dcrat | 1591688ee44d114c7dbc24e6621dc072bcd7faa6d067f16ee6fd81b107f9f58d

Analysis

max time kernel
900s
max time network
901s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 03:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cs22.exe
Size 1.4MB
Sample260808-dh733a11bv
SHA256 1591688ee44d114c7dbc24e6621dc072bcd7faa6d067f16ee6fd81b107f9f58d
MD5 4b4a136229da0ebb5797ae5f1cefe92f
SHA1 23255f02d3754f71a51a6c9b49c37e508426aafa
SHA512 582f6eadc30af49478a49c1bb125ae66e8c811791f6d8438d315584483b3bed6fcec6234fa29fdaaa42f0adcb7d2a9899f36ceab6c47e7bba3686583f069e0e5
SSDEEP 24576:u2G/nvxW3WieCz8wiB1WHJM+KtldePVko5++DxhVEu8:ubA3jzoULKtldZ7+DxhV+
TLSH
T13D657B017E40CA11F0191633C3EF4A8457B4ED21AAA6E72B7DB93B6D59123937D0DACB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution dcrat infostealer persistence rat

Malware Config

Signatures

Family: DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x000d00000001c4c6-12.dat	dcrat
behavioral2/memory/5268-14-0x0000000000FA0000-0x00000000010C2000-memory.dmp	dcrat

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe"	fontdrvhost.exe

Process spawned unexpected child process 64 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4664	3860	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5084	3860	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2804	3860	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2700	3860	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	696	3860	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5196	3860	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1980	3860	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5876	3860	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3168	3860	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4712	3860	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1968	3860	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	472	3860	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3808	3860	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4920	3860	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4608	3860	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1176	3860	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	572	3860	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2384	3860	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3040	3860	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3536	3860	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1600	3860	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	928	3860	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5004	3860	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5412	3860	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3896	3860	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4092	3860	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5968	3860	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5088	3860	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1436	3860	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4672	3860	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4624	3860	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1092	3860	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2460	3860	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1812	3860	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5184	3860	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5652	3860	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5160	3860	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4860	3860	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2376	3860	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2804	3860	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2700	3860	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4892	3860	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	472	3860	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5996	3860	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3808	3860	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4072	3860	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4552	3860	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1600	3860	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3496	2560	schtasks.exe	182
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1912	2560	schtasks.exe	182
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1692	2560	schtasks.exe	182
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4312	2560	schtasks.exe	182
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4500	2560	schtasks.exe	182
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2804	2560	schtasks.exe	182
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5828	2560	schtasks.exe	182
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3740	2560	schtasks.exe	182
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1728	2560	schtasks.exe	182
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5884	2560	schtasks.exe	182
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4788	2560	schtasks.exe	182
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2844	2560	schtasks.exe	182
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1984	2560	schtasks.exe	182
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4284	2560	schtasks.exe	182
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3988	2560	schtasks.exe	182
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2368	2560	schtasks.exe	182

Executes dropped EXE 33 IoCs

pid	Process
5268	Chainperfnet.exe
5800	spoolsv.exe
3012	smss.exe
4944	cmd.exe
2480	Registry.exe
1740	upfc.exe
2260	smss.exe
1588	lsass.exe
4380	SecurityHealthService.exe
5288	WUDFHost.exe
1012	csrss.exe
3128	fontdrvhost.exe
4324	System.exe
4920	spoolsv.exe
572	lsass.exe
2420	SearchHost.exe
1644	RuntimeBroker.exe
5084	spoolsv.exe
1868	fontdrvhost.exe
4484	spoolsv.exe
2908	SearchHost.exe
2036	Registry.exe
1692	upfc.exe
4592	lsass.exe
2348	cmd.exe
3728	System.exe
2932	SecurityHealthService.exe
4576	csrss.exe
3676	RuntimeBroker.exe
2944	WUDFHost.exe
2964	spoolsv.exe
3416	SearchHost.exe
4356	smss.exe

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ipinfo.io
10	ipinfo.io

Executes a VBScript file via the Windows Script Host. 1 TTPs 3 IoCs

execution

Visual Basic

T1059.005

pid	Process
2332	WScript.exe
3864	WScript.exe
3904	WScript.exe

SmartAssembly .NET packer 1 IoCs

Detects SmartAssembly .NET packer.

resource	yara_rule
behavioral2/memory/5268-18-0x00000000032E0000-0x00000000032EA000-memory.dmp	SmartAssembly

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Media Player\Skins\smss.exe	Chainperfnet.exe
File created	C:\Program Files (x86)\Windows NT\TableTextService\en-US\System.exe	Chainperfnet.exe
File created	C:\Program Files (x86)\Windows NT\TableTextService\en-US\27d1bcfc3c54e0	Chainperfnet.exe
File created	C:\Program Files (x86)\Microsoft\6203df4a6bafc7	Chainperfnet.exe
File created	C:\Program Files\VideoLAN\ebf1f9fa8afd6d	Chainperfnet.exe
File created	C:\Program Files (x86)\Windows Media Player\Skins\69ddcba757bf72	Chainperfnet.exe
File created	C:\Program Files (x86)\Microsoft\lsass.exe	Chainperfnet.exe
File created	C:\Program Files\VideoLAN\VLC\skins\RuntimeBroker.exe	Chainperfnet.exe
File created	C:\Program Files\VideoLAN\VLC\skins\9e8d7a4ca61bd9	Chainperfnet.exe
File created	C:\Program Files\VideoLAN\cmd.exe	Chainperfnet.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\apppatch\fr-FR\spoolsv.exe	Chainperfnet.exe
File created	C:\Windows\apppatch\fr-FR\f3b6ecef712a24	Chainperfnet.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3300	cmd.exe
2936	cmd.exe
2712	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cs22.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings	cs22.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings	Chainperfnet.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 48 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2700	schtasks.exe
696	schtasks.exe
3168	schtasks.exe
4608	schtasks.exe
1176	schtasks.exe
3536	schtasks.exe
5084	schtasks.exe
1968	schtasks.exe
5004	schtasks.exe
3896	schtasks.exe
5968	schtasks.exe
1092	schtasks.exe
2460	schtasks.exe
2376	schtasks.exe
4664	schtasks.exe
1980	schtasks.exe
4712	schtasks.exe
4092	schtasks.exe
4860	schtasks.exe
472	schtasks.exe
4920	schtasks.exe
3040	schtasks.exe
5184	schtasks.exe
2700	schtasks.exe
472	schtasks.exe
5996	schtasks.exe
1600	schtasks.exe
5160	schtasks.exe
2384	schtasks.exe
928	schtasks.exe
5412	schtasks.exe
4672	schtasks.exe
4624	schtasks.exe
1812	schtasks.exe
5652	schtasks.exe
2804	schtasks.exe
3808	schtasks.exe
572	schtasks.exe
1436	schtasks.exe
4892	schtasks.exe
4072	schtasks.exe
1600	schtasks.exe
5196	schtasks.exe
5876	schtasks.exe
3808	schtasks.exe
4552	schtasks.exe
5088	schtasks.exe
2804	schtasks.exe

Suspicious behavior: EnumeratesProcesses 39 IoCs

pid	Process
5268	Chainperfnet.exe
5268	Chainperfnet.exe
5268	Chainperfnet.exe
5268	Chainperfnet.exe
5268	Chainperfnet.exe
5268	Chainperfnet.exe
5268	Chainperfnet.exe
5268	Chainperfnet.exe
5268	Chainperfnet.exe
5268	Chainperfnet.exe
5268	Chainperfnet.exe
5268	Chainperfnet.exe
5268	Chainperfnet.exe
5268	Chainperfnet.exe
5268	Chainperfnet.exe
5268	Chainperfnet.exe
5268	Chainperfnet.exe
5268	Chainperfnet.exe
5268	Chainperfnet.exe
5268	Chainperfnet.exe
5268	Chainperfnet.exe
5268	Chainperfnet.exe
5268	Chainperfnet.exe
5268	Chainperfnet.exe
5268	Chainperfnet.exe
5268	Chainperfnet.exe
1868	fontdrvhost.exe
1868	fontdrvhost.exe
1868	fontdrvhost.exe
1868	fontdrvhost.exe
1868	fontdrvhost.exe
1868	fontdrvhost.exe
1868	fontdrvhost.exe
1868	fontdrvhost.exe
1868	fontdrvhost.exe
1868	fontdrvhost.exe
1868	fontdrvhost.exe
1868	fontdrvhost.exe
1868	fontdrvhost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1868	fontdrvhost.exe

Suspicious use of AdjustPrivilegeToken 33 IoCs

description	pid	Process
Token: SeDebugPrivilege	5268	Chainperfnet.exe
Token: SeDebugPrivilege	5800	spoolsv.exe
Token: SeDebugPrivilege	3012	smss.exe
Token: SeDebugPrivilege	4944	cmd.exe
Token: SeDebugPrivilege	2480	Registry.exe
Token: SeDebugPrivilege	2260	smss.exe
Token: SeDebugPrivilege	1588	lsass.exe
Token: SeDebugPrivilege	1740	upfc.exe
Token: SeDebugPrivilege	4380	SecurityHealthService.exe
Token: SeDebugPrivilege	5288	WUDFHost.exe
Token: SeDebugPrivilege	1012	csrss.exe
Token: SeDebugPrivilege	3128	fontdrvhost.exe
Token: SeDebugPrivilege	4324	System.exe
Token: SeDebugPrivilege	4920	spoolsv.exe
Token: SeDebugPrivilege	572	lsass.exe
Token: SeDebugPrivilege	2420	SearchHost.exe
Token: SeDebugPrivilege	1644	RuntimeBroker.exe
Token: SeDebugPrivilege	5084	spoolsv.exe
Token: SeDebugPrivilege	1868	fontdrvhost.exe
Token: SeDebugPrivilege	4484	spoolsv.exe
Token: SeDebugPrivilege	2908	SearchHost.exe
Token: SeDebugPrivilege	2036	Registry.exe
Token: SeDebugPrivilege	1692	upfc.exe
Token: SeDebugPrivilege	4592	lsass.exe
Token: SeDebugPrivilege	2348	cmd.exe
Token: SeDebugPrivilege	3728	System.exe
Token: SeDebugPrivilege	2932	SecurityHealthService.exe
Token: SeDebugPrivilege	4576	csrss.exe
Token: SeDebugPrivilege	3676	RuntimeBroker.exe
Token: SeDebugPrivilege	2944	WUDFHost.exe
Token: SeDebugPrivilege	2964	spoolsv.exe
Token: SeDebugPrivilege	3416	SearchHost.exe
Token: SeDebugPrivilege	4356	smss.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2532 wrote to memory of 2332	2532	cs22.exe	89
PID 2332 wrote to memory of 3300	2332	WScript.exe	90
PID 3300 wrote to memory of 5268	3300	cmd.exe	92
PID 5268 wrote to memory of 2936	5268	Chainperfnet.exe	170
PID 2936 wrote to memory of 3896	2936	cmd.exe	172
PID 2936 wrote to memory of 5084	2936	cmd.exe	177
PID 1868 wrote to memory of 3864	1868	fontdrvhost.exe	180
PID 1868 wrote to memory of 3904	1868	fontdrvhost.exe	181
PID 1868 wrote to memory of 2712	1868	fontdrvhost.exe	245
PID 2712 wrote to memory of 776	2712	cmd.exe	247

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\cs22.exe
"C:\Users\Admin\AppData\Local\Temp\cs22.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2532
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\chainproviderwebBroker\0jcgp6yu3hBQuIZpLC05P.vbe"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2332
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\chainproviderwebBroker\QWtd6Ag8hlOX.bat" "
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3300
  - - C:\chainproviderwebBroker\Chainperfnet.exe
      "C:\chainproviderwebBroker\Chainperfnet.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5268
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\FwrwvNaa50.bat"
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:2936
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:3896
      - C:\Windows\apppatch\fr-FR\spoolsv.exe
        
        "C:\Windows\apppatch\fr-FR\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:5084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\Windows\apppatch\fr-FR\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\apppatch\fr-FR\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 14 /tr "'C:\Windows\apppatch\fr-FR\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 7 /tr "'C:\Program Files\VideoLAN\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 10 /tr "'C:\Program Files\VideoLAN\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5196

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 10 /tr "'C:\Windows.old\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Windows.old\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 8 /tr "'C:\Windows.old\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3168

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\Windows.old\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows.old\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 8 /tr "'C:\Windows.old\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SecurityHealthServiceS" /sc MINUTE /mo 14 /tr "'C:\Users\Admin\SecurityHealthService.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SecurityHealthService" /sc ONLOGON /tr "'C:\Users\Admin\SecurityHealthService.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SecurityHealthServiceS" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\SecurityHealthService.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\upfc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1176

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2384

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\Users\Default\Local Settings\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Users\Default\Local Settings\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\Users\Default\Local Settings\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1600

C:\Windows\apppatch\fr-FR\spoolsv.exe
"C:\Windows\apppatch\fr-FR\spoolsv.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Media Player\Skins\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\Skins\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5004

C:\Windows.old\smss.exe
"C:\Windows.old\smss.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3012

C:\Program Files\VideoLAN\cmd.exe
"C:\Program Files\VideoLAN\cmd.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Media Player\Skins\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3896

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WUDFHostW" /sc MINUTE /mo 5 /tr "'C:\Users\Default\My Documents\WUDFHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WUDFHost" /sc ONLOGON /tr "'C:\Users\Default\My Documents\WUDFHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WUDFHostW" /sc MINUTE /mo 12 /tr "'C:\Users\Default\My Documents\WUDFHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1092

C:\Windows.old\Registry.exe
"C:\Windows.old\Registry.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2460

C:\Recovery\WindowsRE\upfc.exe
"C:\Recovery\WindowsRE\upfc.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1740

C:\Program Files (x86)\Windows Media Player\Skins\smss.exe
"C:\Program Files (x86)\Windows Media Player\Skins\smss.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2260

C:\Users\Default\Local Settings\lsass.exe
"C:\Users\Default\Local Settings\lsass.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\chainproviderwebBroker\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\chainproviderwebBroker\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5184

C:\Users\Admin\SecurityHealthService.exe
"C:\Users\Admin\SecurityHealthService.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\chainproviderwebBroker\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5652

C:\Users\Default\My Documents\WUDFHost.exe
"C:\Users\Default\My Documents\WUDFHost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5288

C:\Recovery\WindowsRE\csrss.exe
"C:\Recovery\WindowsRE\csrss.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 10 /tr "'C:\chainproviderwebBroker\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5160

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\chainproviderwebBroker\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4860

C:\chainproviderwebBroker\fontdrvhost.exe
"C:\chainproviderwebBroker\fontdrvhost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3128

C:\Program Files (x86)\Windows NT\TableTextService\en-US\System.exe
"C:\Program Files (x86)\Windows NT\TableTextService\en-US\System.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\chainproviderwebBroker\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Microsoft\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Microsoft\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Program Files\VideoLAN\VLC\skins\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\VLC\skins\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Program Files\VideoLAN\VLC\skins\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3808

C:\chainproviderwebBroker\spoolsv.exe
"C:\chainproviderwebBroker\spoolsv.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchHostS" /sc MINUTE /mo 5 /tr "'C:\chainproviderwebBroker\SearchHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4072

C:\Program Files (x86)\Microsoft\lsass.exe
"C:\Program Files (x86)\Microsoft\lsass.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchHost" /sc ONLOGON /tr "'C:\chainproviderwebBroker\SearchHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchHostS" /sc MINUTE /mo 7 /tr "'C:\chainproviderwebBroker\SearchHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1600

C:\chainproviderwebBroker\SearchHost.exe
"C:\chainproviderwebBroker\SearchHost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2420

C:\Program Files\VideoLAN\VLC\skins\RuntimeBroker.exe
"C:\Program Files\VideoLAN\VLC\skins\RuntimeBroker.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1644

C:\chainproviderwebBroker\fontdrvhost.exe
"C:\chainproviderwebBroker\fontdrvhost.exe"
1⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1868
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3f3e653d-d197-4f2e-80ef-16a9b9e49c62.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:3864
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\41c1b2f0-037d-4206-89f0-20df0e8827f4.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:3904
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SNnEytbzjv.bat" "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2712
- - C:\Windows\System32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:776

C:\chainproviderwebBroker\spoolsv.exe
"C:\chainproviderwebBroker\spoolsv.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4484

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4684

C:\chainproviderwebBroker\SearchHost.exe
"C:\chainproviderwebBroker\SearchHost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2908

C:\Windows.old\Registry.exe
"C:\Windows.old\Registry.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2036

C:\Recovery\WindowsRE\upfc.exe
"C:\Recovery\WindowsRE\upfc.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1692

C:\Program Files (x86)\Microsoft\lsass.exe
"C:\Program Files (x86)\Microsoft\lsass.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4592

C:\Program Files\VideoLAN\cmd.exe
"C:\Program Files\VideoLAN\cmd.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2348

C:\Program Files (x86)\Windows NT\TableTextService\en-US\System.exe
"C:\Program Files (x86)\Windows NT\TableTextService\en-US\System.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3728

C:\Users\Admin\SecurityHealthService.exe
"C:\Users\Admin\SecurityHealthService.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2932

C:\Recovery\WindowsRE\csrss.exe
"C:\Recovery\WindowsRE\csrss.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4576

C:\Program Files\VideoLAN\VLC\skins\RuntimeBroker.exe
"C:\Program Files\VideoLAN\VLC\skins\RuntimeBroker.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3676

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:5980

C:\Users\Default\My Documents\WUDFHost.exe
"C:\Users\Default\My Documents\WUDFHost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2944

C:\chainproviderwebBroker\spoolsv.exe
"C:\chainproviderwebBroker\spoolsv.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2964

C:\chainproviderwebBroker\SearchHost.exe
"C:\chainproviderwebBroker\SearchHost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3416

C:\Program Files (x86)\Windows Media Player\Skins\smss.exe
"C:\Program Files (x86)\Windows Media Player\Skins\smss.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4356

C:\Windows\system32\schtasks.exe
schtasks.exe /delete /tn "Chainperfnet" /f
1⤵
- Process spawned unexpected child process
PID:3496

C:\Windows\system32\schtasks.exe
schtasks.exe /delete /tn "ChainperfnetC" /f
1⤵
- Process spawned unexpected child process
PID:1912

C:\Windows\system32\schtasks.exe
schtasks.exe /delete /tn "spoolsv" /f
1⤵
- Process spawned unexpected child process
PID:1692

C:\Windows\system32\schtasks.exe
schtasks.exe /delete /tn "spoolsvs" /f
1⤵
- Process spawned unexpected child process
PID:4312

C:\Windows\system32\schtasks.exe
schtasks.exe /delete /tn "cmd" /f
1⤵
- Process spawned unexpected child process
PID:4500

C:\Windows\system32\schtasks.exe
schtasks.exe /delete /tn "cmdc" /f
1⤵
- Process spawned unexpected child process
PID:2804

C:\Windows\system32\schtasks.exe
schtasks.exe /delete /tn "Registry" /f
1⤵
- Process spawned unexpected child process
PID:5828

C:\Windows\system32\schtasks.exe
schtasks.exe /delete /tn "RegistryR" /f
1⤵
- Process spawned unexpected child process
PID:3740

C:\Windows\system32\schtasks.exe
schtasks.exe /delete /tn "smss" /f
1⤵
- Process spawned unexpected child process
PID:1728

C:\Windows\system32\schtasks.exe
schtasks.exe /delete /tn "smsss" /f
1⤵
- Process spawned unexpected child process
PID:5884

C:\Windows\system32\schtasks.exe
schtasks.exe /delete /tn "SecurityHealthService" /f
1⤵
- Process spawned unexpected child process
PID:4788

C:\Windows\system32\schtasks.exe
schtasks.exe /delete /tn "SecurityHealthServiceS" /f
1⤵
- Process spawned unexpected child process
PID:2844

C:\Windows\system32\schtasks.exe
schtasks.exe /delete /tn "upfc" /f
1⤵
- Process spawned unexpected child process
PID:1984

C:\Windows\system32\schtasks.exe
schtasks.exe /delete /tn "upfcu" /f
1⤵
- Process spawned unexpected child process
PID:4284

C:\Windows\explorer.exe
explorer.exe
1⤵
- Modifies registry class
PID:4016

C:\Windows\system32\schtasks.exe
schtasks.exe /delete /tn "lsass" /f
1⤵
- Process spawned unexpected child process
PID:3988

C:\Windows\system32\schtasks.exe
schtasks.exe /delete /tn "lsassl" /f
1⤵
- Process spawned unexpected child process
PID:2368

C:\Windows\system32\schtasks.exe
schtasks.exe /delete /tn "smss" /f
1⤵
PID:5620

C:\Windows\system32\schtasks.exe
schtasks.exe /delete /tn "smsss" /f
1⤵
PID:4288

C:\Windows\system32\schtasks.exe
schtasks.exe /delete /tn "csrss" /f
1⤵
PID:1936

C:\Windows\system32\schtasks.exe
schtasks.exe /delete /tn "csrssc" /f
1⤵
PID:4308

C:\Windows\system32\schtasks.exe
schtasks.exe /delete /tn "WUDFHost" /f
1⤵
PID:4952

C:\Windows\system32\schtasks.exe
schtasks.exe /delete /tn "WUDFHostW" /f
1⤵
PID:2120

C:\Windows\system32\schtasks.exe
schtasks.exe /delete /tn "System" /f
1⤵
PID:564

C:\Windows\system32\schtasks.exe
schtasks.exe /delete /tn "SystemS" /f
1⤵
PID:4384

C:\Windows\system32\schtasks.exe
schtasks.exe /delete /tn "fontdrvhost" /f
1⤵
PID:1244

C:\Windows\system32\schtasks.exe
schtasks.exe /delete /tn "fontdrvhostf" /f
1⤵
PID:2624

C:\Windows\system32\schtasks.exe
schtasks.exe /delete /tn "spoolsv" /f
1⤵
PID:4596

C:\Windows\system32\schtasks.exe
schtasks.exe /delete /tn "spoolsvs" /f
1⤵
PID:888

C:\Windows\system32\schtasks.exe
schtasks.exe /delete /tn "lsass" /f
1⤵
PID:4712

C:\Windows\system32\schtasks.exe
schtasks.exe /delete /tn "lsassl" /f
1⤵
PID:4524

C:\Windows\system32\schtasks.exe
schtasks.exe /delete /tn "RuntimeBroker" /f
1⤵
PID:1704

C:\Windows\system32\schtasks.exe
schtasks.exe /delete /tn "RuntimeBrokerR" /f
1⤵
PID:2672

C:\Windows\system32\schtasks.exe
schtasks.exe /delete /tn "SearchHost" /f
1⤵
PID:4100

C:\Windows\system32\schtasks.exe
schtasks.exe /delete /tn "SearchHostS" /f
1⤵
PID:4472

C:\Windows\system32\schtasks.exe
schtasks.exe /delete /tn "fontdrvhost" /f
1⤵
PID:4504

C:\Windows\system32\schtasks.exe
schtasks.exe /delete /tn "fontdrvhostf" /f
1⤵
PID:1160

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6203df4a6bafc7

Path C:\Program Files (x86)\Microsoft\6203df4a6bafc7
Size 679B
SHA256 a883f4f0b71c30b9b94fe1a48255360b4d00683b745a0b871626c12386f7c71c
MD5 a93928f300aa02054aefac0984ff8be3
SHA1 171783bd81db27712b00d8d33fcb01e4d1c81b13
SHA512 adf0304051b65c637887ba40dfdcfd269dea2f7fdd81233d3e127099233c036e2c01aa323142cbbeca8a9f92100039971f620238fb9ad594f5429a4679156519
TLSH
T11A018340E87224544CFE1997F323E3C8A4DB54C097443C33DE73D366C109C9259EA2A6
MD5 SHA1 SHA512 TLSH

Submit Download

69ddcba757bf72

Path C:\Program Files (x86)\Windows Media Player\Skins\69ddcba757bf72
Size 243B
SHA256 5a6b71c8842912737875e0dbcba808df26bc962aa3820861ee608359e9580ddf
MD5 fc733ef220f9b46d438412b1c9201b91
SHA1 b1241a11116dce0afea5924b5c633828cdffd221
SHA512 603b0eb01a646f876a2d691252a1ab1bcc5c82b3999cd39c980e4f156e9c954bbda59489fd8a0b33ed05b93d0869675ee7ba875146f46d008d66cb5d0af02010
TLSH
T1AAD095F1101C851BED254DD812AA30880C87430D4ECF1F21B9EA450423184BDC3506D9
MD5 SHA1 SHA512 TLSH

Submit Download

27d1bcfc3c54e0

Path C:\Program Files (x86)\Windows NT\TableTextService\en-US\27d1bcfc3c54e0
Size 210B
SHA256 b3080c7ef7c83291441d4a74ead6c020d5d4fceceb4cd6be7c6f6fa203666b2c
MD5 ed84bdcd9eff4cf17969061f06e37a02
SHA1 3e200d7f73a24adcf8f3c7d390e6e666c9dd177e
SHA512 1df09d60bd361a5576a03c6eaca19e4c24755794dbe9cb6b899e6f7e95f512ea6df213a1d5d29b0f206b732637aa4df2d755f3ffeae4e1610f647941e8c3d207
TLSH
T148D023087459804131B10830347212B321802080ABCD4F01CFD1404305F11AC0505228
MD5 SHA1 SHA512 TLSH

Submit Download

9e8d7a4ca61bd9

Path C:\Program Files\VideoLAN\VLC\skins\9e8d7a4ca61bd9
Size 623B
SHA256 09bd4ea89377f4c79436865bd495c4c2475ab5d8bb323a45e2c5459f0a43998d
MD5 ccbc80426aa840a04c961b43d1db63d4
SHA1 7d6d1472b8ea096ceb0b72fc8584e82a14b412b9
SHA512 4c7dc2f9110fde5f7e30a11f5c635fea5de5ec74246ba977b1b8822e93d3608e8b0412ce9dfde0c766de4a54f8ad007f8cfe61c21dfd9404b166084e3185d00d
TLSH
T1D7F062A12F56C3215DBD51388E1CC42C3064200DE129C3EE8343183E9AA46F0C9EF11D
MD5 SHA1 SHA512 TLSH

Submit Download

ebf1f9fa8afd6d

Path C:\Program Files\VideoLAN\ebf1f9fa8afd6d
Size 574B
SHA256 b99b4546d0505c4bdae72bf26006b908f55ab04af95e398832c2ac087858b777
MD5 f502aad9ba84a1904a7d5d54aa175bd8
SHA1 2e2033d3d2e8f7bb22bcb8a9dcc702897088e114
SHA512 1d3826d1ed77e11081c4078ee3dd60fb71f0ba5259ecbdbf18796d5413a0a6ea5c6d7ff0282c44a2be7dabcf9d211b0e5f781a454702458d58140457acbeb4b9
TLSH
T181F04103C6A1870ED988041FA42C0CC4E94F81FD680C94C38B70D6A31A36D835C18C10
MD5 SHA1 SHA512 TLSH

Submit Download

886983d96e3d3e

Path C:\Recovery\WindowsRE\886983d96e3d3e
Size 79B
SHA256 4a389ad77ad8063d0c160afbf95674407085d8eb81a77da09c196ae51f9dca71
MD5 0210a6f48131304a9033339cb8ca5e53
SHA1 5107d21ae69a745661544926a15324eb852afc21
SHA512 15c23a5f204c3985f902063472bd18ade9e8daaf07c80bae6fb9e8c8076185ee7abbbe19fd5eba96809d0404e1b478ddffc4e261385b73f47147842d08e47d55
TLSH
T102A02403F031CCF4344D4C0D353474501C11401FCC0547D57DD730041035500C104347
MD5 SHA1 SHA512 TLSH

Submit Download

ea1d8f6d871115

Path C:\Recovery\WindowsRE\ea1d8f6d871115
Size 651B
SHA256 dbc5708cb808abbd76af2874abe6d2607ef2175339d18c8468b36f83faefe8e7
MD5 94b3ceec2796245787eb98f2f7dff3ac
SHA1 8e530a583a71e0e8953e5c988273c7ed89862042
SHA512 716f5c116fc44136aeaf3578d89ee5067c21eaabeeae58f6a411370b85748b17470452572126fe4e2466ea91ac4b288091169a0e2b8129d6e2d388ed498eda2d
TLSH
T1A0F062E52363FEDF6DC60162057BAFCB2A856FAEBDC5FA42957901083BD38D118120A0
MD5 SHA1 SHA512 TLSH

Submit Download

926e3e4b62361b

Path C:\Users\Admin\926e3e4b62361b
Size 801B
SHA256 f66e725b8977a9ce367bd8cc1891e8658f2a58d045704de4d456d52a1fd93e6e
MD5 a1c276c042a1ac877eacc85f72994c60
SHA1 ea638ec926a283a36e2bf13408215d84a4589e87
SHA512 0e21a9b2d5132277cbcf33066a85f66da6834e23975836f0d5855f3f155a7acaf9412d4b1accca10a830fd5b14ed06620a12e1a6f973a1ded8adba03204238a4
TLSH
T13001810DB7924EB37D62AC060894F8E2068C83B85B446B4E60AA422BC0ED81218F24D1
MD5 SHA1 SHA512 TLSH

Submit Download

3f3e653d-d197-4f2e-80ef-16a9b9e49c62.vbs

Path C:\Users\Admin\AppData\Local\Temp\3f3e653d-d197-4f2e-80ef-16a9b9e49c62.vbs
Size 717B
SHA256 d4d926cfdb8be608f98f116b7ac7f561fd66d86dff884407fab9ec97f28ce2ad
MD5 91124ea3bc63b3b483a09c89ee9bf00e
SHA1 8db2a2c5a5e198697b398395eabd3300fd74945d
SHA512 33cc04a2961fd08ffe66727c890fbfecb4afd297970c3442b471a0aa4fed10c5959813af1852ca01fbc2311333fd96b6f64c8c2397cf5963b490674a44ce6428
TLSH
T1D101CB16BE0BE63060A52340A0FA44BF6AD884282136FD8BB960E46C2716D2404EC4EE
MD5 SHA1 SHA512 TLSH

Submit Download

41c1b2f0-037d-4206-89f0-20df0e8827f4.vbs

Path C:\Users\Admin\AppData\Local\Temp\41c1b2f0-037d-4206-89f0-20df0e8827f4.vbs
Size 493B
SHA256 096507c27e1da5ef4f189ea1985817f9f62dc7d3fb822d56810161dd2a934b6e
MD5 33af67ddb8d0f9fbc3be19f955492fc3
SHA1 761560e2575e4858fcf8302910a0d18df2a4311a
SHA512 1287379e54ef457585bba9c24d277726704f06629595a3be3adc28f8bb0d79edaf9009e2b37351f3b120dff788f95f992df5c95b617be0601729fd04faf8f70e
TLSH
T141F0271DFF09D734C511434226FA98CF8AAC840E2275E58DBD49E8EE32529244DEA2DD
MD5 SHA1 SHA512 TLSH

Submit Download

FwrwvNaa50.bat

Path C:\Users\Admin\AppData\Local\Temp\FwrwvNaa50.bat
Size 202B
SHA256 24bfe1df97c37d63c42cc1eece9097ce451b30187f22dc679d09e1c2ed02e85f
MD5 10be4e036c5637ce6f2602a573329e44
SHA1 3e7e8d964d43181e27938529b5707b58bfcb0969
SHA512 1182885a6922977d45c4923cd6308de42a099c25de58a3d24cc40c2685bd2817c219c08b38ce2f6407d7a49da309c4c381ddaedb5269b3b5427867fa18066caf
TLSH
T1F3D022C2C652C7A904420816985B128D90976C68B6C12A200699482C2A8B06AB6AA6C2
MD5 SHA1 SHA512 TLSH

Submit Download

SNnEytbzjv.bat

Path C:\Users\Admin\AppData\Local\Temp\SNnEytbzjv.bat
Size 267B
SHA256 ac6b466e3a2b38877ed6bf27306c1c566d0b10e5887f22ac7832e029d844ef07
MD5 a01ab8eebd8fd66674974d0d602ccaa2
SHA1 26338eb16297f37bbc63d1a8bca9235d6eb692f1
SHA512 951fa88c570f91c0d3edf71528b6765dd8becd186cdade61880d2236dcdc073537a05b53b10eb66dd7a7bbed842213c4726e0ca7677d07000127716fb9eafc3e
TLSH
T1B5D02E67D401C2A00A22889A7CCF25CC819E1C98B189B4B426C7587AE49B839A02BAD3
MD5 SHA1 SHA512 TLSH

Submit Download

6203df4a6bafc7

Path C:\Users\Default\Local Settings\6203df4a6bafc7
Size 124B
SHA256 06bd08a5e23e7fdd8038e41c6cd71ec62defabb1f3a0cd39c962d02dce052a28
MD5 54c633da7f33df1741ab245cb2f510ab
SHA1 b672e12031f5e4acfb5242acc764ea3f9a82c347
SHA512 87a4046c87bc430f0956db2ace83974c846f4890785ceaf4233c56fce5a746261b09a87d4d546b29f9ae7236186c04e723af3bab0e5613e0684a568a5d6331a9
TLSH
T172B02B50F078C224C611854C0FA11101408031D8C9EC10054710029002D1615A46D180
MD5 SHA1 SHA512 TLSH

Submit Download

480b7989c529f6

Path C:\Users\Default\My Documents\480b7989c529f6
Size 677B
SHA256 13ef3ed6d059ba3fcff2ddb4769de304b9497f45760d68bd9492597a2223ba4f
MD5 967b41f656eb7966dd109c58e0aaed8b
SHA1 86dd9384c0f393945e141287f368bd1787637895
SHA512 c2592e71267179126070fc12775d0d9ea99e3d736a50371c98b70304afd242c652c76a460362c4ab88a3ae6f4e37ffad612e690612004955a5a4fecba289395f
TLSH
T12601F4DD9E6107B53D4F41045DB52F1264E212852037F2477F2DC1DC81C1BA766B599A
MD5 SHA1 SHA512 TLSH

Submit Download

69ddcba757bf72

Path C:\Windows.old\69ddcba757bf72
Size 14B
SHA256 aa095e1594f235cc120529db4e350dc948051fb470594f1d30cca01b782adad8
MD5 0bdd39462a80f9413a709dcac35a35ac
SHA1 d698b5e6ebb145307e84847b5442e21bb27231a7
SHA512 6c2d97bdca13a01e75db58ef78bf48fe3116f942a1e5fcc69d861188d3004750d3bec6d1ca839a5ade934ce538f98aeebaadb5492062ac5ea0029ee277d47bd4
MD5 SHA1 SHA512

Submit Download

ee2ad38f3d4382

Path C:\Windows.old\ee2ad38f3d4382
Size 504B
SHA256 29c1f4ded3ee97e68d83eabbcc2857a513d9ec64517368bf45d3b416431a9449
MD5 a02ed1495ec15cf4266ae2fa13cf1513
SHA1 9b285c52525c76cbfa444ec0cc7c0c15f6ae5801
SHA512 1abdb6015765fbc7ebacbcfe09ab41f14d01b7f5d9cb83b2605f8deca66a895e3430a3c07e6f630599d1f38d29eeeb12526a7a256d889a8e5b9eac3a51dba9c8
TLSH
T1B9F0057405D53F676F140B9650304C55AD848929FCD05B23554C855D995F8C029A5995
MD5 SHA1 SHA512 TLSH

Submit Download

f3b6ecef712a24

Path C:\Windows\apppatch\fr-FR\f3b6ecef712a24
Size 808B
SHA256 803da9c30dc682b05b420d73be4870821c824d32352d1b9c5dc8d0379dff865c
MD5 12c55fbfa8b473ed62a80367232492ae
SHA1 ebba05e9cb131ed23906d5072652dfc04a2c9e61
SHA512 39bc92aa92be2f2415b80417d9f6ee451c10158c7306c22d6204bfe7c44333da25c631dbe649ca05f6b088eef5877f6ba47481db0eea9ebeece5b64dde7294b3
TLSH
T16701C5C30ADA98FB49E04878CF7C2D602683EDE7C488B340B22FA15EA0724A3106D730
MD5 SHA1 SHA512 TLSH

Submit Download

0jcgp6yu3hBQuIZpLC05P.vbe

Path C:\chainproviderwebBroker\0jcgp6yu3hBQuIZpLC05P.vbe
Size 211B
SHA256 d92a5311f18c08d2ec53f7c6998d094f21e38d040c5a31ec62ee4b82bb8123f7
MD5 b4a10ff96025704f6d745a717fb65568
SHA1 0248cd66f4d53d766cf857315fc9a8b8b1463a59
SHA512 fbb21225a8f394ce504f998971ea487905bcbdd30595c941441419ba77934f55339acad04434593ef8a2620253c88eda093a97fe138f881804403b3b36f12b27
TLSH
T1B0D0230C4463E288DD24D4918280CC2C0C514B584B800EC3C47CDD0C00404A6303C3DB
MD5 SHA1 SHA512 TLSH

Submit Download

5b884080fd4f94

Path C:\chainproviderwebBroker\5b884080fd4f94
Size 950B
SHA256 d36d7ce14a6035361549a3447ce8f71b6b7923fffee48af1a2642863a91dfccf
MD5 bd17b60f8c3ff12a794ad69efb5fd331
SHA1 db301eb53608a5ac9444243c4020c38875ee700a
SHA512 3057914211f3a4890bcfbe7e18e76b4912330624a85165eb86be86d78926c45110370f4671de10546a4e900edb08cca37b43e6fb50611bf5d1a3c0c382188842
TLSH
T1581188AB86B35BC6499ACCFB0224664A4EF588165A23D1AF04D9C0B58134D981649D73
MD5 SHA1 SHA512 TLSH

Submit Download

Chainperfnet.exe

Path C:\chainproviderwebBroker\Chainperfnet.exe
Size 1.1MB
SHA256 fa245486b3fd0ed56fc169c0c57cad8b5a8390bd4e6b04765148cb5d2d8e0f2e
MD5 8d94c3b91f4c437c0989338d703affc9
SHA1 8da9e1f5e0f929d74253f6c1facb3fda88a867e7
SHA512 12088116126f7a991df5461d3daec1c30961b9935ff7d2d911f9f29f110068f94506d33b095f35f1149d27d8dc7ccc891fadb8a0f6521ac3814eab01d1a6c789
SSDEEP 12288:f5h/uGl4pwiBWH+fMcwbuOHJxOpn6TKHNlYq/wpsqlohYBVpio5+KphTI+Diz6DJ:d8wiB1WHJM+KtldePVko5++DxhVEu
TLSH
T109354A117E44CE11F0091233C3EF458957B0E961AAA6E32B7DBA3B6E55123A77C0D9CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QWtd6Ag8hlOX.bat

Path C:\chainproviderwebBroker\QWtd6Ag8hlOX.bat
Size 44B
SHA256 c6e93ae71a092e09df1526c73496466cabbba86235d2adf6dc16baab988bf9d8
MD5 b11da99e2c20eb3464c99bd43178ec21
SHA1 8e7df93e482df60531375c6c65e685c3ce1455af
SHA512 725997d6fe5d70c8d0e8cb5dbbcd94476d89ad5021abb3ea6fced3671218fc5511488cfcc82004ad07f163ebb83e3114a1d30bb02c9279fd894ea07f5c6a9f9e
MD5 SHA1 SHA512

Submit Download

cfa885d449487c

Path C:\chainproviderwebBroker\cfa885d449487c
Size 296B
SHA256 e5297c5a5125017e99e9d6f07072884d03c2ff576cd1a010e70a08ff9dc038ad
MD5 3265b452be8ecead77ff17da5cdee7e8
SHA1 f09f5a918e7e198b7ccca19c4bd73f1e8b3da94e
SHA512 eabe016a63368dc8f63458ec8dbf5db6a4d909f5f2664af150262ac248fa743c4c4206287317286424fde9f864b89bb2318ce5dc99a422231e2536af90d3566c
TLSH
T16DE07D315CC811BB578A5113620B97DF670C943505C570C427C1A89E59400C9D85207B
MD5 SHA1 SHA512 TLSH

Submit Download

f3b6ecef712a24

Path C:\chainproviderwebBroker\f3b6ecef712a24
Size 657B
SHA256 438fc74315508dae995421adfc6abb4603f1fd2a35bbd617205959eea772195f
MD5 e852128bcba44cda543cefae1ecb9efc
SHA1 843fd1e1c2ccb0be48b8af2a6c96b58e4c9a2ad0
SHA512 6931ec3a53b0b76b136a888c59bde57630bf8c7147911a2f1576e5448b5b7a398e75705710124f4b94f4c8af251ce4f69908cd47fb9444970527b6381468c1e8
TLSH
T1410183C32089AD0C9B5C692A084B604391AB97B34A9E2D94000EF3B36420E87A00357B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5268-19-0x00000000032F0000-0x00000000032FC000-memory.dmp

Download

memory/5268-14-0x0000000000FA0000-0x00000000010C2000-memory.dmp

Download

memory/5268-15-0x0000000003190000-0x000000000319E000-memory.dmp

Download

memory/5268-16-0x00000000031A0000-0x00000000031A8000-memory.dmp

Download

memory/5268-17-0x00000000031B0000-0x00000000031C6000-memory.dmp

Download

memory/5268-18-0x00000000032E0000-0x00000000032EA000-memory.dmp

Download