dcrat | 364532c577bd7b6231ab88362d4377d2c665ea92f07de32746fe5a0bd4046341

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21-12-2024 22:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_364532c577bd7b6231ab88362d4377d2c665ea92f07de32746fe5a0bd4046341.exe
Size

1.3MB
MD5

b9b44c07c3f43d735fd8ce9d90e32cfa
SHA1

e119216e3abfa510fbd3eb8a6cf72153a054ffbc
SHA256

364532c577bd7b6231ab88362d4377d2c665ea92f07de32746fe5a0bd4046341
SHA512

b285303ea67facf0cee1ad524cbcf2241ee842431470e24639d2f26551324599ceb0edd7bda03204819af7bce26f90ec837810830ac0e38fc047b717a136b95d
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 6 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1416	2856	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2776	2856	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2840	2856	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2784	2856	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2664	2856	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2628	2856	schtasks.exe	35

DCRat payload 10 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0008000000016dd1-12.dat	dcrat
behavioral1/memory/872-13-0x0000000001090000-0x00000000011A0000-memory.dmp	dcrat
behavioral1/memory/556-38-0x0000000000FC0000-0x00000000010D0000-memory.dmp	dcrat
behavioral1/memory/804-162-0x00000000013D0000-0x00000000014E0000-memory.dmp	dcrat
behavioral1/memory/2652-223-0x0000000000040000-0x0000000000150000-memory.dmp	dcrat
behavioral1/memory/1436-283-0x0000000000F20000-0x0000000001030000-memory.dmp	dcrat
behavioral1/memory/292-343-0x0000000001250000-0x0000000001360000-memory.dmp	dcrat
behavioral1/memory/1708-521-0x00000000002F0000-0x0000000000400000-memory.dmp	dcrat
behavioral1/memory/2744-581-0x0000000000220000-0x0000000000330000-memory.dmp	dcrat
behavioral1/memory/1632-641-0x00000000013A0000-0x00000000014B0000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1200	powershell.exe
824	powershell.exe
2684	powershell.exe

Executes dropped EXE 12 IoCs

pid	Process
872	DllCommonsvc.exe
556	OSPPSVC.exe
764	OSPPSVC.exe
804	OSPPSVC.exe
2652	OSPPSVC.exe
1436	OSPPSVC.exe
292	OSPPSVC.exe
1020	OSPPSVC.exe
1552	OSPPSVC.exe
1708	OSPPSVC.exe
2744	OSPPSVC.exe
1632	OSPPSVC.exe

Loads dropped DLL 2 IoCs

pid	Process
3056	cmd.exe
3056	cmd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 13 IoCs

Web Service

T1102

flow	ioc
5	raw.githubusercontent.com
16	raw.githubusercontent.com
20	raw.githubusercontent.com
23	raw.githubusercontent.com
28	raw.githubusercontent.com
4	raw.githubusercontent.com
9	raw.githubusercontent.com
13	raw.githubusercontent.com
27	raw.githubusercontent.com
32	raw.githubusercontent.com
35	raw.githubusercontent.com
39	raw.githubusercontent.com
42	raw.githubusercontent.com

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Cursors\cmd.exe	DllCommonsvc.exe
File created	C:\Windows\Cursors\ebf1f9fa8afd6d	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_364532c577bd7b6231ab88362d4377d2c665ea92f07de32746fe5a0bd4046341.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2628	schtasks.exe
1416	schtasks.exe
2776	schtasks.exe
2840	schtasks.exe
2784	schtasks.exe
2664	schtasks.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
872	DllCommonsvc.exe
1200	powershell.exe
824	powershell.exe
2684	powershell.exe
556	OSPPSVC.exe
764	OSPPSVC.exe
804	OSPPSVC.exe
2652	OSPPSVC.exe
1436	OSPPSVC.exe
292	OSPPSVC.exe
1020	OSPPSVC.exe
1552	OSPPSVC.exe
1708	OSPPSVC.exe
2744	OSPPSVC.exe
1632	OSPPSVC.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeDebugPrivilege	872	DllCommonsvc.exe
Token: SeDebugPrivilege	1200	powershell.exe
Token: SeDebugPrivilege	556	OSPPSVC.exe
Token: SeDebugPrivilege	824	powershell.exe
Token: SeDebugPrivilege	2684	powershell.exe
Token: SeDebugPrivilege	764	OSPPSVC.exe
Token: SeDebugPrivilege	804	OSPPSVC.exe
Token: SeDebugPrivilege	2652	OSPPSVC.exe
Token: SeDebugPrivilege	1436	OSPPSVC.exe
Token: SeDebugPrivilege	292	OSPPSVC.exe
Token: SeDebugPrivilege	1020	OSPPSVC.exe
Token: SeDebugPrivilege	1552	OSPPSVC.exe
Token: SeDebugPrivilege	1708	OSPPSVC.exe
Token: SeDebugPrivilege	2744	OSPPSVC.exe
Token: SeDebugPrivilege	1632	OSPPSVC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2552 wrote to memory of 1568	2552	JaffaCakes118_364532c577bd7b6231ab88362d4377d2c665ea92f07de32746fe5a0bd4046341.exe	30
PID 2552 wrote to memory of 1568	2552	JaffaCakes118_364532c577bd7b6231ab88362d4377d2c665ea92f07de32746fe5a0bd4046341.exe	30
PID 2552 wrote to memory of 1568	2552	JaffaCakes118_364532c577bd7b6231ab88362d4377d2c665ea92f07de32746fe5a0bd4046341.exe	30
PID 2552 wrote to memory of 1568	2552	JaffaCakes118_364532c577bd7b6231ab88362d4377d2c665ea92f07de32746fe5a0bd4046341.exe	30
PID 1568 wrote to memory of 3056	1568	WScript.exe	32
PID 1568 wrote to memory of 3056	1568	WScript.exe	32
PID 1568 wrote to memory of 3056	1568	WScript.exe	32
PID 1568 wrote to memory of 3056	1568	WScript.exe	32
PID 3056 wrote to memory of 872	3056	cmd.exe	34
PID 3056 wrote to memory of 872	3056	cmd.exe	34
PID 3056 wrote to memory of 872	3056	cmd.exe	34
PID 3056 wrote to memory of 872	3056	cmd.exe	34
PID 872 wrote to memory of 2684	872	DllCommonsvc.exe	42
PID 872 wrote to memory of 2684	872	DllCommonsvc.exe	42
PID 872 wrote to memory of 2684	872	DllCommonsvc.exe	42
PID 872 wrote to memory of 1200	872	DllCommonsvc.exe	43
PID 872 wrote to memory of 1200	872	DllCommonsvc.exe	43
PID 872 wrote to memory of 1200	872	DllCommonsvc.exe	43
PID 872 wrote to memory of 824	872	DllCommonsvc.exe	44
PID 872 wrote to memory of 824	872	DllCommonsvc.exe	44
PID 872 wrote to memory of 824	872	DllCommonsvc.exe	44
PID 872 wrote to memory of 556	872	DllCommonsvc.exe	48
PID 872 wrote to memory of 556	872	DllCommonsvc.exe	48
PID 872 wrote to memory of 556	872	DllCommonsvc.exe	48
PID 556 wrote to memory of 760	556	OSPPSVC.exe	49
PID 556 wrote to memory of 760	556	OSPPSVC.exe	49
PID 556 wrote to memory of 760	556	OSPPSVC.exe	49
PID 760 wrote to memory of 1616	760	cmd.exe	51
PID 760 wrote to memory of 1616	760	cmd.exe	51
PID 760 wrote to memory of 1616	760	cmd.exe	51
PID 760 wrote to memory of 764	760	cmd.exe	52
PID 760 wrote to memory of 764	760	cmd.exe	52
PID 760 wrote to memory of 764	760	cmd.exe	52
PID 764 wrote to memory of 2552	764	OSPPSVC.exe	53
PID 764 wrote to memory of 2552	764	OSPPSVC.exe	53
PID 764 wrote to memory of 2552	764	OSPPSVC.exe	53
PID 2552 wrote to memory of 2548	2552	cmd.exe	55
PID 2552 wrote to memory of 2548	2552	cmd.exe	55
PID 2552 wrote to memory of 2548	2552	cmd.exe	55
PID 2552 wrote to memory of 804	2552	cmd.exe	56
PID 2552 wrote to memory of 804	2552	cmd.exe	56
PID 2552 wrote to memory of 804	2552	cmd.exe	56
PID 804 wrote to memory of 2860	804	OSPPSVC.exe	57
PID 804 wrote to memory of 2860	804	OSPPSVC.exe	57
PID 804 wrote to memory of 2860	804	OSPPSVC.exe	57
PID 2860 wrote to memory of 1748	2860	cmd.exe	59
PID 2860 wrote to memory of 1748	2860	cmd.exe	59
PID 2860 wrote to memory of 1748	2860	cmd.exe	59
PID 2860 wrote to memory of 2652	2860	cmd.exe	60
PID 2860 wrote to memory of 2652	2860	cmd.exe	60
PID 2860 wrote to memory of 2652	2860	cmd.exe	60
PID 2652 wrote to memory of 692	2652	OSPPSVC.exe	61
PID 2652 wrote to memory of 692	2652	OSPPSVC.exe	61
PID 2652 wrote to memory of 692	2652	OSPPSVC.exe	61
PID 692 wrote to memory of 1304	692	cmd.exe	63
PID 692 wrote to memory of 1304	692	cmd.exe	63
PID 692 wrote to memory of 1304	692	cmd.exe	63
PID 692 wrote to memory of 1436	692	cmd.exe	64
PID 692 wrote to memory of 1436	692	cmd.exe	64
PID 692 wrote to memory of 1436	692	cmd.exe	64
PID 1436 wrote to memory of 1904	1436	OSPPSVC.exe	65
PID 1436 wrote to memory of 1904	1436	OSPPSVC.exe	65
PID 1436 wrote to memory of 1904	1436	OSPPSVC.exe	65
PID 1904 wrote to memory of 1864	1904	cmd.exe	67

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_364532c577bd7b6231ab88362d4377d2c665ea92f07de32746fe5a0bd4046341.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_364532c577bd7b6231ab88362d4377d2c665ea92f07de32746fe5a0bd4046341.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2552
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1568
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3056
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:872
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2684
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\OSPPSVC.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1200
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Cursors\cmd.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:824
    - - C:\providercommon\OSPPSVC.exe
        
        "C:\providercommon\OSPPSVC.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:556
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\VAhDAdBh8f.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:760
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:1616
        
        C:\providercommon\OSPPSVC.exe
        
        "C:\providercommon\OSPPSVC.exe"
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:764
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\UJpHfzfs2i.bat"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:2552
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:2548
        
        C:\providercommon\OSPPSVC.exe
        
        "C:\providercommon\OSPPSVC.exe"
        9⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:804
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\d5cQTyHbvx.bat"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:2860
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:1748
        
        C:\providercommon\OSPPSVC.exe
        
        "C:\providercommon\OSPPSVC.exe"
        11⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2652
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ay5NT8uJA6.bat"
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:692
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:1304
        
        C:\providercommon\OSPPSVC.exe
        
        "C:\providercommon\OSPPSVC.exe"
        13⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1436
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\e2wUPJtRJp.bat"
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:1904
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        15⤵
        
        PID:1864
        
        C:\providercommon\OSPPSVC.exe
        
        "C:\providercommon\OSPPSVC.exe"
        15⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:292
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\fjnbjzFmbP.bat"
        16⤵
        
        PID:1668
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        17⤵
        
        PID:2596
        
        C:\providercommon\OSPPSVC.exe
        
        "C:\providercommon\OSPPSVC.exe"
        17⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1020
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\iVu5YTRuDT.bat"
        18⤵
        
        PID:1096
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        19⤵
        
        PID:2784
        
        C:\providercommon\OSPPSVC.exe
        
        "C:\providercommon\OSPPSVC.exe"
        19⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1552
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\D5faDLbbQ0.bat"
        20⤵
        
        PID:2096
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        21⤵
        
        PID:344
        
        C:\providercommon\OSPPSVC.exe
        
        "C:\providercommon\OSPPSVC.exe"
        21⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1708
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\QHkN6qNcbm.bat"
        22⤵
        
        PID:1172
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        23⤵
        
        PID:2500
        
        C:\providercommon\OSPPSVC.exe
        
        "C:\providercommon\OSPPSVC.exe"
        23⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2744
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\X5pWA5YIY7.bat"
        24⤵
        
        PID:1316
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        25⤵
        
        PID:2712
        
        C:\providercommon\OSPPSVC.exe
        
        "C:\providercommon\OSPPSVC.exe"
        25⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1632
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\9IAAZSZGIv.bat"
        26⤵
        
        PID:2504
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        27⤵
        
        PID:2140

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 9 /tr "'C:\providercommon\OSPPSVC.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\providercommon\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 13 /tr "'C:\providercommon\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 6 /tr "'C:\Windows\Cursors\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Windows\Cursors\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 6 /tr "'C:\Windows\Cursors\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
276edecdf319dbba04e9c6c7d580360d

SHA1
a734f20a8ad2d86f0001fa3839068e1c123971c8

SHA256
0cc717e2b01aa878f269c4039bef8de4c50eee923ac3e3d95d59a4c8f0c6100b

SHA512
3e35370bc1c3594d8dd70ca60816ebe8c72e0acd2de6264ee5dd55692af8c983165020cdf93f7a16b02f2f4f863e2c8aad38ecf2d53f1d8c940fab661ed0e3bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
48c266a95176b1be2197a9179234776b

SHA1
8229c8f4a659115d0cf022413917fdcb54eb374c

SHA256
bc15e76950d29a174c3e963c8c51d8a7062e2df7fd136f0fc24e08cf3bc1fdcc

SHA512
20ae65bda776800f98cdeaff8fe6c6f0cba109802e1fbe95c41929d46ddab62a9c49ee5988703390bcc5a8b322381c7ec9196b694f4339c0490568d5922f8826

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a2cb27f006b7af9b88ff11445d8a6893

SHA1
b33e522f355a2ea7877f4a3102658f0969f6953b

SHA256
978fc7e7da162e2a9fc91762ecdde9b991c2a8ab7cd1dfe134f68c17a7670d7b

SHA512
9a1a73ef0ab4cd1721e7322bb58918734071ac465f82e35fb18b4077aa012f7d815473ab84a1b8fbe9a12e63d8ae093cb6c03ddadd63e688233309f9469615d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
49113cbdf74a36d0e67e0d42d1b3ac0b

SHA1
39b366732b155a034505a9755d7c34e26b99527d

SHA256
3ca66cdd8f9d04a365cef2ce180ad44961e5aaed6af4d45b0852c21328998d67

SHA512
ae5019eab47b23faae4b36d38fc98d5e1fc0c7b3e608edc9b4b98c91dbf3deccc4f6245e4edbb537a469c5b179da33881d9211fa5863bcc01dc309d12cd18767

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e6e77cbb1c39e6f91b6038ba4bcc1b06

SHA1
303310c74770b3b2964f98626703dda35241f351

SHA256
46cbc2f30e18e80aafe48ca87d533a22436e3aafb8cc63627556d67ad7a96752

SHA512
fa7515bed6d899e68b632ce9078530068b354f6633fc8b9cb11de67fcce80ce608e3dfd37bd87339de143aeb9c30b8894e06504bf864f5df50b4219f12407f56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6b6f5dfb0cfb4ea19660d0fcdf116f4b

SHA1
77441d936b65b50d71e072e4ad5fbdedc785cbfd

SHA256
567bc9ec90831237cdc40b6e83e6ec07222461c3a97b1d0e8d19483613726ca2

SHA512
0841dc63bded4f7db4814841d4b00d803e92fc5102118af14e32ce654a8c2791bd3802ed1e24d4d0eb2df8bf19b75dce173d271b4cc67844fbf7543c6551782c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
886f7b979c3bcdc954189bbb0423e8f8

SHA1
90e040430f79ae429cef0a4014d13f73a44759c6

SHA256
73c1fcd0954a7dee40f3558a9c34be7b3f52dd2c5acc204da2084fe6aff14fd9

SHA512
8edca61fc112ba88d4091f65a7ca53754e5233f6d5a1c096987ed9e41f278711a5d6540dd9e6cf1d140aaa0326a4242535e887591a20b43bc4b7cfe1f30eff8a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
735593fc2e2e4209b6c348338beb7d64

SHA1
5c192215ca55a2d4fff31acb37fa7d3cdf4db40d

SHA256
4c60354ccd13d64ee59efb96985f3dffd648f07799688cb8efafaaffe683fe61

SHA512
d314f179a5b6f89ff33a3e3486fd5235edac80dd626f71ac94cd7e3e7c3502a116c3ed1af9b814e2212da24432f9ea5936e49f591cdb69fd812e4350813fdedf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e0155683eeb5912504e52773eeba2e5c

SHA1
69194f0626a05c87fe8bf383e7bf86ed88e28800

SHA256
177b6fd2897cdaf35478616e9a279f7c9e087560940d090159ea9ea2e9d5c712

SHA512
b39fab1823fb511fa3a040cbbb7683346d219a12f803a7e31f3007efba14b09e2fe90d56467c7d9666f581acc0fc0d77d2dd79625aec1ffec4f99ba346fbe14d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5ff8c97c8264665fa71ea2b589eee35a

SHA1
59ad0253b15a1d731a8f609b62c8e799c08815e4

SHA256
6902881f849063b5e9fb8a2fb571bb064c3360d99b2b310b7eefb8ad8a55f03c

SHA512
ea55e2e32b6d756ed3cf022eaf1559bdc90965b34893aa25420afb0c9b520c8c70afce6f40f38628a2dc47d76596560aedcf9fa336a768c8ea27521fa95da1c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\9IAAZSZGIv.bat

Filesize
194B

MD5
bef2be9e8d56b21fc4a380c98d88f29e

SHA1
06858778a6472801d32e21574706f91b17b14471

SHA256
15b357729d8d2ce3b5be5aeeab222781db2eecb39568506cebccf0d1ed893a6e

SHA512
7d2bb0e2ecd6d74f08bf632ebc845f9f102ad606b4d4a0a45bd50fb0f22f537689d5e3332715bf6e538675217c3b4b1bea0b4d89583fe9744a62daf13736f6f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD6B.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\D5faDLbbQ0.bat

Filesize
194B

MD5
0f4582d7076f53d2b38c497c37e16eb8

SHA1
23ca27efcec446acd77437f4dc515b912e43fb68

SHA256
e69568e51996cac9926f987f17f8c723f091e2a5f86b18ada38f8a8e8dff6c87

SHA512
c2f94716641e906a5f1a48598529109f1d2e97f651ddf2e0c206dfb87a760ef57e6a03cbad6ef11d25fb2fd67b0a1cbb0d80f59177d945ced970e3bb08ccb79e

Download Submit
C:\Users\Admin\AppData\Local\Temp\QHkN6qNcbm.bat

Filesize
194B

MD5
5d739a202ad7d00c09e7a3ae44391e28

SHA1
90b9088b42fb7119be55607bfc78891fb84ca33f

SHA256
43f45339e7659b0455515892f81ae5662a50e8743367109c66311862b8ef7151

SHA512
79f97375a36520b6783d597f8f5400db7200c802cf776aca637ac3cd80ce858d9c5675a81250086f89773626a51391943e6d1ef58922ab06005611151e4484c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD7D.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\UJpHfzfs2i.bat

Filesize
194B

MD5
04eb23b569c228dd44b0e47a9a5416a2

SHA1
b493db82b0e4407b5c86d88ecc83880756a60db1

SHA256
9035e064023cd4bea17131de7b56817789e64d4fe3af2d997d62c249fdb464be

SHA512
b683f9b9e2f5c173c1aa6edfd76c684f602ed89a760ffee326b0643e02857c2edeb728ed1022f000d581fb16b196e7aa90c9947670c441b1ab8c200069eb3ec4

Download Submit
C:\Users\Admin\AppData\Local\Temp\VAhDAdBh8f.bat

Filesize
194B

MD5
291e182b8c62fea66c115330f7963530

SHA1
6c6ef3e17eff2a5e9a565dd4715103536be6daa4

SHA256
7d5bb3e7858f7682a2f998786ff6a3c22e174f72138108c56e6328a2485f8f19

SHA512
5286b42a4b689d42c21032bd8cab539aea931d2532abdb699d54b7bdd8f87f8a7f98025ccd4275d179f0b9c30c29cb3e9fe94400510466e2f55162a45bf64d45

Download Submit
C:\Users\Admin\AppData\Local\Temp\X5pWA5YIY7.bat

Filesize
194B

MD5
7b25baa2ca033e25cace1a78a7c0c39a

SHA1
a8d6c0c43dd0cd6cdc63cca9624cd85bc6770a94

SHA256
ab7ad4bab851fcf57a104bc181702d9ec391ef5bcdcfb99e38cbcc2df3d8341f

SHA512
731f74257ea5b88847294854d8e629558c28c4624479e89e8d9499afe02c3d37aa4107ded0d347ff0a252ed077e7953de8a3e6ba96746091993ac2b8986a5cfe

Download Submit
C:\Users\Admin\AppData\Local\Temp\ay5NT8uJA6.bat

Filesize
194B

MD5
5f2a31ea3a6de6f23bd54312c58c3607

SHA1
05a16789e713db59a7dc38163996969034dfcbe7

SHA256
729c703270e325194fc72c9b71d33529ba7bab30396606a88e84da353706f909

SHA512
c65455b1099c8169ab2ad67050054e35718cf8031a7810167fa8f9367905e33129eb07f747b6a8b338264c6c97ec23f20bd71affd8abd913350fcacb320e3ed3

Download Submit
C:\Users\Admin\AppData\Local\Temp\d5cQTyHbvx.bat

Filesize
194B

MD5
1c796b8a10059f282a7145cbd0b03715

SHA1
2149ffe750c5362cd218889eb3f620e3cb5612b5

SHA256
5e3cf40aa9f94a40bd95a023a51ec589011aa4ee66e41680d8b90a1eadfb3ac9

SHA512
cf15f63386460cf3a9a7bb39fe8b1b908ff8f016e5d653aa2c148a01c347f8ec9351e2e64464f38cc75b60da797889550e1ad0145cf597cf1d849d151fc0d8c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\e2wUPJtRJp.bat

Filesize
194B

MD5
b24c294891b5748505e356501fb78bdf

SHA1
3cba0821410f083c39094fb6dc53130342e5d53b

SHA256
c8c2d52b29db88321070c8b62728cc2d61f3aa2bb50483edd1884b9f36f9b9e0

SHA512
8236f21efa965e9c457643e2f7a6f9f5601a924e92fbffe9370e0db02d0098d8b3d1ab6145638e5b2c264293fa3181276f4a043a6782edf89a099252565198f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\fjnbjzFmbP.bat

Filesize
194B

MD5
0672776c40c5e740ef558abcc4bba9d0

SHA1
428a1e5ff3ba0c17eb39dcc702e06bb1a164d46b

SHA256
ccfa38f568100159388d21dd86aa3d82c21a8a0f3220dd654cc639999294663c

SHA512
bae7b64b1c5d67d27a45e2c390c193eef27a10ed0a86d7901ae2c43e5e50777db789e323b34901bd44cdd74a2bbb531f585599f3ec1f1a0d6a32e8f07a733f16

Download Submit
C:\Users\Admin\AppData\Local\Temp\iVu5YTRuDT.bat

Filesize
194B

MD5
14550318b91671ffb7597e82efb80d3c

SHA1
2c2fadf9cd47111b7dc431a0ebebc6411007fc57

SHA256
282099c4b2e9cfaa26694b7bd48f0ef35c5e96530b065dc40071f182761c9762

SHA512
6aaf8a5cf99216a2a28b707f0e3fae3422b3c3b16093fc25f2c8eeb5e6e2389111b748ff02c6f2f948b55e81a6496af691b83c458160d7e13c19e9b6173a1606

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\588A50I45MYMCVIMIWIK.temp

Filesize
7KB

MD5
98ef53d4fe15d74dcbba1934839ee0f6

SHA1
3dc99fdb16781da96dfcb51c78f1b8bc82529a49

SHA256
7c752079c1682ab288e430d9118fbe891010cb4f137b9d64f186e17659617518

SHA512
82343d4877c04323a5df33d4238d056100cb47a4e8a166e4fa917941c87189e2a9f1d2ae91efaa7ea1b39d4d710f13a8e7cb267f274a074c24cf685228c3d995

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/292-343-0x0000000001250000-0x0000000001360000-memory.dmp

Filesize
1.1MB

Download
memory/556-38-0x0000000000FC0000-0x00000000010D0000-memory.dmp

Filesize
1.1MB

Download
memory/804-163-0x0000000000430000-0x0000000000442000-memory.dmp

Filesize
72KB

Download
memory/804-162-0x00000000013D0000-0x00000000014E0000-memory.dmp

Filesize
1.1MB

Download
memory/872-16-0x0000000000160000-0x000000000016C000-memory.dmp

Filesize
48KB

Download
memory/872-17-0x00000000003F0000-0x00000000003FC000-memory.dmp

Filesize
48KB

Download
memory/872-15-0x00000000003E0000-0x00000000003EC000-memory.dmp

Filesize
48KB

Download
memory/872-14-0x0000000000150000-0x0000000000162000-memory.dmp

Filesize
72KB

Download
memory/872-13-0x0000000001090000-0x00000000011A0000-memory.dmp

Filesize
1.1MB

Download
memory/1200-43-0x0000000000560000-0x0000000000568000-memory.dmp

Filesize
32KB

Download
memory/1436-283-0x0000000000F20000-0x0000000001030000-memory.dmp

Filesize
1.1MB

Download
memory/1632-641-0x00000000013A0000-0x00000000014B0000-memory.dmp

Filesize
1.1MB

Download
memory/1708-521-0x00000000002F0000-0x0000000000400000-memory.dmp

Filesize
1.1MB

Download
memory/2652-223-0x0000000000040000-0x0000000000150000-memory.dmp

Filesize
1.1MB

Download
memory/2684-44-0x000000001B770000-0x000000001BA52000-memory.dmp

Filesize
2.9MB

Download
memory/2744-581-0x0000000000220000-0x0000000000330000-memory.dmp

Filesize
1.1MB

Download