8bc4d422624113b2af547b64fa7df842b821f189ca4d7bad6e75767fec4a9e59

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
27/05/2024, 17:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
123.bat
Size 66B
Sample240527-v2fllacf56
SHA256 b449f5170c97f7328ce8ff6f2d741c489de4fc9640dcd1a4781349c60f25d934
MD5 572472c7cc450eedfcd8061e7f64eb96
SHA1 6d315e5521592f668dc2899eaa83f2ac9cbe99c4
SHA512 f89b64c7300aa52b1bba95f1a45fb1dcc1ef13ed81bb0e671159120f909bba94a9762de9c78056f1f535e2797efffa689e6e10b73ca3a0997b307361619883b6
MD5 SHA1 SHA512

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4860	icacls.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4416	WMIC.exe
Token: SeSecurityPrivilege	4416	WMIC.exe
Token: SeTakeOwnershipPrivilege	4416	WMIC.exe
Token: SeLoadDriverPrivilege	4416	WMIC.exe
Token: SeSystemProfilePrivilege	4416	WMIC.exe
Token: SeSystemtimePrivilege	4416	WMIC.exe
Token: SeProfSingleProcessPrivilege	4416	WMIC.exe
Token: SeIncBasePriorityPrivilege	4416	WMIC.exe
Token: SeCreatePagefilePrivilege	4416	WMIC.exe
Token: SeBackupPrivilege	4416	WMIC.exe
Token: SeRestorePrivilege	4416	WMIC.exe
Token: SeShutdownPrivilege	4416	WMIC.exe
Token: SeDebugPrivilege	4416	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4416	WMIC.exe
Token: SeRemoteShutdownPrivilege	4416	WMIC.exe
Token: SeUndockPrivilege	4416	WMIC.exe
Token: SeManageVolumePrivilege	4416	WMIC.exe
Token: 33	4416	WMIC.exe
Token: 34	4416	WMIC.exe
Token: 35	4416	WMIC.exe
Token: 36	4416	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4416	WMIC.exe
Token: SeSecurityPrivilege	4416	WMIC.exe
Token: SeTakeOwnershipPrivilege	4416	WMIC.exe
Token: SeLoadDriverPrivilege	4416	WMIC.exe
Token: SeSystemProfilePrivilege	4416	WMIC.exe
Token: SeSystemtimePrivilege	4416	WMIC.exe
Token: SeProfSingleProcessPrivilege	4416	WMIC.exe
Token: SeIncBasePriorityPrivilege	4416	WMIC.exe
Token: SeCreatePagefilePrivilege	4416	WMIC.exe
Token: SeBackupPrivilege	4416	WMIC.exe
Token: SeRestorePrivilege	4416	WMIC.exe
Token: SeShutdownPrivilege	4416	WMIC.exe
Token: SeDebugPrivilege	4416	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4416	WMIC.exe
Token: SeRemoteShutdownPrivilege	4416	WMIC.exe
Token: SeUndockPrivilege	4416	WMIC.exe
Token: SeManageVolumePrivilege	4416	WMIC.exe
Token: 33	4416	WMIC.exe
Token: 34	4416	WMIC.exe
Token: 35	4416	WMIC.exe
Token: 36	4416	WMIC.exe
Token: SeIncreaseQuotaPrivilege	412	WMIC.exe
Token: SeSecurityPrivilege	412	WMIC.exe
Token: SeTakeOwnershipPrivilege	412	WMIC.exe
Token: SeLoadDriverPrivilege	412	WMIC.exe
Token: SeSystemProfilePrivilege	412	WMIC.exe
Token: SeSystemtimePrivilege	412	WMIC.exe
Token: SeProfSingleProcessPrivilege	412	WMIC.exe
Token: SeIncBasePriorityPrivilege	412	WMIC.exe
Token: SeCreatePagefilePrivilege	412	WMIC.exe
Token: SeBackupPrivilege	412	WMIC.exe
Token: SeRestorePrivilege	412	WMIC.exe
Token: SeShutdownPrivilege	412	WMIC.exe
Token: SeDebugPrivilege	412	WMIC.exe
Token: SeSystemEnvironmentPrivilege	412	WMIC.exe
Token: SeRemoteShutdownPrivilege	412	WMIC.exe
Token: SeUndockPrivilege	412	WMIC.exe
Token: SeManageVolumePrivilege	412	WMIC.exe
Token: 33	412	WMIC.exe
Token: 34	412	WMIC.exe
Token: 35	412	WMIC.exe
Token: 36	412	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5056	WMIC.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1904	javaw.exe
1904	javaw.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 436 wrote to memory of 3440	436	cmd.exe	83
PID 436 wrote to memory of 3440	436	cmd.exe	83
PID 436 wrote to memory of 3440	436	cmd.exe	83
PID 3440 wrote to memory of 1904	3440	DCRat.exe	84
PID 3440 wrote to memory of 1904	3440	DCRat.exe	84
PID 436 wrote to memory of 5028	436	cmd.exe	85
PID 436 wrote to memory of 5028	436	cmd.exe	85
PID 1904 wrote to memory of 4860	1904	javaw.exe	86
PID 1904 wrote to memory of 4860	1904	javaw.exe	86
PID 1904 wrote to memory of 4464	1904	javaw.exe	92
PID 1904 wrote to memory of 4464	1904	javaw.exe	92
PID 4464 wrote to memory of 4416	4464	cmd.exe	94
PID 4464 wrote to memory of 4416	4464	cmd.exe	94
PID 1904 wrote to memory of 3404	1904	javaw.exe	95
PID 1904 wrote to memory of 3404	1904	javaw.exe	95
PID 1904 wrote to memory of 3512	1904	javaw.exe	97
PID 1904 wrote to memory of 3512	1904	javaw.exe	97
PID 3512 wrote to memory of 412	3512	cmd.exe	99
PID 3512 wrote to memory of 412	3512	cmd.exe	99
PID 1904 wrote to memory of 2728	1904	javaw.exe	100
PID 1904 wrote to memory of 2728	1904	javaw.exe	100
PID 2728 wrote to memory of 5056	2728	cmd.exe	102
PID 2728 wrote to memory of 5056	2728	cmd.exe	102
PID 1904 wrote to memory of 4712	1904	javaw.exe	103
PID 1904 wrote to memory of 4712	1904	javaw.exe	103
PID 4712 wrote to memory of 228	4712	cmd.exe	105
PID 4712 wrote to memory of 228	4712	cmd.exe	105
PID 1904 wrote to memory of 1008	1904	javaw.exe	106
PID 1904 wrote to memory of 1008	1904	javaw.exe	106
PID 1008 wrote to memory of 4700	1008	cmd.exe	108
PID 1008 wrote to memory of 4700	1008	cmd.exe	108
PID 1904 wrote to memory of 1516	1904	javaw.exe	109
PID 1904 wrote to memory of 1516	1904	javaw.exe	109
PID 1516 wrote to memory of 3028	1516	cmd.exe	111
PID 1516 wrote to memory of 3028	1516	cmd.exe	111

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\123.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:436
- C:\Users\Admin\AppData\Local\Temp\DCRat.exe
  DCRat.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3440
- - C:\Program Files\Java\jre-1.8\bin\javaw.exe
    "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -Dprism.dirtyopts=false -Dfile.encoding=UTF-8 -classpath "lib\.;lib\..;lib\IIIllllIlIlllIlIIIIlllIlIlIlllllIIIlIIllllIIIlIllIIlIIllllIIllllllIIlIIIIIIlllIIIlIllllllIIllIlIllIlllIllIlIIIIIIIIllllI.jar;lib\IIIllllIlIlllIlIIIIlllIlIlIlllllIIIlIIllllIIIlIllIIlIIllllIIllllllIIlIIIIIIlllIIIlIllllllIIllIlIllIlllIllIlIIIIIIIIllllIIilIl.jar;lib\IIlIlIllIIlIIllIIllIIlIIIllIlIlIlIIIIlIlIllIIlIIllIIIIIllIIIIlIIIlIIlIIlIIlIllIIlllIIIllIIIlIIlIllllIllIIIIlIIIlIllllllI.jar;lib\IlIIlIllllIIIIIlIlllIllIlIlIIIIIlIIIlIlIlllIIllIllIIIIIIlIIlllIIIlIIIlllIIIlllllIlIlIlllllIIlIllIIlIIlIIlIIIlllllllIlIII.jar;lib\IlIlIIIIIIIlIlllllllIllIIlIIllIllllIIIlIIIlIlIIlIIlIIlIllIlllIlIlIIllIIlIIIIIIIlIIIIIIIIIlIlllIIllIlIIlIIIlIlIlllIIIIIIl.jar;lib\IlIllIIllllllllIlIIlllllIIIIllIIIlIIlllIIllIIllllIIllIlIIIlIIIIlIIIIIlllllllIllIIlIlIllIIlIlIlIIllIlIllIIIlIIIIlIllIIIIl.jar;lib\IllIIIIllIlIIIIlIlIllIIlIIllIIlIllIIlllllIlllIllIlIIlIIlllIIlIlIlIllIllIIlIIIlIIIllIIIIIllIIlllllIlIIIIIlIIIIIIIIIIIIlII.jar;lib\lIIllIIlIlllIlIlllIlIIlIIIlllllIIlIlIIllIllIlIlllIlIIlIlIlIIllIlIIIIIllIIlIIlIIlIIllIIIlIIllIlIIIIlIlIIlIIlIllIIlIIlIlIl.jar;lib\llIlIIIIlIlIlllllIlIIllllIIIlIlIllllIIllllIlllIIlllllIIlIlllIIIIIIlIIllIIIlIlIlllIlIIIlIIIIIllIlllIlllIIllIIllIlIlIIlllI.jar;lib\llIlIlIIIllllIIIllllllllllIllIlIlllIIlllIIlllIIllIIllllIlllIIIIIllllIIlllIIllIIIIlIlIlIlIIIlIIIlIlIlIlIIlllIIlllIlIlIlII.jar;lib\lllIIlIlIIlIIllllIIllllIIlIllllIIIlIllllIIllIIIlllIIIIIIlIIlllIIllIllIIlllIlIIlIlIlllIIlllIlllIlIIlIIIllIlllIIIlIIIIIlll.jar;lib\lllIlIIIIIlIllIlIlIIllIlIIIlIIllIllllIIIIIllIlllIllIIllIIllIllIllIIlIlllllIIlIllIllIIlIIlIIIllIlIlIIlIIIIIIIllIIlllIllIl.jar;lib\llllIlIIIIIllllIlIIIlIllIlIIIllllIIIllIllllIIlllIlIIIlllIIlIlIlllIIlIIIIlIIIIlllIIlIIlIlIIIIIIIIllllIllIlIIIlIllIlIlIIll.jar;lib\llllIlIIlIllllIlIlIIIlIIIlIllIlIIIIlIlIIlIlIIIIllIIlIIllIIIllllIlIllIlllllIIIIIIIIllIllIlIlllllllIllIIIllllIIllIIlIllIll.jar" org.develnext.jphp.ext.javafx.FXLauncher
    3⤵
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1904
  - - C:\Windows\system32\icacls.exe
      C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
      4⤵
      Modifies file permissions
      PID:4860
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c C:\Windows\System32\wbem\wmic.exe baseboard get Manufac ��
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4464
    - - C:\Windows\System32\wbem\WMIC.exe
        
        C:\Windows\System32\wbem\wmic.exe baseboard get Manufac
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4416
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c USERPR ��
      4⤵
      PID:3404
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c C:\Windows\System32\wbem\wmic.exe baseboap��3��
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3512
    - - C:\Windows\System32\wbem\WMIC.exe
        
        C:\Windows\System32\wbem\wmic.exe baseboap��3��
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:412
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c C:\Windows\System32\wbem\wmic.exe CPU get Proc ��8�Y
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2728
    - - C:\Windows\System32\wbem\WMIC.exe
        
        C:\Windows\System32\wbem\wmic.exe CPU get Proc
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5056
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c C:\Windows\System32\wbem\wmic.exe diskdrive where "'Index*'L��] ��\�X[�[X�\\"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4712
    - - C:\Windows\System32\wbem\WMIC.exe
        
        C:\Windows\System32\wbem\wmic.exe diskdrive where "'Index*'L��] ��\�X[�[X�\\"
        5⤵
        
        PID:228
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c C:\Windows\System32\wbem\wmic.exe Path Win32_VideoConp��3�\��]�Y[��\�
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1008
    - - C:\Windows\System32\wbem\WMIC.exe
        
        C:\Windows\System32\wbem\wmic.exe Path Win32_VideoConp��3�\��]�Y[��\�
        5⤵
        
        PID:4700
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c C:\Windows\System32\wbem\wmic.exe diskdrive where "'Il*'L��] ��^"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1516
    - - C:\Windows\System32\wbem\WMIC.exe
        
        C:\Windows\System32\wbem\wmic.exe diskdrive where "'Il*'L��] ��^"
        5⤵
        
        PID:3028
- C:\Users\Admin\AppData\Local\Temp\php\php.exe
  php -S 127.0.0.1:8000 -t ..\server
  2⤵
  PID:5028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 762260f4625be0f51cf66ef30dc425c717ef1234184404bd07e9a9efc9762739
MD5 9c183ad58286441d61b2c5f1495b06ae
SHA1 092f20f4185ff4677efc730e3e69138aaa77011d
SHA512 c6fcd57e9af237ea5dd67195cd94dae4d86b56bb32d486f0e51e838e298c878872de563bed537e73b9e8045f4fdc1689ac236d0441172d245d8cc11088b4492f
MD5 SHA1 SHA512

Submit Download

memory/1904-3-0x00000213DDF60000-0x00000213DE1D0000-memory.dmp

Download

memory/1904-13-0x00000213DC6F0000-0x00000213DC6F1000-memory.dmp

Download

memory/1904-17-0x00000213DE1D0000-0x00000213DE1E0000-memory.dmp

Download

memory/1904-20-0x00000213DE1F0000-0x00000213DE200000-memory.dmp

Download

memory/1904-19-0x00000213DE1E0000-0x00000213DE1F0000-memory.dmp

Download

memory/1904-22-0x00000213DE200000-0x00000213DE210000-memory.dmp

Download

memory/1904-24-0x00000213DE210000-0x00000213DE220000-memory.dmp

Download

memory/1904-26-0x00000213DE220000-0x00000213DE230000-memory.dmp

Download

memory/1904-28-0x00000213DE230000-0x00000213DE240000-memory.dmp

Download

memory/1904-32-0x00000213DE240000-0x00000213DE250000-memory.dmp

Download

memory/1904-34-0x00000213DE250000-0x00000213DE260000-memory.dmp

Download

memory/1904-39-0x00000213DE260000-0x00000213DE270000-memory.dmp

Download

memory/1904-41-0x00000213DDF60000-0x00000213DE1D0000-memory.dmp

Download

memory/1904-42-0x00000213DE270000-0x00000213DE280000-memory.dmp

Download

memory/1904-45-0x00000213DE280000-0x00000213DE290000-memory.dmp

Download

memory/1904-44-0x00000213DE1D0000-0x00000213DE1E0000-memory.dmp

Download

memory/1904-49-0x00000213DE290000-0x00000213DE2A0000-memory.dmp

Download

memory/1904-48-0x00000213DE1F0000-0x00000213DE200000-memory.dmp

Download

memory/1904-47-0x00000213DE1E0000-0x00000213DE1F0000-memory.dmp

Download

memory/1904-53-0x00000213DE2A0000-0x00000213DE2B0000-memory.dmp

Download

memory/1904-52-0x00000213DE200000-0x00000213DE210000-memory.dmp

Download

memory/1904-54-0x00000213DE210000-0x00000213DE220000-memory.dmp

Download

memory/1904-55-0x00000213DE2B0000-0x00000213DE2C0000-memory.dmp

Download

memory/1904-59-0x00000213DE220000-0x00000213DE230000-memory.dmp

Download

memory/1904-60-0x00000213DE2C0000-0x00000213DE2D0000-memory.dmp

Download

memory/1904-62-0x00000213DE2D0000-0x00000213DE2E0000-memory.dmp

Download

memory/1904-61-0x00000213DE230000-0x00000213DE240000-memory.dmp

Download

memory/1904-64-0x00000213DE240000-0x00000213DE250000-memory.dmp

Download

memory/1904-65-0x00000213DE2E0000-0x00000213DE2F0000-memory.dmp

Download

memory/1904-70-0x00000213DE300000-0x00000213DE310000-memory.dmp

Download

memory/1904-69-0x00000213DE2F0000-0x00000213DE300000-memory.dmp

Download

memory/1904-68-0x00000213DE250000-0x00000213DE260000-memory.dmp

Download

memory/1904-73-0x00000213DE310000-0x00000213DE320000-memory.dmp

Download

memory/1904-72-0x00000213DE260000-0x00000213DE270000-memory.dmp

Download

memory/1904-81-0x00000213DE340000-0x00000213DE350000-memory.dmp

Download

memory/1904-80-0x00000213DE330000-0x00000213DE340000-memory.dmp

Download

memory/1904-79-0x00000213DE320000-0x00000213DE330000-memory.dmp

Download

memory/1904-84-0x00000213DE350000-0x00000213DE360000-memory.dmp

Download

memory/1904-83-0x00000213DE280000-0x00000213DE290000-memory.dmp

Download

memory/1904-78-0x00000213DE270000-0x00000213DE280000-memory.dmp

Download

memory/1904-86-0x00000213DE360000-0x00000213DE370000-memory.dmp

Download

memory/1904-85-0x00000213DE290000-0x00000213DE2A0000-memory.dmp

Download

memory/1904-91-0x00000213DE2A0000-0x00000213DE2B0000-memory.dmp

Download

memory/1904-92-0x00000213DE370000-0x00000213DE380000-memory.dmp

Download

memory/1904-96-0x00000213DE380000-0x00000213DE390000-memory.dmp

Download

memory/1904-95-0x00000213DE2B0000-0x00000213DE2C0000-memory.dmp

Download

memory/1904-100-0x00000213DE2C0000-0x00000213DE2D0000-memory.dmp

Download

memory/1904-101-0x00000213DE390000-0x00000213DE3A0000-memory.dmp

Download

memory/1904-104-0x00000213DE3A0000-0x00000213DE3B0000-memory.dmp

Download

memory/1904-103-0x00000213DE2D0000-0x00000213DE2E0000-memory.dmp

Download

memory/1904-107-0x00000213DE2E0000-0x00000213DE2F0000-memory.dmp

Download

memory/1904-108-0x00000213DE3B0000-0x00000213DE3C0000-memory.dmp

Download

memory/1904-111-0x00000213DC6F0000-0x00000213DC6F1000-memory.dmp

Download

memory/1904-163-0x00000213DC6F0000-0x00000213DC6F1000-memory.dmp

Download

memory/1904-201-0x00000213DE300000-0x00000213DE310000-memory.dmp

Download

memory/1904-200-0x00000213DE2F0000-0x00000213DE300000-memory.dmp

Download

memory/1904-219-0x00000213DC6F0000-0x00000213DC6F1000-memory.dmp

Download

memory/1904-218-0x00000213DC6F0000-0x00000213DC6F1000-memory.dmp

Download

memory/1904-374-0x00000213DC6F0000-0x00000213DC6F1000-memory.dmp

Download

memory/1904-373-0x00000213DC6F0000-0x00000213DC6F1000-memory.dmp

Download

memory/1904-341-0x00000213DDF60000-0x00000213DEF60000-memory.dmp

Download

memory/1904-604-0x00000213DE310000-0x00000213DE320000-memory.dmp

Download

memory/1904-620-0x00000213DE320000-0x00000213DE330000-memory.dmp

Download

memory/1904-622-0x00000213DE340000-0x00000213DE350000-memory.dmp

Download

memory/1904-621-0x00000213DE330000-0x00000213DE340000-memory.dmp

Download

memory/1904-626-0x00000213DE350000-0x00000213DE360000-memory.dmp

Download

memory/1904-629-0x00000213DE360000-0x00000213DE370000-memory.dmp

Download

memory/1904-633-0x00000213DE370000-0x00000213DE380000-memory.dmp

Download

memory/1904-636-0x00000213DE380000-0x00000213DE390000-memory.dmp

Download

memory/1904-639-0x00000213DE390000-0x00000213DE3A0000-memory.dmp

Download

memory/1904-640-0x00000213DE3A0000-0x00000213DE3B0000-memory.dmp

Download

memory/1904-643-0x00000213DE3B0000-0x00000213DE3C0000-memory.dmp

Download

memory/3440-0-0x0000000000400000-0x000000000041F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads