dcrat | f9153f463defeabeca8a0539c7bcd474d4c209dedb92cf9d4999c61c14fb7fd3

Analysis

max time kernel
149s
max time network
154s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
21-12-2024 19:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_f9153f463defeabeca8a0539c7bcd474d4c209dedb92cf9d4999c61c14fb7fd3.exe
Size

1.3MB
MD5

f6d66059371195992463f16f6cfadc9f
SHA1

e3f908edf338b279a171bde3feff02f48b2df34f
SHA256

f9153f463defeabeca8a0539c7bcd474d4c209dedb92cf9d4999c61c14fb7fd3
SHA512

3a43a6f82b05de1e6bf3298347aee74e2c12be703a0ec6de4c52c2b75a863ca1f6ba1ceeca4cae47a081b457faf044cae1e9f49f3d84b7168327d986dd684d65
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 6 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2844	2676	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2572	2676	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2568	2676	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2820	2676	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2616	2676	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2556	2676	schtasks.exe	35

DCRat payload 10 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x000700000001907c-9.dat	dcrat
behavioral1/memory/2276-13-0x0000000000030000-0x0000000000140000-memory.dmp	dcrat
behavioral1/memory/1708-28-0x0000000000A60000-0x0000000000B70000-memory.dmp	dcrat
behavioral1/memory/2976-104-0x00000000012B0000-0x00000000013C0000-memory.dmp	dcrat
behavioral1/memory/2464-164-0x00000000002B0000-0x00000000003C0000-memory.dmp	dcrat
behavioral1/memory/496-224-0x0000000001320000-0x0000000001430000-memory.dmp	dcrat
behavioral1/memory/2728-402-0x0000000000390000-0x00000000004A0000-memory.dmp	dcrat
behavioral1/memory/408-462-0x0000000000B10000-0x0000000000C20000-memory.dmp	dcrat
behavioral1/memory/1284-522-0x0000000000E30000-0x0000000000F40000-memory.dmp	dcrat
behavioral1/memory/2848-582-0x00000000003C0000-0x00000000004D0000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1248	powershell.exe
320	powershell.exe
3048	powershell.exe

Executes dropped EXE 11 IoCs

pid	Process
2276	DllCommonsvc.exe
1708	WMIADAP.exe
2976	WMIADAP.exe
2464	WMIADAP.exe
496	WMIADAP.exe
2044	WMIADAP.exe
1804	WMIADAP.exe
2728	WMIADAP.exe
408	WMIADAP.exe
1284	WMIADAP.exe
2848	WMIADAP.exe

Loads dropped DLL 2 IoCs

pid	Process
3060	cmd.exe
3060	cmd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 10 IoCs

Web Service

T1102

flow	ioc
23	raw.githubusercontent.com
34	raw.githubusercontent.com
4	raw.githubusercontent.com
16	raw.githubusercontent.com
12	raw.githubusercontent.com
20	raw.githubusercontent.com
27	raw.githubusercontent.com
30	raw.githubusercontent.com
5	raw.githubusercontent.com
9	raw.githubusercontent.com

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Photo Viewer\taskhost.exe	DllCommonsvc.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\taskhost.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Photo Viewer\b75386f1303e64	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_f9153f463defeabeca8a0539c7bcd474d4c209dedb92cf9d4999c61c14fb7fd3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2844	schtasks.exe
2572	schtasks.exe
2568	schtasks.exe
2820	schtasks.exe
2616	schtasks.exe
2556	schtasks.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2276	DllCommonsvc.exe
3048	powershell.exe
320	powershell.exe
1248	powershell.exe
1708	WMIADAP.exe
2976	WMIADAP.exe
2464	WMIADAP.exe
496	WMIADAP.exe
2044	WMIADAP.exe
1804	WMIADAP.exe
2728	WMIADAP.exe
408	WMIADAP.exe
1284	WMIADAP.exe
2848	WMIADAP.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeDebugPrivilege	2276	DllCommonsvc.exe
Token: SeDebugPrivilege	1708	WMIADAP.exe
Token: SeDebugPrivilege	3048	powershell.exe
Token: SeDebugPrivilege	320	powershell.exe
Token: SeDebugPrivilege	1248	powershell.exe
Token: SeDebugPrivilege	2976	WMIADAP.exe
Token: SeDebugPrivilege	2464	WMIADAP.exe
Token: SeDebugPrivilege	496	WMIADAP.exe
Token: SeDebugPrivilege	2044	WMIADAP.exe
Token: SeDebugPrivilege	1804	WMIADAP.exe
Token: SeDebugPrivilege	2728	WMIADAP.exe
Token: SeDebugPrivilege	408	WMIADAP.exe
Token: SeDebugPrivilege	1284	WMIADAP.exe
Token: SeDebugPrivilege	2848	WMIADAP.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 388 wrote to memory of 2468	388	JaffaCakes118_f9153f463defeabeca8a0539c7bcd474d4c209dedb92cf9d4999c61c14fb7fd3.exe	31
PID 388 wrote to memory of 2468	388	JaffaCakes118_f9153f463defeabeca8a0539c7bcd474d4c209dedb92cf9d4999c61c14fb7fd3.exe	31
PID 388 wrote to memory of 2468	388	JaffaCakes118_f9153f463defeabeca8a0539c7bcd474d4c209dedb92cf9d4999c61c14fb7fd3.exe	31
PID 388 wrote to memory of 2468	388	JaffaCakes118_f9153f463defeabeca8a0539c7bcd474d4c209dedb92cf9d4999c61c14fb7fd3.exe	31
PID 2468 wrote to memory of 3060	2468	WScript.exe	32
PID 2468 wrote to memory of 3060	2468	WScript.exe	32
PID 2468 wrote to memory of 3060	2468	WScript.exe	32
PID 2468 wrote to memory of 3060	2468	WScript.exe	32
PID 3060 wrote to memory of 2276	3060	cmd.exe	34
PID 3060 wrote to memory of 2276	3060	cmd.exe	34
PID 3060 wrote to memory of 2276	3060	cmd.exe	34
PID 3060 wrote to memory of 2276	3060	cmd.exe	34
PID 2276 wrote to memory of 1248	2276	DllCommonsvc.exe	42
PID 2276 wrote to memory of 1248	2276	DllCommonsvc.exe	42
PID 2276 wrote to memory of 1248	2276	DllCommonsvc.exe	42
PID 2276 wrote to memory of 3048	2276	DllCommonsvc.exe	43
PID 2276 wrote to memory of 3048	2276	DllCommonsvc.exe	43
PID 2276 wrote to memory of 3048	2276	DllCommonsvc.exe	43
PID 2276 wrote to memory of 320	2276	DllCommonsvc.exe	44
PID 2276 wrote to memory of 320	2276	DllCommonsvc.exe	44
PID 2276 wrote to memory of 320	2276	DllCommonsvc.exe	44
PID 2276 wrote to memory of 1708	2276	DllCommonsvc.exe	48
PID 2276 wrote to memory of 1708	2276	DllCommonsvc.exe	48
PID 2276 wrote to memory of 1708	2276	DllCommonsvc.exe	48
PID 1708 wrote to memory of 1980	1708	WMIADAP.exe	49
PID 1708 wrote to memory of 1980	1708	WMIADAP.exe	49
PID 1708 wrote to memory of 1980	1708	WMIADAP.exe	49
PID 1980 wrote to memory of 924	1980	cmd.exe	51
PID 1980 wrote to memory of 924	1980	cmd.exe	51
PID 1980 wrote to memory of 924	1980	cmd.exe	51
PID 1980 wrote to memory of 2976	1980	cmd.exe	52
PID 1980 wrote to memory of 2976	1980	cmd.exe	52
PID 1980 wrote to memory of 2976	1980	cmd.exe	52
PID 2976 wrote to memory of 2944	2976	WMIADAP.exe	53
PID 2976 wrote to memory of 2944	2976	WMIADAP.exe	53
PID 2976 wrote to memory of 2944	2976	WMIADAP.exe	53
PID 2944 wrote to memory of 2252	2944	cmd.exe	55
PID 2944 wrote to memory of 2252	2944	cmd.exe	55
PID 2944 wrote to memory of 2252	2944	cmd.exe	55
PID 2944 wrote to memory of 2464	2944	cmd.exe	56
PID 2944 wrote to memory of 2464	2944	cmd.exe	56
PID 2944 wrote to memory of 2464	2944	cmd.exe	56
PID 2464 wrote to memory of 3060	2464	WMIADAP.exe	57
PID 2464 wrote to memory of 3060	2464	WMIADAP.exe	57
PID 2464 wrote to memory of 3060	2464	WMIADAP.exe	57
PID 3060 wrote to memory of 1764	3060	cmd.exe	59
PID 3060 wrote to memory of 1764	3060	cmd.exe	59
PID 3060 wrote to memory of 1764	3060	cmd.exe	59
PID 3060 wrote to memory of 496	3060	cmd.exe	60
PID 3060 wrote to memory of 496	3060	cmd.exe	60
PID 3060 wrote to memory of 496	3060	cmd.exe	60
PID 496 wrote to memory of 1872	496	WMIADAP.exe	61
PID 496 wrote to memory of 1872	496	WMIADAP.exe	61
PID 496 wrote to memory of 1872	496	WMIADAP.exe	61
PID 1872 wrote to memory of 1744	1872	cmd.exe	63
PID 1872 wrote to memory of 1744	1872	cmd.exe	63
PID 1872 wrote to memory of 1744	1872	cmd.exe	63
PID 1872 wrote to memory of 2044	1872	cmd.exe	64
PID 1872 wrote to memory of 2044	1872	cmd.exe	64
PID 1872 wrote to memory of 2044	1872	cmd.exe	64
PID 2044 wrote to memory of 1620	2044	WMIADAP.exe	65
PID 2044 wrote to memory of 1620	2044	WMIADAP.exe	65
PID 2044 wrote to memory of 1620	2044	WMIADAP.exe	65
PID 1620 wrote to memory of 2460	1620	cmd.exe	67

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f9153f463defeabeca8a0539c7bcd474d4c209dedb92cf9d4999c61c14fb7fd3.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f9153f463defeabeca8a0539c7bcd474d4c209dedb92cf9d4999c61c14fb7fd3.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:388
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2468
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3060
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2276
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1248
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Photo Viewer\taskhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3048
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\WMIADAP.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:320
    - - C:\MSOCache\All Users\WMIADAP.exe
        
        "C:\MSOCache\All Users\WMIADAP.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1708
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\or7X1gMNi7.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1980
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:924
        
        C:\MSOCache\All Users\WMIADAP.exe
        
        "C:\MSOCache\All Users\WMIADAP.exe"
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2976
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\xdvgpfy6bM.bat"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:2944
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:2252
        
        C:\MSOCache\All Users\WMIADAP.exe
        
        "C:\MSOCache\All Users\WMIADAP.exe"
        9⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2464
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\SsFcJDxdf6.bat"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:3060
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:1764
        
        C:\MSOCache\All Users\WMIADAP.exe
        
        "C:\MSOCache\All Users\WMIADAP.exe"
        11⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:496
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\WVE2eLfZN7.bat"
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:1872
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:1744
        
        C:\MSOCache\All Users\WMIADAP.exe
        
        "C:\MSOCache\All Users\WMIADAP.exe"
        13⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2044
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\3jGxsc69Nm.bat"
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:1620
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        15⤵
        
        PID:2460
        
        C:\MSOCache\All Users\WMIADAP.exe
        
        "C:\MSOCache\All Users\WMIADAP.exe"
        15⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1804
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\tlraSVrJxn.bat"
        16⤵
        
        PID:1296
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        17⤵
        
        PID:2804
        
        C:\MSOCache\All Users\WMIADAP.exe
        
        "C:\MSOCache\All Users\WMIADAP.exe"
        17⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2728
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\zcjutnjrcv.bat"
        18⤵
        
        PID:2336
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        19⤵
        
        PID:2148
        
        C:\MSOCache\All Users\WMIADAP.exe
        
        "C:\MSOCache\All Users\WMIADAP.exe"
        19⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:408
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\9minE9DcLk.bat"
        20⤵
        
        PID:1860
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        21⤵
        
        PID:1988
        
        C:\MSOCache\All Users\WMIADAP.exe
        
        "C:\MSOCache\All Users\WMIADAP.exe"
        21⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1284
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\VbZulfStaN.bat"
        22⤵
        
        PID:2252
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        23⤵
        
        PID:2968
        
        C:\MSOCache\All Users\WMIADAP.exe
        
        "C:\MSOCache\All Users\WMIADAP.exe"
        23⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Photo Viewer\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Photo Viewer\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\WMIADAP.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAP" /sc ONLOGON /tr "'C:\MSOCache\All Users\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
da736b2ab58c93e85fcc586a6a6dc1c3

SHA1
1071e1f88c68948f01a6deea29fda0787fc0468a

SHA256
a150b174043e0c9019e197a6b092d038492656b63510667ac66e35791a4cec81

SHA512
a16b1bb524832ea58b721f905eed95f634ee939196e113f2010ed1b5bd2fccd21f0dc86a3524f837d595820ce6949dfab61bc6edb226ed6fbae2f206dd9e7052

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2699fab046af42e3c4785af9aa52e457

SHA1
7cc432c566641a2513c519b693506089c273397f

SHA256
c3f052f78da33f1389b47bc83d5cb614c752fa79ce106ce0cff29f730b362021

SHA512
9a1859d75257b37224359a01bed26002c21cd2cc7648a817eae22f8c0745d73fce9e7e1ddf409c23c7802558806850802a51fbb0612fe53a35f25c1ed72eb299

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
922b573cc1a2d17f6cdf4b0e51de1b27

SHA1
f11920ee5623ac7e3e20ca7c563e76da8b6a5865

SHA256
e9d835081cbe18a3c5b10c6630a0cedaab4dc8e05d97fe5d42348bdbe15a2da8

SHA512
c5f2880aed96a4cfd2774adb31355dd0443240234217cff550937ba9de787a01a36befb227ce88f074306cd68ceb92e1ab48e7e83b3209646c9bab1963ee4b8a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
92d4292ec1dfe6ecdeb1692a14988406

SHA1
e0dfd761234dd17b12f6c91040a8ff0e2af62416

SHA256
c5797010887fa02ef5c32b35f07926d583c3bc1c6f26263687d74d3cbd3c25c5

SHA512
31ed3b61f1a01be4d4bc781b575cc7c8391e1cf559364f16930657abd59084ae5899af1a2e833291a5f65de84c6f0e0febcf81c008b5f61c158ba6378f4ab9b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
108aad5a8fd7307074e02857bb0c2c6f

SHA1
07a7e1b00e317215998b5bdf77f72d42f8855cdd

SHA256
1f5957fb4ae36946a0c21a722844e1b31c9ab6e784956d7025362f5ba95e6000

SHA512
02ae31378b1b86b938b7fdae7a9d1ac16cae28078f1287e3977f027a97c73cbd996d9e761a87399b5f2305d9aa679af7cdc9fe5ecd90157c0c262f496a2b76d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
148c0834debe94c4a8fec3a7c7813bae

SHA1
5bbf4e6d7eee197ee21c3dd11e6bee909102bde2

SHA256
16b8b44c0e662b92165437bc7ffdb268008a8856be58b4f036f5aa1dcd6021cc

SHA512
d2aa11c56ff6bd055032a16e2d5abf7df4d647665ccff2222425f5ffac69f6eaab3f0ac61f4abea6b946961c932ad368668ed4436979d53fe38d6e07ea14aaf5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f7d3a5ec1b49e9476545a88bda23ed0d

SHA1
88151365d20a5c8b8a2628f11138279d4a67c11c

SHA256
5206b620e4cb1ea01eba0bb496792c18ffc9ae4e1028d74e00953bbc48aff08f

SHA512
61f51ed0548dfb6b333c0ca26356c3b4b4da973a1d1cad2f3acf686f22353e7c3485b116ede87f8cb5dc34e4ac14eaa832ddce0f3b073c765f4595e5e5fc6ebf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1f0ec8bb44476322c48deb66eeeb9cf9

SHA1
2b4f814cbcd6adcf4bd3b2b4c721accb02d29b8c

SHA256
63af3ace2d112304e97f56d1aaf6394fb45a4a5341f74093e4da449bbf49bb68

SHA512
511d59faeab862ae5b76fe915d9587c83f3640a47a001dde2b1ea270015d5900a88ab11a69f064d52501b4f252e6f64ef93f76768e04b0319cdb31a3e8962fb3

Download Submit
C:\Users\Admin\AppData\Local\Temp\3jGxsc69Nm.bat

Filesize
198B

MD5
46989f5f6dcf89fc90f87d61084f7f28

SHA1
cc33d3c131dbdcd480144b8fb686df70acd5428d

SHA256
060b0585a2902b2f05b2e721d3d13f91711ea6f17b82efbb6142b81dd7f23e28

SHA512
9617dc98a13d4c5fd5117eeed8e694cc27ca7f70c12606c408916970afa510e2d30634d82cb06550b7260e0f0176bf9340a54a06588e85fec0407f15f272327a

Download Submit
C:\Users\Admin\AppData\Local\Temp\9minE9DcLk.bat

Filesize
198B

MD5
56c74b5811bd30e0e321686332942776

SHA1
bbb771bca7c4eb1c7255da26c41c732b65a3ee9f

SHA256
5f5ca8a815e1e67b78f6cf58f3cf3b19bfdf69cffea0c09956d0165f1bfa6719

SHA512
4d08c1e72ff626fd963a86672780f28790dc69f0b8faa4ad8b906c5d7f38bf2e2950e4f69924d15ba73d9fbec46248e97900a5617b37db4bca26acd92a5c2ee6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1D04.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\SsFcJDxdf6.bat

Filesize
198B

MD5
aec3f996443ca02bed6bee0e98b43d5e

SHA1
54796c8202e1e519f014afb7283e16874d2ff58c

SHA256
d2ef96434de3e58f92ba0fe976eab7080dfd3d573fddc1fd956af7f4b16e557b

SHA512
3aa38506cff66d6819df4c035a8574b9663bad5a131847e1b0f96401a03b5c1c35c8bccb4967b7078c72827c06712356dffbea5155f86bcbd52d36380b249f99

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1D36.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\VbZulfStaN.bat

Filesize
198B

MD5
673cf5115fe4ca433e6f6994bce34fd7

SHA1
edbbd6f6bfa0f3bc26761eebd42eb0d75fb3391a

SHA256
338e38926edbd9cd66d48c818c0da42c697375a7d8240bee7a316302a383aba2

SHA512
fb05c0c1b54c4022206a60897898e6f8620940f46e953aec31a86f626cfcba58e4bfca87d8b9eefe992fd7d28ec974fd0b8669b73c67922440eb4b5d977f91b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\WVE2eLfZN7.bat

Filesize
198B

MD5
3d21cd0bc293e4837f0c337bccfeea2c

SHA1
24d0cffcd8566d347729592e62ff2e7801dd6b85

SHA256
14e35cd4232dace14386d94d8ad9377a5a3825c3a57dfc323dd51ed68e99b6dd

SHA512
db28f8e465b985b406fc343d21e7f8c370e7d8e600a010b781fc1092722cd2af183f7ccc417ffc4ee31559ed0be2b455dcfd043875ab68ada45fc093c2d46d4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\or7X1gMNi7.bat

Filesize
198B

MD5
181377f617b793d6f4b0024bdff30192

SHA1
d2d0b252bab6465b3e7cf733194e18ebb10c74b5

SHA256
916c28dbe0a6703e965a323bf08a803249c8cd511de2288018e50c343145a76e

SHA512
593dd3fc431e8620b980e8f1ed94d211ab4ed45d5a581d6f5de1206806537e38e43d76e8f6a1e8a60d14886ce050dffd170be24d8fc7a513f6fcb91b45ea82b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\tlraSVrJxn.bat

Filesize
198B

MD5
56a09cccdec6fa91fb24344a0fad2342

SHA1
18e3db48b9577e11c5e496ff1c646a41616102f1

SHA256
37e2750a1a932b01cc20cd779af95f281613f920dd3e454a3e4967f3c9d22934

SHA512
9d616dc8cc43784d5065be9a8f16da48d6090d50f25fb57c5c178f331508148c187cc524a7b96cee653185d4964670baf8de566f26a186b3b6f96237999d3bab

Download Submit
C:\Users\Admin\AppData\Local\Temp\xdvgpfy6bM.bat

Filesize
198B

MD5
25f0650fcd113d5c44a349d81b041e63

SHA1
44b1dbfb5856257179ad0ad76b2b3ad4c89cceba

SHA256
3856af46ab967b9e1180f85f0be1b16d0844be9f9fde997034195a1fc5d9b237

SHA512
7557ff9d19f3470168d9bb16b3594611d0505bb326fa8934f3b04f3f7729692604abb718be33066c20890bb940ef0ab46ffde47595da3ebacc7fd3af9c15b429

Download Submit
C:\Users\Admin\AppData\Local\Temp\zcjutnjrcv.bat

Filesize
198B

MD5
8e8c8b08d1777dbe2fcdf5f386d069a7

SHA1
d8d7d1ba3cd0088bad8d14de181c901bb232e80c

SHA256
f844611e6e2e4590069639df26c77d59ad647f44386a27035b5a5058822f950d

SHA512
38a8cb0b16c9f30b4cd7b3711b131d52787efa2449d842f028a4bfd8e3751315cf04486cd829fd178162825a5bf2125b4e65266e9575adf253810c81c990146b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
30c8c7e5c7e00c720797795a7106a64a

SHA1
ca9a3e5448ac4b3ba05af39dea084659bc12d2dd

SHA256
02f9984ca2bd1d11e4521151370d73f6a0d84d55508a7db61c4cc16698fd9c5e

SHA512
34fd1e5f6da3b4b9efb97aeb705124ff01250c8f17cf4a43f8013f1603c3c087141d1c8b5b1c6f4e5d11a14ff339ba3e3b8799aa902bc56e70dd896532cdac3f

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
memory/408-462-0x0000000000B10000-0x0000000000C20000-memory.dmp

Filesize
1.1MB

Download
memory/496-224-0x0000000001320000-0x0000000001430000-memory.dmp

Filesize
1.1MB

Download
memory/1284-522-0x0000000000E30000-0x0000000000F40000-memory.dmp

Filesize
1.1MB

Download
memory/1708-43-0x0000000000150000-0x0000000000162000-memory.dmp

Filesize
72KB

Download
memory/1708-28-0x0000000000A60000-0x0000000000B70000-memory.dmp

Filesize
1.1MB

Download
memory/2276-14-0x00000000002F0000-0x0000000000302000-memory.dmp

Filesize
72KB

Download
memory/2276-15-0x0000000000300000-0x000000000030C000-memory.dmp

Filesize
48KB

Download
memory/2276-16-0x0000000000310000-0x000000000031C000-memory.dmp

Filesize
48KB

Download
memory/2276-17-0x0000000000590000-0x000000000059C000-memory.dmp

Filesize
48KB

Download
memory/2276-13-0x0000000000030000-0x0000000000140000-memory.dmp

Filesize
1.1MB

Download
memory/2464-164-0x00000000002B0000-0x00000000003C0000-memory.dmp

Filesize
1.1MB

Download
memory/2728-402-0x0000000000390000-0x00000000004A0000-memory.dmp

Filesize
1.1MB

Download
memory/2848-582-0x00000000003C0000-0x00000000004D0000-memory.dmp

Filesize
1.1MB

Download
memory/2976-104-0x00000000012B0000-0x00000000013C0000-memory.dmp

Filesize
1.1MB

Download
memory/3048-44-0x000000001B720000-0x000000001BA02000-memory.dmp

Filesize
2.9MB

Download
memory/3048-45-0x0000000000300000-0x0000000000308000-memory.dmp

Filesize
32KB

Download