Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
21-12-2024 20:14
Behavioral task
behavioral1
Sample
JaffaCakes118_9c589596888515924b85bd2510f7faab0a1cd8a992b6363ace3c9f6852b10c51.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
JaffaCakes118_9c589596888515924b85bd2510f7faab0a1cd8a992b6363ace3c9f6852b10c51.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_9c589596888515924b85bd2510f7faab0a1cd8a992b6363ace3c9f6852b10c51.exe
-
Size
1.3MB
-
MD5
77a3ee4f03b385ed4de69f367c07c3b6
-
SHA1
a6bd818f8a68d6ea0acf6d270a3366fc85f925e1
-
SHA256
9c589596888515924b85bd2510f7faab0a1cd8a992b6363ace3c9f6852b10c51
-
SHA512
d9fdb616926305cc510ab54e4ee4b6de0cae87b2e1610e59b5546c891f25fd151299da26d7ee75f937e0f4d8ad20148d7f3b85caca8d1940ed625a9ad44a627d
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Process spawned unexpected child process 12 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4208 4392 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1528 4392 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 812 4392 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 556 4392 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4372 4392 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4216 4392 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4012 4392 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3148 4392 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4948 4392 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3640 4392 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1048 4392 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1592 4392 schtasks.exe 88 -
resource yara_rule behavioral2/files/0x000a000000023b90-10.dat dcrat behavioral2/memory/1228-13-0x0000000000A20000-0x0000000000B30000-memory.dmp dcrat -
Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2532 powershell.exe 2468 powershell.exe 2384 powershell.exe 3196 powershell.exe 700 powershell.exe -
Checks computer location settings 2 TTPs 14 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation conhost.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation conhost.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation conhost.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation DllCommonsvc.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation conhost.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation conhost.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation JaffaCakes118_9c589596888515924b85bd2510f7faab0a1cd8a992b6363ace3c9f6852b10c51.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation conhost.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation conhost.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation conhost.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation conhost.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation conhost.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation conhost.exe -
Executes dropped EXE 13 IoCs
pid Process 1228 DllCommonsvc.exe 3152 conhost.exe 3712 conhost.exe 4448 conhost.exe 1576 conhost.exe 3652 conhost.exe 4084 conhost.exe 32 conhost.exe 2840 conhost.exe 3032 conhost.exe 4768 conhost.exe 1700 conhost.exe 692 conhost.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 12 IoCs
flow ioc 17 raw.githubusercontent.com 23 raw.githubusercontent.com 37 raw.githubusercontent.com 44 raw.githubusercontent.com 54 raw.githubusercontent.com 16 raw.githubusercontent.com 39 raw.githubusercontent.com 43 raw.githubusercontent.com 50 raw.githubusercontent.com 52 raw.githubusercontent.com 53 raw.githubusercontent.com 38 raw.githubusercontent.com -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\Internet Explorer\Registry.exe DllCommonsvc.exe File created C:\Program Files (x86)\Internet Explorer\ee2ad38f3d4382 DllCommonsvc.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\ModemLogs\conhost.exe DllCommonsvc.exe File opened for modification C:\Windows\ModemLogs\conhost.exe DllCommonsvc.exe File created C:\Windows\ModemLogs\088424020bedd6 DllCommonsvc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_9c589596888515924b85bd2510f7faab0a1cd8a992b6363ace3c9f6852b10c51.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies registry class 12 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings conhost.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings conhost.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings conhost.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings conhost.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings conhost.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings conhost.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings conhost.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings conhost.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings conhost.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings conhost.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings conhost.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings JaffaCakes118_9c589596888515924b85bd2510f7faab0a1cd8a992b6363ace3c9f6852b10c51.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 12 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 556 schtasks.exe 4372 schtasks.exe 4216 schtasks.exe 3148 schtasks.exe 1048 schtasks.exe 1592 schtasks.exe 4208 schtasks.exe 1528 schtasks.exe 4948 schtasks.exe 3640 schtasks.exe 812 schtasks.exe 4012 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 23 IoCs
pid Process 1228 DllCommonsvc.exe 3196 powershell.exe 2468 powershell.exe 2532 powershell.exe 2384 powershell.exe 2384 powershell.exe 700 powershell.exe 3196 powershell.exe 2468 powershell.exe 700 powershell.exe 2532 powershell.exe 3152 conhost.exe 3712 conhost.exe 4448 conhost.exe 1576 conhost.exe 3652 conhost.exe 4084 conhost.exe 32 conhost.exe 2840 conhost.exe 3032 conhost.exe 4768 conhost.exe 1700 conhost.exe 692 conhost.exe -
Suspicious use of AdjustPrivilegeToken 18 IoCs
description pid Process Token: SeDebugPrivilege 1228 DllCommonsvc.exe Token: SeDebugPrivilege 3196 powershell.exe Token: SeDebugPrivilege 2468 powershell.exe Token: SeDebugPrivilege 2532 powershell.exe Token: SeDebugPrivilege 2384 powershell.exe Token: SeDebugPrivilege 700 powershell.exe Token: SeDebugPrivilege 3152 conhost.exe Token: SeDebugPrivilege 3712 conhost.exe Token: SeDebugPrivilege 4448 conhost.exe Token: SeDebugPrivilege 1576 conhost.exe Token: SeDebugPrivilege 3652 conhost.exe Token: SeDebugPrivilege 4084 conhost.exe Token: SeDebugPrivilege 32 conhost.exe Token: SeDebugPrivilege 2840 conhost.exe Token: SeDebugPrivilege 3032 conhost.exe Token: SeDebugPrivilege 4768 conhost.exe Token: SeDebugPrivilege 1700 conhost.exe Token: SeDebugPrivilege 692 conhost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3296 wrote to memory of 4000 3296 JaffaCakes118_9c589596888515924b85bd2510f7faab0a1cd8a992b6363ace3c9f6852b10c51.exe 83 PID 3296 wrote to memory of 4000 3296 JaffaCakes118_9c589596888515924b85bd2510f7faab0a1cd8a992b6363ace3c9f6852b10c51.exe 83 PID 3296 wrote to memory of 4000 3296 JaffaCakes118_9c589596888515924b85bd2510f7faab0a1cd8a992b6363ace3c9f6852b10c51.exe 83 PID 4000 wrote to memory of 1304 4000 WScript.exe 85 PID 4000 wrote to memory of 1304 4000 WScript.exe 85 PID 4000 wrote to memory of 1304 4000 WScript.exe 85 PID 1304 wrote to memory of 1228 1304 cmd.exe 87 PID 1304 wrote to memory of 1228 1304 cmd.exe 87 PID 1228 wrote to memory of 2532 1228 DllCommonsvc.exe 102 PID 1228 wrote to memory of 2532 1228 DllCommonsvc.exe 102 PID 1228 wrote to memory of 2468 1228 DllCommonsvc.exe 103 PID 1228 wrote to memory of 2468 1228 DllCommonsvc.exe 103 PID 1228 wrote to memory of 700 1228 DllCommonsvc.exe 104 PID 1228 wrote to memory of 700 1228 DllCommonsvc.exe 104 PID 1228 wrote to memory of 3196 1228 DllCommonsvc.exe 105 PID 1228 wrote to memory of 3196 1228 DllCommonsvc.exe 105 PID 1228 wrote to memory of 2384 1228 DllCommonsvc.exe 106 PID 1228 wrote to memory of 2384 1228 DllCommonsvc.exe 106 PID 1228 wrote to memory of 3152 1228 DllCommonsvc.exe 111 PID 1228 wrote to memory of 3152 1228 DllCommonsvc.exe 111 PID 3152 wrote to memory of 4016 3152 conhost.exe 118 PID 3152 wrote to memory of 4016 3152 conhost.exe 118 PID 4016 wrote to memory of 2772 4016 cmd.exe 120 PID 4016 wrote to memory of 2772 4016 cmd.exe 120 PID 4016 wrote to memory of 3712 4016 cmd.exe 126 PID 4016 wrote to memory of 3712 4016 cmd.exe 126 PID 3712 wrote to memory of 2400 3712 conhost.exe 130 PID 3712 wrote to memory of 2400 3712 conhost.exe 130 PID 2400 wrote to memory of 3292 2400 cmd.exe 132 PID 2400 wrote to memory of 3292 2400 cmd.exe 132 PID 2400 wrote to memory of 4448 2400 cmd.exe 137 PID 2400 wrote to memory of 4448 2400 cmd.exe 137 PID 4448 wrote to memory of 4132 4448 conhost.exe 139 PID 4448 wrote to memory of 4132 4448 conhost.exe 139 PID 4132 wrote to memory of 1888 4132 cmd.exe 141 PID 4132 wrote to memory of 1888 4132 cmd.exe 141 PID 4132 wrote to memory of 1576 4132 cmd.exe 143 PID 4132 wrote to memory of 1576 4132 cmd.exe 143 PID 1576 wrote to memory of 4128 1576 conhost.exe 145 PID 1576 wrote to memory of 4128 1576 conhost.exe 145 PID 4128 wrote to memory of 4436 4128 cmd.exe 147 PID 4128 wrote to memory of 4436 4128 cmd.exe 147 PID 4128 wrote to memory of 3652 4128 cmd.exe 149 PID 4128 wrote to memory of 3652 4128 cmd.exe 149 PID 3652 wrote to memory of 920 3652 conhost.exe 151 PID 3652 wrote to memory of 920 3652 conhost.exe 151 PID 920 wrote to memory of 676 920 cmd.exe 153 PID 920 wrote to memory of 676 920 cmd.exe 153 PID 920 wrote to memory of 4084 920 cmd.exe 155 PID 920 wrote to memory of 4084 920 cmd.exe 155 PID 4084 wrote to memory of 4052 4084 conhost.exe 157 PID 4084 wrote to memory of 4052 4084 conhost.exe 157 PID 4052 wrote to memory of 3268 4052 cmd.exe 159 PID 4052 wrote to memory of 3268 4052 cmd.exe 159 PID 4052 wrote to memory of 32 4052 cmd.exe 161 PID 4052 wrote to memory of 32 4052 cmd.exe 161 PID 32 wrote to memory of 980 32 conhost.exe 163 PID 32 wrote to memory of 980 32 conhost.exe 163 PID 980 wrote to memory of 4824 980 cmd.exe 165 PID 980 wrote to memory of 4824 980 cmd.exe 165 PID 980 wrote to memory of 2840 980 cmd.exe 167 PID 980 wrote to memory of 2840 980 cmd.exe 167 PID 2840 wrote to memory of 4632 2840 conhost.exe 169 PID 2840 wrote to memory of 4632 2840 conhost.exe 169 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9c589596888515924b85bd2510f7faab0a1cd8a992b6363ace3c9f6852b10c51.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9c589596888515924b85bd2510f7faab0a1cd8a992b6363ace3c9f6852b10c51.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3296 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4000 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\providercommon\DllCommonsvc.exe"C:\providercommon\DllCommonsvc.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2532
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\ModemLogs\conhost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2468
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Internet Explorer\Registry.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:700
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\spoolsv.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3196
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Microsoft\Diagnosis\SppExtComObj.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2384
-
-
C:\Windows\ModemLogs\conhost.exe"C:\Windows\ModemLogs\conhost.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3152 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\QUR8LTwG0H.bat"6⤵
- Suspicious use of WriteProcessMemory
PID:4016 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:27⤵PID:2772
-
-
C:\Windows\ModemLogs\conhost.exe"C:\Windows\ModemLogs\conhost.exe"7⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3712 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\kz4ReWEb5Y.bat"8⤵
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:29⤵PID:3292
-
-
C:\Windows\ModemLogs\conhost.exe"C:\Windows\ModemLogs\conhost.exe"9⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\THL7XCWxQ1.bat"10⤵
- Suspicious use of WriteProcessMemory
PID:4132 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:211⤵PID:1888
-
-
C:\Windows\ModemLogs\conhost.exe"C:\Windows\ModemLogs\conhost.exe"11⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\KRs2fZV4we.bat"12⤵
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:213⤵PID:4436
-
-
C:\Windows\ModemLogs\conhost.exe"C:\Windows\ModemLogs\conhost.exe"13⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3652 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\0xFiNVDkrN.bat"14⤵
- Suspicious use of WriteProcessMemory
PID:920 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:215⤵PID:676
-
-
C:\Windows\ModemLogs\conhost.exe"C:\Windows\ModemLogs\conhost.exe"15⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\u02VouYs0z.bat"16⤵
- Suspicious use of WriteProcessMemory
PID:4052 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:217⤵PID:3268
-
-
C:\Windows\ModemLogs\conhost.exe"C:\Windows\ModemLogs\conhost.exe"17⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:32 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\DemtbJLPzJ.bat"18⤵
- Suspicious use of WriteProcessMemory
PID:980 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:219⤵PID:4824
-
-
C:\Windows\ModemLogs\conhost.exe"C:\Windows\ModemLogs\conhost.exe"19⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\CZdmQsnKkU.bat"20⤵PID:4632
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:221⤵PID:3500
-
-
C:\Windows\ModemLogs\conhost.exe"C:\Windows\ModemLogs\conhost.exe"21⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3032 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\AXFqcUy7ES.bat"22⤵PID:2116
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:223⤵PID:4436
-
-
C:\Windows\ModemLogs\conhost.exe"C:\Windows\ModemLogs\conhost.exe"23⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4768 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\VDNADHaqjn.bat"24⤵PID:2864
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:225⤵PID:4664
-
-
C:\Windows\ModemLogs\conhost.exe"C:\Windows\ModemLogs\conhost.exe"25⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1700 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\X9PDuMdk3a.bat"26⤵PID:4496
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:227⤵PID:1632
-
-
C:\Windows\ModemLogs\conhost.exe"C:\Windows\ModemLogs\conhost.exe"27⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:692
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\Windows\ModemLogs\conhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4208
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Windows\ModemLogs\conhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1528
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 12 /tr "'C:\Windows\ModemLogs\conhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:812
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Internet Explorer\Registry.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:556
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\Registry.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4372
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Internet Explorer\Registry.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4216
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 9 /tr "'C:\providercommon\spoolsv.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4012
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\providercommon\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3148
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 12 /tr "'C:\providercommon\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4948
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\Microsoft\Diagnosis\SppExtComObj.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3640
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Users\All Users\Microsoft\Diagnosis\SppExtComObj.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1048
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 11 /tr "'C:\Users\All Users\Microsoft\Diagnosis\SppExtComObj.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1592
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5baf55b95da4a601229647f25dad12878
SHA1abc16954ebfd213733c4493fc1910164d825cac8
SHA256ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
SHA51224f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD559d97011e091004eaffb9816aa0b9abd
SHA11602a56b01dd4b7c577ca27d3117e4bcc1aa657b
SHA25618f381e0db020a763b8c515c346ef58679ab9c403267eacfef5359e272f7e71d
SHA512d9ca49c1a17580981e2c1a50d73c0eecaa7a62f8514741512172e395af2a3d80aeb0f71c58bc7f52c18246d57ba67af09b6bff4776877d6cc6f0245c30e092d6
-
Filesize
944B
MD5d28a889fd956d5cb3accfbaf1143eb6f
SHA1157ba54b365341f8ff06707d996b3635da8446f7
SHA25621e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45
SHA5120b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c
-
Filesize
944B
MD56d3e9c29fe44e90aae6ed30ccf799ca8
SHA1c7974ef72264bbdf13a2793ccf1aed11bc565dce
SHA2562360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d
SHA51260c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a
-
Filesize
197B
MD5fb59b037381409677efefe1c5cc1ba7b
SHA1f3e561e6194f6c707d73530fd4fd83db6702fca3
SHA2563bbcada6efc94e781b85f01d86a49abf89fbebeb7562bab68ba19eb368e9254e
SHA512eca6128407ac9230fc8b67f8244650fde4057ad4eb29c19bf50808d468d6e8d807977d62b44f2059eb4fb1a33489c72ae0894ea8f4d8b9d7a6ddcd25e3249745
-
Filesize
197B
MD5de91a56ccdc49f20ae6df2a915b99fdc
SHA181b7f04efb4aa1f9032cdd978787e497eaa7d3c9
SHA25672e99f8d358f31fc3adbbbc5ad6b8eb8c72d6d8913237fe5c2ef8081aa5fd233
SHA512cf960c77d54e0c4401fae335ff526fef1b31433efd5233f846d6f80928b972b2183c0fda743d047d5d10d4e488a9714ea08e7a2fe487035620593797c0d55fce
-
Filesize
197B
MD5ea86336350cb0e2d0213bdff1c21ee58
SHA112366545cd8976a641fd70e8779804a3bc7ef69e
SHA2565163247a2675279248a39ee1cc34997a6c695f8ee6c43486e8f61f17fd30a253
SHA5124140b2d811b06842c83b33af6ede674c1758cd9164588c1963baa64cb2547af02de67bf9c73f2f2463a7fa736e89efde14c1d3fb1c9c015a4b00eb82c24d0aaf
-
Filesize
197B
MD5419a631aa10207eea2a5c48ec08f4845
SHA15fe1cfcad1fbf076c2b2a6bc9749196dde784827
SHA2565d9f6cd2293216389f5f24e720b24e5b5807e7f28d8b3039296a9638e20aca87
SHA512ce8108b6b12b0be49d49e26a62904580cbebbfee48bddff987982d1175f17620b7b2b7ec838ad6ba5ecfde7971039a224477c4320cd8b30b664f2fd4aeebfb2b
-
Filesize
197B
MD5d2a49ac492d644eb20dbdb31e90607e2
SHA17e46f34150389aa58119807e558574a9c18d7f03
SHA2565677b047171a34792ab16bbf8572f9bd29c7a18577ca686c50d420047942fbd1
SHA512c324538277f739e90b3a9664d10695bbe71973df769a2eb8c23a21eee590850fc6f2c7b54e695a7c98f1e99c65f365934b41237631a2a3e33eede06058266cd1
-
Filesize
197B
MD51358a3d0bc797ad7df685042fda35f82
SHA1d283645f95fb83dbd88ffe7bd5c7c438991b8b70
SHA256b87aefba8155045830b8c654be259cdcd85d099e933ffc61a68621f4cacf9ffd
SHA5123f9d367c96a2536c4a28641c8b877208797f3859372e7a9940cb4ccf5c392e970091aadc77973321be6c785613490cd235b522d7c5805b655bc13e1915f63dce
-
Filesize
197B
MD52930bb54dbebff033b0abb286aea9def
SHA17e4579181ea3005cf7455c34ea9688d6b029e73e
SHA256319fbdc1308711c1d610a359456fea641ee4d1a894b10c01a8226ea2a6fad945
SHA512587a1526a57ea1018547e0fb88bb110f3b6661d9cc6b7d62f04fa312b3b8a7a1bee1aaa4275fe2d542ec74fbd0cda7e70c0e9acbdb6ccd8ad127899fd1bdada9
-
Filesize
197B
MD51ac8f1714ac80bb8dbff5f22d1c0a953
SHA1d874198a87703e2d62dc41635102d2c9f3b83214
SHA25667908759d0a92578bb74f5cf9cf6c063836e638eccc8da1a4269ac3afe52a8c5
SHA51251d1c60ccd33233debe7c11ae311e8e97b0ac1d72848450079c21084b6e86cc241d9a9f057a325b7c2ef67ec7f68c9ca768d33d9d565512014c691af3ecf64e5
-
Filesize
197B
MD57636ce1b2d585a9d4502adc1d4dcf2ee
SHA1557d7342a3b110866c8829e129ce8ab9c9e10b14
SHA256cdfba1c052340b63eb46725dfaf112851d61cc971f0983555db45709b10bf468
SHA512cd5f5d47c8bf49f4bf6323b2e7d3127af918473870214d9c6bf2fae6fbe8353fbe21d5d97f28615bbf2751c14ce53f81930272fde44e9b71a2a556c70ced135e
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
197B
MD52006fd5b3ab4de0dac29d83f021f8b37
SHA19a6eac37d42c97b86008c76aa5f5e17666f41e5b
SHA25649056a08b4b5ff51c3ded3d8d63c881421a9765ce54004c91fff5b3d0f3f5b8b
SHA5120edefa8ea1fb0e979ceff017ae075ca48c4beef52825b60fdf28bb797ad00975ab63f3c8f38fa16c442eae65d3236c5540d7c75dca7566075a57b240b172c059
-
Filesize
197B
MD5566b95b1f480183844a591cdb40d3a90
SHA1f097a1729076d92ebeb988cbabb81e579605b1e6
SHA256f977995d37c8b971a2d0a0d5160a1da946b85d33e597d98f93cfa2076466ed0c
SHA512f20250f6c47bfc5e6cd1048d841965f7b0a3fa8a720a3dfb74e634cfedb1e9a97d10b0454854ee8c15aaee309a101f9496d54fd6f80e52f9d51cdb5ebf45316c
-
Filesize
36B
MD56783c3ee07c7d151ceac57f1f9c8bed7
SHA117468f98f95bf504cc1f83c49e49a78526b3ea03
SHA2568ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322
SHA512c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8
-
Filesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
Filesize
197B
MD58088241160261560a02c84025d107592
SHA1083121f7027557570994c9fc211df61730455bb5
SHA2562072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1
SHA51220d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478