Analysis
-
max time kernel
145s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
21-12-2024 21:56
Behavioral task
behavioral1
Sample
JaffaCakes118_5e6daa8d3c295c5a0cf8e4e79c0b85fb216ae875d7218c725cbc4195bd0d6a23.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_5e6daa8d3c295c5a0cf8e4e79c0b85fb216ae875d7218c725cbc4195bd0d6a23.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_5e6daa8d3c295c5a0cf8e4e79c0b85fb216ae875d7218c725cbc4195bd0d6a23.exe
-
Size
1.3MB
-
MD5
3054790b27d498c8c829297c5e0a5659
-
SHA1
92d0860380e5475d7e0ba2bdebdbcb59e2b92205
-
SHA256
5e6daa8d3c295c5a0cf8e4e79c0b85fb216ae875d7218c725cbc4195bd0d6a23
-
SHA512
68c89596f5995b742e886f010d355a5e76e399a19ce65c8de68e7dcb804ab491732b97161661e6fb24f19546a0caa0bba28217f15fdb61a52ba4ce6bed3567f6
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Process spawned unexpected child process 12 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1176 624 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2460 624 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3636 624 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2316 624 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5076 624 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2396 624 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3668 624 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 668 624 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1944 624 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2304 624 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4956 624 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4644 624 schtasks.exe 88 -
resource yara_rule behavioral2/files/0x000a000000023b8c-10.dat dcrat behavioral2/memory/4460-13-0x0000000000580000-0x0000000000690000-memory.dmp dcrat -
Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 848 powershell.exe 1316 powershell.exe 1200 powershell.exe 4856 powershell.exe 1212 powershell.exe -
Checks computer location settings 2 TTPs 16 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation DllCommonsvc.exe Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation dllhost.exe Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation dllhost.exe Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation dllhost.exe Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation dllhost.exe Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation dllhost.exe Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation dllhost.exe Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation dllhost.exe Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation JaffaCakes118_5e6daa8d3c295c5a0cf8e4e79c0b85fb216ae875d7218c725cbc4195bd0d6a23.exe Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation dllhost.exe Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation dllhost.exe Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation dllhost.exe Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation dllhost.exe Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation dllhost.exe Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation dllhost.exe -
Executes dropped EXE 14 IoCs
pid Process 4460 DllCommonsvc.exe 4924 dllhost.exe 4392 dllhost.exe 3516 dllhost.exe 4824 dllhost.exe 1884 dllhost.exe 2152 dllhost.exe 2816 dllhost.exe 2308 dllhost.exe 4252 dllhost.exe 1960 dllhost.exe 3540 dllhost.exe 1512 dllhost.exe 3528 dllhost.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 14 IoCs
flow ioc 13 raw.githubusercontent.com 14 raw.githubusercontent.com 40 raw.githubusercontent.com 44 raw.githubusercontent.com 45 raw.githubusercontent.com 52 raw.githubusercontent.com 54 raw.githubusercontent.com 46 raw.githubusercontent.com 53 raw.githubusercontent.com 22 raw.githubusercontent.com 55 raw.githubusercontent.com 56 raw.githubusercontent.com 38 raw.githubusercontent.com 39 raw.githubusercontent.com -
Drops file in Program Files directory 7 IoCs
description ioc Process File created C:\Program Files (x86)\Windows Multimedia Platform\fontdrvhost.exe DllCommonsvc.exe File created C:\Program Files (x86)\Windows Multimedia Platform\5b884080fd4f94 DllCommonsvc.exe File created C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\csrss.exe DllCommonsvc.exe File opened for modification C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\csrss.exe DllCommonsvc.exe File created C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\886983d96e3d3e DllCommonsvc.exe File created C:\Program Files (x86)\Windows Portable Devices\dwm.exe DllCommonsvc.exe File created C:\Program Files (x86)\Windows Portable Devices\6cb0b6c459d5d3 DllCommonsvc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_5e6daa8d3c295c5a0cf8e4e79c0b85fb216ae875d7218c725cbc4195bd0d6a23.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies registry class 14 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings JaffaCakes118_5e6daa8d3c295c5a0cf8e4e79c0b85fb216ae875d7218c725cbc4195bd0d6a23.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings dllhost.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings dllhost.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings dllhost.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings dllhost.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings dllhost.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings dllhost.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings dllhost.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings dllhost.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings dllhost.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings dllhost.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings dllhost.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings dllhost.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings dllhost.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 12 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1944 schtasks.exe 4956 schtasks.exe 1176 schtasks.exe 2460 schtasks.exe 5076 schtasks.exe 2396 schtasks.exe 3668 schtasks.exe 668 schtasks.exe 4644 schtasks.exe 3636 schtasks.exe 2316 schtasks.exe 2304 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 4460 DllCommonsvc.exe 848 powershell.exe 4856 powershell.exe 1316 powershell.exe 1212 powershell.exe 1200 powershell.exe 848 powershell.exe 4924 dllhost.exe 1316 powershell.exe 4856 powershell.exe 1212 powershell.exe 1200 powershell.exe 4392 dllhost.exe 3516 dllhost.exe 4824 dllhost.exe 1884 dllhost.exe 2152 dllhost.exe 2816 dllhost.exe 2308 dllhost.exe 4252 dllhost.exe 1960 dllhost.exe 3540 dllhost.exe 1512 dllhost.exe 3528 dllhost.exe -
Suspicious use of AdjustPrivilegeToken 19 IoCs
description pid Process Token: SeDebugPrivilege 4460 DllCommonsvc.exe Token: SeDebugPrivilege 848 powershell.exe Token: SeDebugPrivilege 4856 powershell.exe Token: SeDebugPrivilege 1316 powershell.exe Token: SeDebugPrivilege 1212 powershell.exe Token: SeDebugPrivilege 1200 powershell.exe Token: SeDebugPrivilege 4924 dllhost.exe Token: SeDebugPrivilege 4392 dllhost.exe Token: SeDebugPrivilege 3516 dllhost.exe Token: SeDebugPrivilege 4824 dllhost.exe Token: SeDebugPrivilege 1884 dllhost.exe Token: SeDebugPrivilege 2152 dllhost.exe Token: SeDebugPrivilege 2816 dllhost.exe Token: SeDebugPrivilege 2308 dllhost.exe Token: SeDebugPrivilege 4252 dllhost.exe Token: SeDebugPrivilege 1960 dllhost.exe Token: SeDebugPrivilege 3540 dllhost.exe Token: SeDebugPrivilege 1512 dllhost.exe Token: SeDebugPrivilege 3528 dllhost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1040 wrote to memory of 4952 1040 JaffaCakes118_5e6daa8d3c295c5a0cf8e4e79c0b85fb216ae875d7218c725cbc4195bd0d6a23.exe 83 PID 1040 wrote to memory of 4952 1040 JaffaCakes118_5e6daa8d3c295c5a0cf8e4e79c0b85fb216ae875d7218c725cbc4195bd0d6a23.exe 83 PID 1040 wrote to memory of 4952 1040 JaffaCakes118_5e6daa8d3c295c5a0cf8e4e79c0b85fb216ae875d7218c725cbc4195bd0d6a23.exe 83 PID 4952 wrote to memory of 4524 4952 WScript.exe 85 PID 4952 wrote to memory of 4524 4952 WScript.exe 85 PID 4952 wrote to memory of 4524 4952 WScript.exe 85 PID 4524 wrote to memory of 4460 4524 cmd.exe 87 PID 4524 wrote to memory of 4460 4524 cmd.exe 87 PID 4460 wrote to memory of 1200 4460 DllCommonsvc.exe 102 PID 4460 wrote to memory of 1200 4460 DllCommonsvc.exe 102 PID 4460 wrote to memory of 4856 4460 DllCommonsvc.exe 103 PID 4460 wrote to memory of 4856 4460 DllCommonsvc.exe 103 PID 4460 wrote to memory of 1316 4460 DllCommonsvc.exe 104 PID 4460 wrote to memory of 1316 4460 DllCommonsvc.exe 104 PID 4460 wrote to memory of 848 4460 DllCommonsvc.exe 105 PID 4460 wrote to memory of 848 4460 DllCommonsvc.exe 105 PID 4460 wrote to memory of 1212 4460 DllCommonsvc.exe 106 PID 4460 wrote to memory of 1212 4460 DllCommonsvc.exe 106 PID 4460 wrote to memory of 4924 4460 DllCommonsvc.exe 112 PID 4460 wrote to memory of 4924 4460 DllCommonsvc.exe 112 PID 4924 wrote to memory of 1556 4924 dllhost.exe 114 PID 4924 wrote to memory of 1556 4924 dllhost.exe 114 PID 1556 wrote to memory of 1844 1556 cmd.exe 116 PID 1556 wrote to memory of 1844 1556 cmd.exe 116 PID 1556 wrote to memory of 4392 1556 cmd.exe 120 PID 1556 wrote to memory of 4392 1556 cmd.exe 120 PID 4392 wrote to memory of 4016 4392 dllhost.exe 131 PID 4392 wrote to memory of 4016 4392 dllhost.exe 131 PID 4016 wrote to memory of 4632 4016 cmd.exe 133 PID 4016 wrote to memory of 4632 4016 cmd.exe 133 PID 4016 wrote to memory of 3516 4016 cmd.exe 135 PID 4016 wrote to memory of 3516 4016 cmd.exe 135 PID 3516 wrote to memory of 1160 3516 dllhost.exe 140 PID 3516 wrote to memory of 1160 3516 dllhost.exe 140 PID 1160 wrote to memory of 3464 1160 cmd.exe 142 PID 1160 wrote to memory of 3464 1160 cmd.exe 142 PID 1160 wrote to memory of 4824 1160 cmd.exe 144 PID 1160 wrote to memory of 4824 1160 cmd.exe 144 PID 4824 wrote to memory of 2268 4824 dllhost.exe 146 PID 4824 wrote to memory of 2268 4824 dllhost.exe 146 PID 2268 wrote to memory of 2848 2268 cmd.exe 148 PID 2268 wrote to memory of 2848 2268 cmd.exe 148 PID 2268 wrote to memory of 1884 2268 cmd.exe 150 PID 2268 wrote to memory of 1884 2268 cmd.exe 150 PID 1884 wrote to memory of 1756 1884 dllhost.exe 152 PID 1884 wrote to memory of 1756 1884 dllhost.exe 152 PID 1756 wrote to memory of 640 1756 cmd.exe 154 PID 1756 wrote to memory of 640 1756 cmd.exe 154 PID 1756 wrote to memory of 2152 1756 cmd.exe 156 PID 1756 wrote to memory of 2152 1756 cmd.exe 156 PID 2152 wrote to memory of 3472 2152 dllhost.exe 158 PID 2152 wrote to memory of 3472 2152 dllhost.exe 158 PID 3472 wrote to memory of 3688 3472 cmd.exe 160 PID 3472 wrote to memory of 3688 3472 cmd.exe 160 PID 3472 wrote to memory of 2816 3472 cmd.exe 162 PID 3472 wrote to memory of 2816 3472 cmd.exe 162 PID 2816 wrote to memory of 4648 2816 dllhost.exe 164 PID 2816 wrote to memory of 4648 2816 dllhost.exe 164 PID 4648 wrote to memory of 2436 4648 cmd.exe 166 PID 4648 wrote to memory of 2436 4648 cmd.exe 166 PID 4648 wrote to memory of 2308 4648 cmd.exe 168 PID 4648 wrote to memory of 2308 4648 cmd.exe 168 PID 2308 wrote to memory of 2852 2308 dllhost.exe 170 PID 2308 wrote to memory of 2852 2308 dllhost.exe 170 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5e6daa8d3c295c5a0cf8e4e79c0b85fb216ae875d7218c725cbc4195bd0d6a23.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5e6daa8d3c295c5a0cf8e4e79c0b85fb216ae875d7218c725cbc4195bd0d6a23.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1040 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\providercommon\DllCommonsvc.exe"C:\providercommon\DllCommonsvc.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1200
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\csrss.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4856
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\dllhost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1316
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Portable Devices\dwm.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:848
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Multimedia Platform\fontdrvhost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1212
-
-
C:\providercommon\dllhost.exe"C:\providercommon\dllhost.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\lcLsEvVTrf.bat"6⤵
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:27⤵PID:1844
-
-
C:\providercommon\dllhost.exe"C:\providercommon\dllhost.exe"7⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\WzmeI2KvQx.bat"8⤵
- Suspicious use of WriteProcessMemory
PID:4016 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:29⤵PID:4632
-
-
C:\providercommon\dllhost.exe"C:\providercommon\dllhost.exe"9⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3516 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\hevtjRcN1r.bat"10⤵
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:211⤵PID:3464
-
-
C:\providercommon\dllhost.exe"C:\providercommon\dllhost.exe"11⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\dekjrv1PTF.bat"12⤵
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:213⤵PID:2848
-
-
C:\providercommon\dllhost.exe"C:\providercommon\dllhost.exe"13⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\uMS4yFj28m.bat"14⤵
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:215⤵PID:640
-
-
C:\providercommon\dllhost.exe"C:\providercommon\dllhost.exe"15⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\jaxwQXfGLd.bat"16⤵
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:217⤵PID:3688
-
-
C:\providercommon\dllhost.exe"C:\providercommon\dllhost.exe"17⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\uMS4yFj28m.bat"18⤵
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:219⤵PID:2436
-
-
C:\providercommon\dllhost.exe"C:\providercommon\dllhost.exe"19⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\8NcI1AeIbp.bat"20⤵PID:2852
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:221⤵PID:4024
-
-
C:\providercommon\dllhost.exe"C:\providercommon\dllhost.exe"21⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4252 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\qUPyb5cGVE.bat"22⤵PID:632
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:223⤵PID:2264
-
-
C:\providercommon\dllhost.exe"C:\providercommon\dllhost.exe"23⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1960 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\pdW26R6SPG.bat"24⤵PID:404
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:225⤵PID:4932
-
-
C:\providercommon\dllhost.exe"C:\providercommon\dllhost.exe"25⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3540 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\biigBqxW9T.bat"26⤵PID:3544
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:227⤵PID:468
-
-
C:\providercommon\dllhost.exe"C:\providercommon\dllhost.exe"27⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1512 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Yvohz7Nokj.bat"28⤵PID:2636
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:229⤵PID:512
-
-
C:\providercommon\dllhost.exe"C:\providercommon\dllhost.exe"29⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3528 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\L59TFxmxil.bat"30⤵PID:8
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:231⤵PID:1588
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\csrss.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1176
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2460
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3636
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\providercommon\dllhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2316
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\providercommon\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5076
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\providercommon\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2396
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Portable Devices\dwm.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3668
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:668
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Portable Devices\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1944
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\fontdrvhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2304
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Multimedia Platform\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4956
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4644
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5baf55b95da4a601229647f25dad12878
SHA1abc16954ebfd213733c4493fc1910164d825cac8
SHA256ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
SHA51224f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD56d3e9c29fe44e90aae6ed30ccf799ca8
SHA1c7974ef72264bbdf13a2793ccf1aed11bc565dce
SHA2562360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d
SHA51260c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a
-
Filesize
944B
MD52e907f77659a6601fcc408274894da2e
SHA19f5b72abef1cd7145bf37547cdb1b9254b4efe9d
SHA256385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233
SHA51234fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721
-
Filesize
194B
MD58b72936f81f1e51cd9698ca35ed4576c
SHA15a0fd11c780eb13d1d107bd50de39ba7ff9c0a1c
SHA2563818023cda76c2639415e552b8a9934ec86ad74b70acaea5d6ae4007531cf1ff
SHA512199d9797632b755ce21209f66fe8ab262d42aa963061bf50cea457d6095f0325961904eda191fedd8dd81c615d856f25f66442b925a555ec213c164e721ff8ef
-
Filesize
194B
MD50a2a3cbb825d021ee8ab93b370be7bc4
SHA16608d25a38b63eafe392f50c30de7197af7ae33b
SHA256c50ccd5bbe8565b57899dcf1c1fa21ce1a86d376ac112d980c18ab0b421d5783
SHA5129e17606586514de132b2e98d22527ea0b5f307a087aa38bf6f7384a23628714d80c3b61f4ff51bc1d17ad162cf1c496831fdccc1ca11852e6edf692f56c3c656
-
Filesize
194B
MD5b07cf2b94d6b94337259752f7ae6a9d0
SHA1b992ae4f28e32ab1daed35242c70d0867909dfed
SHA2564722bbac82f4a6f3e82be8b0f519e9c77f031f9a064f5977fafcab0b709dbf0d
SHA5121664daa03b04cc1a89926573721862824c6fef7600eef60ab0618d6d0184b8d385f9b083fd759d57e37a715dd5e56b478ec88d5662c4eea3540469507daf92c1
-
Filesize
194B
MD54a498ef27158f97c470680da95df221e
SHA12304eabe259113ee0184e8c447393d8c10627fad
SHA256007aad7788f0ca04755973182965e7245c2a6478deb934211d48c9280992a5f5
SHA51294875e1c10f46b4d36a084ece47cf2d877117b5b96d4c2af318c8b23d7be69a7ee94cc4536c3d30af7556856a931138b07169c50085c15f17a4023e56b1e1c61
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
194B
MD58d467fa2b286a3219d772b290f619c03
SHA15e8d7c9a77dd7881e3b5764e7f2aebbf63a00829
SHA2568890c11c286df4117c6ee7b200c0979a2b7f26f3a05c424081a75a115261790b
SHA512ed405dc59fdb5d5648f95956b8d5dafdcd6f216866e3a4b4c477cc99c3af3cb57220a44d06193b06ae08550b73e35740cd8a073e70091a5f4ad99a0c85376072
-
Filesize
194B
MD5d2fd3119ff738c5542ae71bdd549647e
SHA10442ae7a423310ffdc6fff135a3dea9de0b1514a
SHA2566809f22d1855237924e6bad41e4a8a4fb3993b004538c06dc64d5f4af85f4312
SHA512033ef1c6a2fb03eb4ae32e5ad77a1c29d4e519c43414474937aa2edd1f6730cc48d53aeee9767cef6889e24e99a2a12a046cc6dd8f108bd8f162d2cd74a19cf5
-
Filesize
194B
MD58d60158b16791d8a91246ce6fec7898d
SHA1ecde7996b6cc51068e549f646349e2ef637ce047
SHA256ae4b64606aad75c91d099f629102aa000ce5fb2c422e1183a71d68c59b780c3e
SHA51228d4ab5be5cd44af161f174198d35c6074d4fd9765d6346fb557246fea934c88fc0adcf013d60c8bf39e726753985e056028d8c23105441113917b9cb83d6b8d
-
Filesize
194B
MD545a94d8d042c9923f1e6977964a27aee
SHA1e83fd596f348b902e7c3e7a058f42ba9e008f026
SHA256be6ac125bee9f7c8e59c059baf06f55cf403b268a18bb669f417800d144a0496
SHA512d94048b90f8f28a4ba3f0e4792efa910098407e28a96501e2cea3b0cef9941ac8ef938f773b0392a18c4e7c65bf69e3de3023112f4a6fe7cadb911615e68c27d
-
Filesize
194B
MD53a126f6b39e60df90552823a58a16233
SHA175e32ab5de4a53733876eb0dacb5f798a546f6cf
SHA256070d8d5a7203fae4c5c489e905390fc1302ac6edf8eded6d1c28be5dc2cd5931
SHA512b6f4e4eed59523b9e4d9b4a3e046784a66f0d32cb778ec483b3e56e237e0c3115ce63e107bbdf10a3b5b25f198de4d1091fa76301b09e04e9304c17476a0f349
-
Filesize
194B
MD5519ee7643858aee07ab12e3e5bbea84b
SHA1da0c50ff8fabdb3b9c00768bed443adb2374984f
SHA2567b475765455f80b41b4281bb1abbfad4f7d26f1c27a8fc4636edbbda7b217361
SHA512ee6a0cd175ee9530fbfd48efc106a36eea9b8a1c9777435241f73635db3cd48bece5e6cebfb0ae85a07de0b793a239671d6c9c89e6ff5c1a055acf0e46a878db
-
Filesize
194B
MD56a40ae8c12d2b6d451742738895f16b3
SHA13b4ecf622365b2899e7c6e6e34631b68694e73b4
SHA2560d8fdfd556c9a8b2fe152fa8902599fea2d0a284df131c73d12deb9a97f40195
SHA51257d2fa903cf8179078f6e7979b4917a320afa0e5bd17090bc5e438fe72692f9faea92c74aae6db68cb97f558cdf886be899c55c5e5322f3234a3f5d4e3f49358
-
Filesize
194B
MD59f1e764927632ab2edcd3a9f0e45d039
SHA132cdf6347cd6d17a7a142cc33e81b95f329ee50f
SHA256bcdcff32561e4b5a45d35cea26625c5ab5a29ae267088ed02228e4ffbafcbae3
SHA512edce4dba091c2760d036321c7c54063ad52be1b5e74a77b6e6342c35ab6dd2e2767202314300bd48e166a679c12753fa6e7b26d81bc5f58e08bb29961b36b4e7
-
Filesize
36B
MD56783c3ee07c7d151ceac57f1f9c8bed7
SHA117468f98f95bf504cc1f83c49e49a78526b3ea03
SHA2568ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322
SHA512c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8
-
Filesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
Filesize
197B
MD58088241160261560a02c84025d107592
SHA1083121f7027557570994c9fc211df61730455bb5
SHA2562072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1
SHA51220d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478