PID 2092 wrote to memory of 2088	2092	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe	88
PID 2092 wrote to memory of 2088	2092	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe	88
PID 2092 wrote to memory of 2516	2092	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe	90
PID 2092 wrote to memory of 2516	2092	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe	90
PID 2092 wrote to memory of 2516	2092	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe	90
PID 2092 wrote to memory of 1696	2092	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe	91
PID 2092 wrote to memory of 1696	2092	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe	91
PID 2092 wrote to memory of 1696	2092	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe	91
PID 2092 wrote to memory of 1976	2092	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe	92
PID 2092 wrote to memory of 1976	2092	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe	92
PID 2092 wrote to memory of 1976	2092	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe	92
PID 2092 wrote to memory of 576	2092	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe	104
PID 2092 wrote to memory of 576	2092	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe	104
PID 2092 wrote to memory of 576	2092	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe	104
PID 576 wrote to memory of 2000	576	cmd.exe	106
PID 576 wrote to memory of 2000	576	cmd.exe	106
PID 576 wrote to memory of 2000	576	cmd.exe	106
PID 576 wrote to memory of 908	576	cmd.exe	107
PID 576 wrote to memory of 908	576	cmd.exe	107
PID 576 wrote to memory of 908	576	cmd.exe	107
PID 908 wrote to memory of 1908	908	Idle.exe	108
PID 908 wrote to memory of 1908	908	Idle.exe	108
PID 908 wrote to memory of 1908	908	Idle.exe	108
PID 908 wrote to memory of 1988	908	Idle.exe	109
PID 908 wrote to memory of 1988	908	Idle.exe	109
PID 908 wrote to memory of 1988	908	Idle.exe	109
PID 1908 wrote to memory of 2508	1908	WScript.exe	110
PID 1908 wrote to memory of 2508	1908	WScript.exe	110
PID 1908 wrote to memory of 2508	1908	WScript.exe	110
PID 2508 wrote to memory of 2236	2508	Idle.exe	111

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
"C:\Users\Admin\AppData\Local\Temp\86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe"
1⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2032
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Offline Web Pages\WmiPrvSE.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2432
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\audiodg.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2708
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1296
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Favorites\taskhost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1796
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Media Player\ja-JP\winlogon.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2668
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Help\Windows\ja-JP\WmiPrvSE.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2672
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Resources\Themes\Aero\en-US\winlogon.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:608
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\spoolsv.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2392
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Branding\ShellBrd\dwm.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2060
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\taskhost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2496
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\explorer.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2088
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft Office\Stationery\1033\Idle.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2516
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\Idle.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1696
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\addins\System.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1976
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\bbUpz34cjT.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:576
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:2000
- - C:\Program Files (x86)\Microsoft Office\Stationery\1033\Idle.exe
    "C:\Program Files (x86)\Microsoft Office\Stationery\1033\Idle.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:908
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\beedb7a3-f8b0-4626-8483-b9bf45465ec8.vbs"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1908
    - - C:\Program Files (x86)\Microsoft Office\Stationery\1033\Idle.exe
        
        "C:\Program Files (x86)\Microsoft Office\Stationery\1033\Idle.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2508
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\dd5becf3-2792-4fc7-9fcb-4240c93d98ad.vbs"
        6⤵
        
        PID:2236
        
        C:\Program Files (x86)\Microsoft Office\Stationery\1033\Idle.exe
        
        "C:\Program Files (x86)\Microsoft Office\Stationery\1033\Idle.exe"
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3068
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4202e37c-413d-4ef2-85ae-b34b3a18786e.vbs"
        8⤵
        
        PID:2840
        
        C:\Program Files (x86)\Microsoft Office\Stationery\1033\Idle.exe
        
        "C:\Program Files (x86)\Microsoft Office\Stationery\1033\Idle.exe"
        9⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:568
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\dc1f9ba5-98fd-4bb8-b78d-e7ff67e91154.vbs"
        10⤵
        
        PID:2040
        
        C:\Program Files (x86)\Microsoft Office\Stationery\1033\Idle.exe
        
        "C:\Program Files (x86)\Microsoft Office\Stationery\1033\Idle.exe"
        11⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1148
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b56e66b9-5ec8-4427-83d7-f88e2eceedc3.vbs"
        12⤵
        
        PID:1960
        
        C:\Program Files (x86)\Microsoft Office\Stationery\1033\Idle.exe
        
        "C:\Program Files (x86)\Microsoft Office\Stationery\1033\Idle.exe"
        13⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2680
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c52b4a04-47a8-4151-b9db-39226bca58cb.vbs"
        14⤵
        
        PID:3040
        
        C:\Program Files (x86)\Microsoft Office\Stationery\1033\Idle.exe
        
        "C:\Program Files (x86)\Microsoft Office\Stationery\1033\Idle.exe"
        15⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1500
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b5be986b-d9ea-4fa2-9017-4a80250bb547.vbs"
        16⤵
        
        PID:1232
        
        C:\Program Files (x86)\Microsoft Office\Stationery\1033\Idle.exe
        
        "C:\Program Files (x86)\Microsoft Office\Stationery\1033\Idle.exe"
        17⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2016
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5de22180-b86a-4e65-9953-65681004cbb3.vbs"
        18⤵
        
        PID:2684
        
        C:\Program Files (x86)\Microsoft Office\Stationery\1033\Idle.exe
        
        "C:\Program Files (x86)\Microsoft Office\Stationery\1033\Idle.exe"
        19⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2824
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d1342715-ff4e-4ed9-9ca1-b765b996f532.vbs"
        20⤵
        
        PID:1516
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9f07b36d-6070-429f-a8f6-087f5f27bc1b.vbs"
        20⤵
        
        PID:1408
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6d2b3fe0-96cb-40a2-978d-ac05897e6c05.vbs"
        18⤵
        
        PID:2968
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9d0c6a50-b656-4eee-9ab8-586c2ee6c186.vbs"
        16⤵
        
        PID:2992
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e6b32b79-5c23-4b03-9b8f-3316215bc91d.vbs"
        14⤵
        
        PID:1992
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\08bd0131-edd6-4ae3-a06a-81dea0f99b08.vbs"
        12⤵
        
        PID:1312
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b20c6a3f-2390-4697-a211-34b8ea0c7fb6.vbs"
        10⤵
        
        PID:2500
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\050cda2a-67ce-4fa8-a319-0ee492972eb1.vbs"
        8⤵
        
        PID:1892
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e9af472d-6886-4b5c-a33a-3388668c35f7.vbs"
        6⤵
        
        PID:2160
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a2d0c7ac-222c-4298-a72c-a801ca0576db.vbs"
      4⤵
      PID:1988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 9 /tr "'C:\Windows\Offline Web Pages\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Windows\Offline Web Pages\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 12 /tr "'C:\Windows\Offline Web Pages\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac128" /sc MINUTE /mo 11 /tr "'C:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12" /sc ONLOGON /tr "'C:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac128" /sc MINUTE /mo 12 /tr "'C:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 7 /tr "'C:\Users\Default\Favorites\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Users\Default\Favorites\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 10 /tr "'C:\Users\Default\Favorites\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Media Player\ja-JP\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\ja-JP\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Media Player\ja-JP\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 12 /tr "'C:\Windows\Help\Windows\ja-JP\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Windows\Help\Windows\ja-JP\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 8 /tr "'C:\Windows\Help\Windows\ja-JP\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 11 /tr "'C:\Windows\Resources\Themes\Aero\en-US\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\Resources\Themes\Aero\en-US\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\Windows\Resources\Themes\Aero\en-US\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1172

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 11 /tr "'C:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 14 /tr "'C:\Windows\Branding\ShellBrd\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1256

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\Branding\ShellBrd\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 7 /tr "'C:\Windows\Branding\ShellBrd\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2788

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Microsoft Office\Stationery\1033\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Office\Stationery\1033\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Microsoft Office\Stationery\1033\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 10 /tr "'C:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 11 /tr "'C:\Windows\addins\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Windows\addins\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 7 /tr "'C:\Windows\addins\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

winlogon.exe

Path C:\Program Files (x86)\Windows Media Player\ja-JP\winlogon.exe
Size 1.6MB
SHA256 86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12
MD5 522b3cc9b8e0565c5a2eb2d40b7a9513
SHA1 86d71ba007afecc0f28e9815086992099a13f2c4
SHA512 a22e86028dc923064c045563341d3c144f9d3473935c8ebecf54e2a6ab4afb5b21d2cc0a80f92dc96ceb294dbbf2a33ebc48122079acb62f9ec140230e3e6c73
SSDEEP 24576:qsm8JijftfWIqZpyh/X6bSmV2GKz1oncoiF9GFwUvpHk3tSfEybcswrJ4gOEGEk:qD8Jijt+xpS/ekYmLGdhEAf7bCcjE
MD5 SHA1 SHA512 SSDEEP

Submit Download

4202e37c-413d-4ef2-85ae-b34b3a18786e.vbs

Path C:\Users\Admin\AppData\Local\Temp\4202e37c-413d-4ef2-85ae-b34b3a18786e.vbs
Size 740B
SHA256 5d208e7fdfe7be11549b65f72b63cb53a371313c64d43e3655b759d9cffda841
MD5 cdd8d10332afdaeb8b8c6f8fc13b2432
SHA1 97a85ade26cc5ebd279166cda46ff934b4a4ed3c
SHA512 8acd8ecba95a22594e35b10e78d519b703c81a0de5aff31bd417dfa14cb64cf762ddc9cc74b1ce78b18b59bb68110dcbe4eb1356933e062469ddb717bae549f6
MD5 SHA1 SHA512

Submit Download

5de22180-b86a-4e65-9953-65681004cbb3.vbs

Path C:\Users\Admin\AppData\Local\Temp\5de22180-b86a-4e65-9953-65681004cbb3.vbs
Size 740B
SHA256 d823a2a91ba73cdf428efbbe29fa64bfcff6f4dc5ccb3f9723f68ddd640fa1d4
MD5 cff4f1e88ca804298e31497e36461d74
SHA1 174b4de52bcda0d67bd1372bec82f855ead65055
SHA512 170f35b323dfeddb022f570a21db4df0fb994e29e5adff3dead09154e060d83317ffa3dc8f29c6ea72963353714ded2ce0b7947d6bfa645bc9d6c5af5b4fd7a8
MD5 SHA1 SHA512

Submit Download

a2d0c7ac-222c-4298-a72c-a801ca0576db.vbs

Path C:\Users\Admin\AppData\Local\Temp\a2d0c7ac-222c-4298-a72c-a801ca0576db.vbs
Size 516B
SHA256 7a3f98a8fc31d87929c77065597b85e081ec369e3b64204329ed52f663aaa1ed
MD5 43085b3b580f7933b3e60b41272125c4
SHA1 67dc96bd04db917458bfc5eaf8c08ec1ae63c062
SHA512 03666ccbbf8f410fe74790e0d06a1e529e6c19db1bc27659a40a4495d3dade1266b9ca9e3514d69ad9e9389eb471c581e68c96098932aa63c4ea848ec7dc5eb9
MD5 SHA1 SHA512

Submit Download

b56e66b9-5ec8-4427-83d7-f88e2eceedc3.vbs

Path C:\Users\Admin\AppData\Local\Temp\b56e66b9-5ec8-4427-83d7-f88e2eceedc3.vbs
Size 740B
SHA256 f525ac12f71b4e00fc28bb85c927c1beb5957d49d714355f499eb17caf366a55
MD5 411010f0a43d68481f065c4a7ae08e78
SHA1 19739522ff4aaf9cc39ee64c6358d7e4d2b77fa8
SHA512 dd65d9d046ed3f52d720ee614096ad53921607e99ecfee2c0318ef819de8460580aba5b90efa38b3177b28392d8f616ea39ed1372f4c3bead9d1099b7b7fe8dd
MD5 SHA1 SHA512

Submit Download

b5be986b-d9ea-4fa2-9017-4a80250bb547.vbs

Path C:\Users\Admin\AppData\Local\Temp\b5be986b-d9ea-4fa2-9017-4a80250bb547.vbs
Size 740B
SHA256 9834bdf10b43b9481d6d8525415391a439554ed89125cc0ddf011aa621f32520
MD5 9e3675971e838704f58be7a7bd07a49e
SHA1 a70589ffaa22e29fb58573564edcb235372df138
SHA512 1056f1edecfab6019820ed54503c883ddedae55fbb3e58dc1140436d9e86690ca130249400225443e72a2119469a104443c5f0b48e86ad74a7268b4ffbc5cb0a
MD5 SHA1 SHA512

Submit Download

bbUpz34cjT.bat

Path C:\Users\Admin\AppData\Local\Temp\bbUpz34cjT.bat
Size 229B
SHA256 044976c5a19295de390169427a8990134d30232848571d5ae1c87af082ca0594
MD5 eac49232b348b5c30d98d6c906df4662
SHA1 99464161a54c175d6f5da6abe901a657ddc72360
SHA512 629ba0d28cebfc8dd2da07290e4a10f16342ac6d13991c28a548248795e618f9ebb5531e939fada362acca4d825109db4d930ae56a3871ca18455afec1701f09
MD5 SHA1 SHA512

Submit Download

beedb7a3-f8b0-4626-8483-b9bf45465ec8.vbs

Path C:\Users\Admin\AppData\Local\Temp\beedb7a3-f8b0-4626-8483-b9bf45465ec8.vbs
Size 739B
SHA256 66db115b539cf88441ae51567259bcb8b178c7d618e53f404d7c466b0aac285f
MD5 673aed291f4ac9e427c9e7ff0b68a67f
SHA1 7cb44c0e3e81f4890a42266eba0b516323465ccc
SHA512 7bd108bb42f575ae7edb274c059cf05faa145caf77b6185ef8d8d273854a21ba002eeec3f7eeb8c140340eb738f01d45f2b5c934ff4ec91fdd3b011e80f65ff8
MD5 SHA1 SHA512

Submit Download

c52b4a04-47a8-4151-b9db-39226bca58cb.vbs

Path C:\Users\Admin\AppData\Local\Temp\c52b4a04-47a8-4151-b9db-39226bca58cb.vbs
Size 740B
SHA256 753575319a9569127200f0eacb5ab2822a4131c7fa44ed19ebf172db845d6eeb
MD5 bfa35e95299af4d70d8f5f720a2ef447
SHA1 c730786d672fe0db30b3942a8782c02840cd9c4d
SHA512 790c37989daca73f3ddcb2df8844b0e6be8068d96e97788e61727e4379792949e6be1798a06e8709aff1691961c6f0b525cdd8c26c710a9767086546b57b0fe0
MD5 SHA1 SHA512

Submit Download

d1342715-ff4e-4ed9-9ca1-b765b996f532.vbs

Path C:\Users\Admin\AppData\Local\Temp\d1342715-ff4e-4ed9-9ca1-b765b996f532.vbs
Size 740B
SHA256 398bd795f7c526d1a529da40240162d24010910a96c45407fc46005273d275d1
MD5 973c5abcfdf3d1fd5fecbf582e8b69f6
SHA1 fd9cd55009d817efda331c2c1abd9c8f6f39a534
SHA512 6c5feff39746cf9a5e3894a091be0ae58a65f67cecde7d5afb48584bf44ae78cd8ea02df638ebf82ba2b9999dd9186144f9cdb81769528b3c752bc3f6269ad1e
MD5 SHA1 SHA512

Submit Download

dc1f9ba5-98fd-4bb8-b78d-e7ff67e91154.vbs

Path C:\Users\Admin\AppData\Local\Temp\dc1f9ba5-98fd-4bb8-b78d-e7ff67e91154.vbs
Size 739B
SHA256 94c1df71ddb287044be38b1a6d8cf4c188dd27b41d50cb56a0daac75f1d27d9b
MD5 8fa15053d67ba714a554c935afb1251e
SHA1 127e9f43b061d2be23249f84ac78e03eeaef180d
SHA512 40aa2ccee0130684dd27dcbe779c971626632fb299d78afed0d9838fd6d06c5689b5fb402f981e6e7c97f40f8008c41f26fad3293d12eb38c135a5d36128cda8
MD5 SHA1 SHA512

Submit Download

dd5becf3-2792-4fc7-9fcb-4240c93d98ad.vbs

Path C:\Users\Admin\AppData\Local\Temp\dd5becf3-2792-4fc7-9fcb-4240c93d98ad.vbs
Size 740B
SHA256 9f6f94e9f8bde38d9c816a338c67bf595f8d567fd624055509e61b9f1745fd66
MD5 9d0380477706fe23e6a8ea8e9523c878
SHA1 8bf385837c432c4757e56157d44334cc5640f4c5
SHA512 1a36b0a15e1fd168e8d4b6fb2635afa6f97c129142778664f66d818466f1cb63387c387992bbdceb2321e210212f54b6d42ab2f7a62b352bee3cf79c570f710d
MD5 SHA1 SHA512

Submit Download

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 7KB
SHA256 3d4a4bffe05e85ad018aaac79d557a96134fac65d77dc01c8c0d81c5498ccead
MD5 048d12e8b64e598e70d65d2cf69cc850
SHA1 8b4445930fc52807ea8eaccb8a11edefa2590d2b
SHA512 e7d3af2f08562e43517cc4eb9cd45f7bec54b476f102ac208ef09ffc2c1cb7d17e22969672b2f23e8b71ee48d1be1bcd3f60ffd84bc48055fefd2c5ddd0ec866
SSDEEP 96:0peCdM8TnqvsqvJCwowhqpeCdM8TnqvsEHyqvJCworKh9dolQHOH7CxXlUVS:UbvUowhubvAHnorKh9EPH7Cx1
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/568-337-0x0000000001370000-0x0000000001512000-memory.dmp

Download

memory/908-302-0x00000000001B0000-0x0000000000352000-memory.dmp

Download

memory/2088-226-0x000000001B700000-0x000000001B9E2000-memory.dmp

Download

memory/2088-227-0x0000000002960000-0x0000000002968000-memory.dmp

Download

memory/2092-239-0x000007FEF50B0000-0x000007FEF5A9C000-memory.dmp

Download

memory/2092-6-0x0000000000390000-0x0000000000398000-memory.dmp

Download

memory/2092-168-0x000007FEF50B0000-0x000007FEF5A9C000-memory.dmp

Download

memory/2092-0-0x000007FEF50B3000-0x000007FEF50B4000-memory.dmp

Download

memory/2092-16-0x0000000000D70000-0x0000000000D7C000-memory.dmp

Download

memory/2092-15-0x00000000006B0000-0x00000000006BA000-memory.dmp

Download

memory/2092-11-0x0000000000670000-0x000000000067A000-memory.dmp

Download

memory/2092-12-0x0000000000680000-0x000000000068E000-memory.dmp

Download

memory/2092-13-0x0000000000690000-0x0000000000698000-memory.dmp

Download

memory/2092-14-0x00000000006A0000-0x00000000006A8000-memory.dmp

Download

memory/2092-10-0x0000000000660000-0x000000000066C000-memory.dmp

Download

memory/2092-1-0x0000000000F70000-0x0000000001112000-memory.dmp

Download

memory/2092-9-0x00000000003C0000-0x00000000003CC000-memory.dmp

Download

memory/2092-2-0x000007FEF50B0000-0x000007FEF5A9C000-memory.dmp

Download

memory/2092-8-0x00000000003B0000-0x00000000003B8000-memory.dmp

Download

memory/2092-7-0x00000000003A0000-0x00000000003B0000-memory.dmp

Download

memory/2092-143-0x000007FEF50B3000-0x000007FEF50B4000-memory.dmp

Download

memory/2092-5-0x00000000001F0000-0x0000000000206000-memory.dmp

Download

memory/2092-4-0x0000000000160000-0x0000000000170000-memory.dmp

Download

memory/2092-3-0x0000000000140000-0x000000000015C000-memory.dmp

Download

memory/2508-313-0x00000000002E0000-0x0000000000482000-memory.dmp

Download

memory/2824-393-0x00000000003C0000-0x0000000000562000-memory.dmp

Download

memory/3068-325-0x0000000000B40000-0x0000000000CE2000-memory.dmp

Download