Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
21-12-2024 21:51
Behavioral task
behavioral1
Sample
JaffaCakes118_6200304e01bf04f6296375c4a993626d63f944dcb784959487ede238d23c104a.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_6200304e01bf04f6296375c4a993626d63f944dcb784959487ede238d23c104a.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_6200304e01bf04f6296375c4a993626d63f944dcb784959487ede238d23c104a.exe
-
Size
1.3MB
-
MD5
56bf1c5e7ebee7b693c076b7ce915bfc
-
SHA1
59e16c886da3ab440f5e3b2df4e9a97f0af411ea
-
SHA256
6200304e01bf04f6296375c4a993626d63f944dcb784959487ede238d23c104a
-
SHA512
43d90d2cabff9b39d951565d1e4d8ac0f763bdb0ec5234b1b51ec3ce8e1ead298474fb2ba646a8d31e75f2ec69711b4eeb84b3a318d2014248f3002f3a136ea2
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Process spawned unexpected child process 21 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2764 2748 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2888 2748 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2624 2748 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2868 2748 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1168 2748 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2612 2748 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2772 2748 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1936 2748 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1068 2748 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1572 2748 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1652 2748 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2860 2748 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1812 2748 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 800 2748 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1496 2748 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2508 2748 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1808 2748 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 388 2748 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1588 2748 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1640 2748 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1916 2748 schtasks.exe 34 -
resource yara_rule behavioral1/files/0x0008000000016c53-10.dat dcrat behavioral1/memory/2208-13-0x00000000013D0000-0x00000000014E0000-memory.dmp dcrat behavioral1/memory/1212-76-0x00000000012B0000-0x00000000013C0000-memory.dmp dcrat behavioral1/memory/2896-431-0x0000000000200000-0x0000000000310000-memory.dmp dcrat behavioral1/memory/2056-491-0x0000000001260000-0x0000000001370000-memory.dmp dcrat behavioral1/memory/700-551-0x00000000013A0000-0x00000000014B0000-memory.dmp dcrat -
Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2924 powershell.exe 2928 powershell.exe 3056 powershell.exe 3028 powershell.exe 2372 powershell.exe 2944 powershell.exe 2932 powershell.exe 2916 powershell.exe -
Executes dropped EXE 12 IoCs
pid Process 2208 DllCommonsvc.exe 1212 conhost.exe 2028 conhost.exe 1808 conhost.exe 3028 conhost.exe 2584 conhost.exe 2300 conhost.exe 2896 conhost.exe 2056 conhost.exe 700 conhost.exe 1260 conhost.exe 2784 conhost.exe -
Loads dropped DLL 2 IoCs
pid Process 2088 cmd.exe 2088 cmd.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 11 IoCs
flow ioc 26 raw.githubusercontent.com 29 raw.githubusercontent.com 33 raw.githubusercontent.com 9 raw.githubusercontent.com 5 raw.githubusercontent.com 13 raw.githubusercontent.com 16 raw.githubusercontent.com 20 raw.githubusercontent.com 23 raw.githubusercontent.com 36 raw.githubusercontent.com 4 raw.githubusercontent.com -
Drops file in Program Files directory 4 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\Office14\1033\sppsvc.exe DllCommonsvc.exe File created C:\Program Files\Microsoft Office\Office14\1033\0a1fd5f707cd16 DllCommonsvc.exe File created C:\Program Files\Uninstall Information\conhost.exe DllCommonsvc.exe File created C:\Program Files\Uninstall Information\088424020bedd6 DllCommonsvc.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\diagnostics\system\HomeGroup\en-US\sppsvc.exe DllCommonsvc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_6200304e01bf04f6296375c4a993626d63f944dcb784959487ede238d23c104a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 21 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2624 schtasks.exe 1168 schtasks.exe 2612 schtasks.exe 388 schtasks.exe 1640 schtasks.exe 2764 schtasks.exe 2772 schtasks.exe 1068 schtasks.exe 1572 schtasks.exe 1496 schtasks.exe 2508 schtasks.exe 2888 schtasks.exe 1652 schtasks.exe 2860 schtasks.exe 800 schtasks.exe 1588 schtasks.exe 1916 schtasks.exe 2868 schtasks.exe 1936 schtasks.exe 1812 schtasks.exe 1808 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 2208 DllCommonsvc.exe 2924 powershell.exe 2372 powershell.exe 2928 powershell.exe 2944 powershell.exe 3028 powershell.exe 2932 powershell.exe 2916 powershell.exe 3056 powershell.exe 1212 conhost.exe 2028 conhost.exe 1808 conhost.exe 3028 conhost.exe 2584 conhost.exe 2300 conhost.exe 2896 conhost.exe 2056 conhost.exe 700 conhost.exe 1260 conhost.exe 2784 conhost.exe -
Suspicious use of AdjustPrivilegeToken 20 IoCs
description pid Process Token: SeDebugPrivilege 2208 DllCommonsvc.exe Token: SeDebugPrivilege 2924 powershell.exe Token: SeDebugPrivilege 2372 powershell.exe Token: SeDebugPrivilege 2928 powershell.exe Token: SeDebugPrivilege 2944 powershell.exe Token: SeDebugPrivilege 3028 powershell.exe Token: SeDebugPrivilege 2932 powershell.exe Token: SeDebugPrivilege 2916 powershell.exe Token: SeDebugPrivilege 3056 powershell.exe Token: SeDebugPrivilege 1212 conhost.exe Token: SeDebugPrivilege 2028 conhost.exe Token: SeDebugPrivilege 1808 conhost.exe Token: SeDebugPrivilege 3028 conhost.exe Token: SeDebugPrivilege 2584 conhost.exe Token: SeDebugPrivilege 2300 conhost.exe Token: SeDebugPrivilege 2896 conhost.exe Token: SeDebugPrivilege 2056 conhost.exe Token: SeDebugPrivilege 700 conhost.exe Token: SeDebugPrivilege 1260 conhost.exe Token: SeDebugPrivilege 2784 conhost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1800 wrote to memory of 2544 1800 JaffaCakes118_6200304e01bf04f6296375c4a993626d63f944dcb784959487ede238d23c104a.exe 30 PID 1800 wrote to memory of 2544 1800 JaffaCakes118_6200304e01bf04f6296375c4a993626d63f944dcb784959487ede238d23c104a.exe 30 PID 1800 wrote to memory of 2544 1800 JaffaCakes118_6200304e01bf04f6296375c4a993626d63f944dcb784959487ede238d23c104a.exe 30 PID 1800 wrote to memory of 2544 1800 JaffaCakes118_6200304e01bf04f6296375c4a993626d63f944dcb784959487ede238d23c104a.exe 30 PID 2544 wrote to memory of 2088 2544 WScript.exe 31 PID 2544 wrote to memory of 2088 2544 WScript.exe 31 PID 2544 wrote to memory of 2088 2544 WScript.exe 31 PID 2544 wrote to memory of 2088 2544 WScript.exe 31 PID 2088 wrote to memory of 2208 2088 cmd.exe 33 PID 2088 wrote to memory of 2208 2088 cmd.exe 33 PID 2088 wrote to memory of 2208 2088 cmd.exe 33 PID 2088 wrote to memory of 2208 2088 cmd.exe 33 PID 2208 wrote to memory of 2944 2208 DllCommonsvc.exe 56 PID 2208 wrote to memory of 2944 2208 DllCommonsvc.exe 56 PID 2208 wrote to memory of 2944 2208 DllCommonsvc.exe 56 PID 2208 wrote to memory of 2932 2208 DllCommonsvc.exe 57 PID 2208 wrote to memory of 2932 2208 DllCommonsvc.exe 57 PID 2208 wrote to memory of 2932 2208 DllCommonsvc.exe 57 PID 2208 wrote to memory of 2916 2208 DllCommonsvc.exe 58 PID 2208 wrote to memory of 2916 2208 DllCommonsvc.exe 58 PID 2208 wrote to memory of 2916 2208 DllCommonsvc.exe 58 PID 2208 wrote to memory of 2924 2208 DllCommonsvc.exe 59 PID 2208 wrote to memory of 2924 2208 DllCommonsvc.exe 59 PID 2208 wrote to memory of 2924 2208 DllCommonsvc.exe 59 PID 2208 wrote to memory of 2928 2208 DllCommonsvc.exe 60 PID 2208 wrote to memory of 2928 2208 DllCommonsvc.exe 60 PID 2208 wrote to memory of 2928 2208 DllCommonsvc.exe 60 PID 2208 wrote to memory of 3056 2208 DllCommonsvc.exe 61 PID 2208 wrote to memory of 3056 2208 DllCommonsvc.exe 61 PID 2208 wrote to memory of 3056 2208 DllCommonsvc.exe 61 PID 2208 wrote to memory of 3028 2208 DllCommonsvc.exe 62 PID 2208 wrote to memory of 3028 2208 DllCommonsvc.exe 62 PID 2208 wrote to memory of 3028 2208 DllCommonsvc.exe 62 PID 2208 wrote to memory of 2372 2208 DllCommonsvc.exe 63 PID 2208 wrote to memory of 2372 2208 DllCommonsvc.exe 63 PID 2208 wrote to memory of 2372 2208 DllCommonsvc.exe 63 PID 2208 wrote to memory of 1212 2208 DllCommonsvc.exe 72 PID 2208 wrote to memory of 1212 2208 DllCommonsvc.exe 72 PID 2208 wrote to memory of 1212 2208 DllCommonsvc.exe 72 PID 1212 wrote to memory of 1500 1212 conhost.exe 74 PID 1212 wrote to memory of 1500 1212 conhost.exe 74 PID 1212 wrote to memory of 1500 1212 conhost.exe 74 PID 1500 wrote to memory of 2660 1500 cmd.exe 76 PID 1500 wrote to memory of 2660 1500 cmd.exe 76 PID 1500 wrote to memory of 2660 1500 cmd.exe 76 PID 1500 wrote to memory of 2028 1500 cmd.exe 77 PID 1500 wrote to memory of 2028 1500 cmd.exe 77 PID 1500 wrote to memory of 2028 1500 cmd.exe 77 PID 2028 wrote to memory of 780 2028 conhost.exe 78 PID 2028 wrote to memory of 780 2028 conhost.exe 78 PID 2028 wrote to memory of 780 2028 conhost.exe 78 PID 780 wrote to memory of 2952 780 cmd.exe 80 PID 780 wrote to memory of 2952 780 cmd.exe 80 PID 780 wrote to memory of 2952 780 cmd.exe 80 PID 780 wrote to memory of 1808 780 cmd.exe 81 PID 780 wrote to memory of 1808 780 cmd.exe 81 PID 780 wrote to memory of 1808 780 cmd.exe 81 PID 1808 wrote to memory of 2228 1808 conhost.exe 82 PID 1808 wrote to memory of 2228 1808 conhost.exe 82 PID 1808 wrote to memory of 2228 1808 conhost.exe 82 PID 2228 wrote to memory of 2244 2228 cmd.exe 84 PID 2228 wrote to memory of 2244 2228 cmd.exe 84 PID 2228 wrote to memory of 2244 2228 cmd.exe 84 PID 2228 wrote to memory of 3028 2228 cmd.exe 85 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6200304e01bf04f6296375c4a993626d63f944dcb784959487ede238d23c104a.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6200304e01bf04f6296375c4a993626d63f944dcb784959487ede238d23c104a.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\providercommon\1zu9dW.bat" "3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\providercommon\DllCommonsvc.exe"C:\providercommon\DllCommonsvc.exe"4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2944
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\WmiPrvSE.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2932
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\OSPPSVC.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2916
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\OSPPSVC.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2924
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\dwm.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2928
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\csrss.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3056
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Microsoft Office\Office14\1033\sppsvc.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3028
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Uninstall Information\conhost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2372
-
-
C:\Program Files\Uninstall Information\conhost.exe"C:\Program Files\Uninstall Information\conhost.exe"5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\BGyPdaK1JU.bat"6⤵
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:27⤵PID:2660
-
-
C:\Program Files\Uninstall Information\conhost.exe"C:\Program Files\Uninstall Information\conhost.exe"7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\YpSpsobUXT.bat"8⤵
- Suspicious use of WriteProcessMemory
PID:780 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:29⤵PID:2952
-
-
C:\Program Files\Uninstall Information\conhost.exe"C:\Program Files\Uninstall Information\conhost.exe"9⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\5EJ4eIa89C.bat"10⤵
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:211⤵PID:2244
-
-
C:\Program Files\Uninstall Information\conhost.exe"C:\Program Files\Uninstall Information\conhost.exe"11⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3028 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\DGa94wSM8j.bat"12⤵PID:1964
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:213⤵PID:1168
-
-
C:\Program Files\Uninstall Information\conhost.exe"C:\Program Files\Uninstall Information\conhost.exe"13⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2584 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\MKE9IzBoeI.bat"14⤵PID:2420
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:215⤵PID:1444
-
-
C:\Program Files\Uninstall Information\conhost.exe"C:\Program Files\Uninstall Information\conhost.exe"15⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2300 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\RnBkS9jGYw.bat"16⤵PID:2140
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:217⤵PID:2916
-
-
C:\Program Files\Uninstall Information\conhost.exe"C:\Program Files\Uninstall Information\conhost.exe"17⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2896 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\cRRFCwJQFV.bat"18⤵PID:1656
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:219⤵PID:2624
-
-
C:\Program Files\Uninstall Information\conhost.exe"C:\Program Files\Uninstall Information\conhost.exe"19⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2056 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\EH4KCibIlQ.bat"20⤵PID:2892
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:221⤵PID:948
-
-
C:\Program Files\Uninstall Information\conhost.exe"C:\Program Files\Uninstall Information\conhost.exe"21⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:700 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\D2zd9hDRps.bat"22⤵PID:2152
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:223⤵PID:2908
-
-
C:\Program Files\Uninstall Information\conhost.exe"C:\Program Files\Uninstall Information\conhost.exe"23⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1260 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\hJP5Gj8VmP.bat"24⤵PID:2060
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:225⤵PID:2688
-
-
C:\Program Files\Uninstall Information\conhost.exe"C:\Program Files\Uninstall Information\conhost.exe"25⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2784
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\WmiPrvSE.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2764
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\WmiPrvSE.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2888
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\WmiPrvSE.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2624
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 6 /tr "'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\OSPPSVC.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2868
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\OSPPSVC.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1168
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 13 /tr "'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\OSPPSVC.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2612
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 11 /tr "'C:\providercommon\OSPPSVC.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2772
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\providercommon\OSPPSVC.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1936
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 11 /tr "'C:\providercommon\OSPPSVC.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1068
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\providercommon\dwm.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1572
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\providercommon\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1652
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 5 /tr "'C:\providercommon\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2860
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\csrss.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1812
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:800
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1496
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 9 /tr "'C:\Program Files\Microsoft Office\Office14\1033\sppsvc.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2508
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\Office14\1033\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1808
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 9 /tr "'C:\Program Files\Microsoft Office\Office14\1033\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:388
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 13 /tr "'C:\Program Files\Uninstall Information\conhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1588
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\conhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1640
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\Program Files\Uninstall Information\conhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1916
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bf9af3c6280a01a4897e5e546f9c3b07
SHA167738086ca84032629b2dc4c586f5fd6f31d2377
SHA25601961287dee9a4ebd0a6a7e1d7b155d82a2a70f4e9116f4c2ec1ee723a776ea5
SHA51243b00396bd261caee47ab29671fbe884116013b4ea4ce4868d5229207a0e195b45815c8a0660d4680427278c6f51e4e313f88a40c222078c93cc5deeea9926cb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5043c901fee71b315582d6a6f461f07bd
SHA143fa4bf47732d6facb1434464b3325e0c4afbd64
SHA256cd6a2cf19081935896c52ee31ab72a30757551b2ff41f6650d5fdce3c8e8d5fd
SHA51260e0e623c136d49aba6d345860bd92cc44e6590d8a6f20660751a35f1ff46660119b20288e3a907fb14ba609ffb828fd000cc25e8479a3d868325eea31e3de5f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55d8f9f0c1988a5481d70b33416fa4d43
SHA1be042de028ff4c901796028b41deab94a6f12904
SHA256eaad537dc4161e7757c030c26578559529975e27677f1f401ec4545f2e2250e7
SHA512e629def52f463eaa13e028161289a59c711950eaf885a3afefaeb73a38fe74a96ea5a1711f4bf6fe4abcf98c7b1cab9c2baacb5f0f4e648a6915636574f8fcb0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53e8c2eaca4b327b3e28ff3206cfadd0c
SHA1fbe39b279086fb37ec873e531395aa42e50492a5
SHA2567be10c3e2d51ea2f75a4e410d512d0a64757a962ac72701002494d69b921a071
SHA5121096d64e8b5f016f91e0e457db66fbf0f66b828c26f8d984dc251791a441625789c4fb89474731e9f89b33719ac65963892945d404d0ff5466da31b4dab35d8e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5efb168673f4a00d0e882617e1a7b1682
SHA16c2d09a9248f07c36fd1d17014b9a4ce9d6a80cc
SHA256f0a89638ae887b6183e0a4a026719cbab9134a54610adfdfc50481b0d2117db4
SHA5120e7665cb27ff76c1c752ab940a046ae06e07ad55bc8b37e6fb16f164c963d9e8760eacffa92a8b28d7a2be2f8e225830e9af61870b751644150bb669b32d24b3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f3fab6832fbe69a864d09d991986a7d9
SHA1a172367f2daf7369b551e980fcbc1d77215348d8
SHA2569f87cd35f1cfca03c380c2466506c1b30f249445211a1f7c0448908b364c7c42
SHA5128a2a570e3b31ce01ac53cad3490d1d1b398806df5483fe1b23472d9d64a6a64d58848d7d8a2f8a7ebffff1630a98f5efc07285dfcc82139a8b7d925402c7dc81
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5413f4ca3f097aaea3e6f91fe7620c40b
SHA17815d42f5aa21aee460b7185bfcd7d3e9628a52f
SHA256f1e0f569a1c1689b9874cab1db8bcae67189588d4d83b9df57dea54d2cfffc86
SHA5123d43cb42f5f9b84b2db1b666d1cb0b903b146887d3961150357f9a7712480e9d5ed7ea571ab881ff9bf3d690aae549a1f253b4ea824ea64f46b6baf401d41f97
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD555d44eb47316117bc1d9989244002bde
SHA1fec65d19e9f307e12075c93b5e438208ae6de57e
SHA256608f0b4b60bffec2ea11429c83f07db655732d980791b22834af5e47dc0969f3
SHA5122ee0e3c1cef679dbb8b0cbb6e38b0f72be2a7e5ea5f81336c86a600686027d4c3ed12139156a2e335e3ec55b059daefec3005a1cf25e50f70628d7e07b78bce9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fa8a4d7b6025d9810e7417548416d821
SHA1ba68cd1c0b984d1d5216b3261671f9e998059aef
SHA256788f3b3e2206f705499fc4a97f539ad674875f7ed6625b4d10c17478427347ca
SHA51238f18674c9e9cd14c07d43463c26f106ca0511bbd62f3b2f49f5abcec76a5893e5b3ebe0577c248f515519c390346c524c9daec67b711c1d7fae6ebfebeec968
-
Filesize
215B
MD58269fb1db1719402c52efe2bbefa5fe4
SHA1361680a0580339b5b454f176386fffcedea07659
SHA25629b545e99976b72b1380f75fb199d5d157884056a37eaaeb8bb935b44ea0a4cd
SHA51225ecc48cb6029cd05bc116f408e973b34dd48fc2fad699cdba2cb16ea32e9a85d281bf70674a6a7ac11c0eca824f50e7d76e69d3e5ae20e44a87817ad9ddf166
-
Filesize
215B
MD575de50e85f5d8b7ae9f830f7a7f141b4
SHA1f28bd29363af4c0301cc5e078f5f015c42de0b7f
SHA256fb1e8fcc0af82d53d744c2083b58bba5533ad0ffc35e34b13ecfa12dba480e7c
SHA512190ed839e76e07b0bd43020e8c834c4e20c278cc8b09dbce38a6059b3034a79005f55f0b9df701206cf6133983e1be1cb06a088736e4da441f1eec1cc4bed809
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
215B
MD595c29853478f3af65e75ecab410a646a
SHA1e1cf570dbc151ef90d89932fb848becf15b657eb
SHA2566e3d693f9340899d1152285fc3e3778c1d9701e839b3bad0b9f1674eedd11673
SHA512a766a935116d2287c724441995a3e5ae9758e9b6c0f54b1f97791d497620ae9aeee035e688beb7e98b87b8aefa768b6be63ef57f7360d7e66e07f760023b99f8
-
Filesize
215B
MD5e9d044b809db4fd1019d72038a1e51c1
SHA1bcd454b38e9de230ddd36114d90d2e0868d5e7b1
SHA256f0581397446eab4d5f5a9b43ab510bcff08f7a025fe9a27fcb8b238d93224da0
SHA512955620eee07ad20d46152ebacd38c46a60bc140a764fc1daf5218eae6570069f8bc9274395caeecd42d67a5baceac8635fedfe7ae51c793f17b84ec3512c78f5
-
Filesize
215B
MD573dd4ffc6a3460b037d4a867885e0968
SHA1a82d7f8e9f3659d12313221e35425260f104ef3a
SHA256dd1a83780542bcbe2a9f6974a98a5a47788ef02b16a561b859e97b9c366b7fbf
SHA5122e43353743b0c40df6c4492e370c5fb1c943f1005ac25d4b114f96b2686029ed0fa5534c8a444a779d12b4b2973cf65b482e3d437369f25aa816f3f4454398c4
-
Filesize
215B
MD5a28512446fddd05537f6620223889055
SHA192a24a40b7e0f2f7c083f03dfac420afcf479f1d
SHA256530f32ff5803669e9304e8214b1ec97e4af95bc7a084b5aa2d81629997ed32e2
SHA512272fb8f0da7aef813767b2acb714d87af1e7dca1178bb89814e34daef8018eee38c59c955988ba3eeea2484876d2f573bafc839099f8fed0dd6b2c7a9235babb
-
Filesize
215B
MD57f048eeb911aafbed5feb023af5ed9fb
SHA133796bc2522d2459b831986fd71ea2a6c8204caf
SHA25679fa799823d90a5e08e9f4984e405525472c1554c1110d02dc8930006edeef61
SHA512c9fd4abb840f48004e36045d2f23017801ce02da5de4b80e1aff9ee78c6f3eda59f027bb9adb201bf78bc93154a7047275e5be03260aded9f4311ff545a4a124
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
215B
MD5e58bae62af713a1234e6120663016889
SHA1084caeb99678b0edb6af1712b773fd218801882d
SHA256450eb648982f78dd785f9745b81a8b8fbfba2086dde7cbd8623e8be1bafae8d3
SHA512a5eee4069ce0514177cd8ae376f15330108e9af43c2fb8fef60a83e2d5ef0d3aa0f955f6f1738ce652fad59e8adfdf07c94974251949f5b314b9c05c18004e4b
-
Filesize
215B
MD5bdd17119f24d70502d54b7a4e2b00f18
SHA14f71dbfdbf9c901a499478b691e9f2abb8d43a39
SHA2569df68a83fe4f0501fdc02970e9cb6bd9d9f88ce95539d6992cd7781bcaba6492
SHA512bcb06ccfd5cb8fc192258bdf96e8a8b4bd469e97d641886d4577183e9f1eb10380b68fc56b06b9753e015a96e1f890d2b7c6163d1b65ad0a34cf9f950dd1e3de
-
Filesize
215B
MD5dad14a6c3fbd7491da4d17f33b6803bf
SHA1370cbebd3cf09818191014748bf2b464febb40d2
SHA256d8874a8342a56873b6e046f697aeae38518386ce1a714735c9b8d6a2f2a6b85d
SHA512d757e24785354fb223686e3b645735fce332d199c884c0300cc0f954c95794c3dfff6b3b6a4b3ba50463a2424d21a5c777c6f3cb917bd9383fb5bd5476ffb4d0
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD5948d9487f1fd20f27d4b3a9c024a9b49
SHA1f5f7297dea74657d9a207610df99811b36be1a29
SHA256f22d2e2d36779e29a86ee1f6ffa703587a2120550315151b34543270b433dfdd
SHA5125d4e38b76c8529911fbb6ca656e4f96b89e0a464dec517bd1ce53e53f975ff4903f7521581a42e5d4c7ba331c84cbb9e596f1004dfd8252aecf5416d997eca9d
-
Filesize
36B
MD56783c3ee07c7d151ceac57f1f9c8bed7
SHA117468f98f95bf504cc1f83c49e49a78526b3ea03
SHA2568ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322
SHA512c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8
-
Filesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
Filesize
197B
MD58088241160261560a02c84025d107592
SHA1083121f7027557570994c9fc211df61730455bb5
SHA2562072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1
SHA51220d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478