dcrat | e4bbb97f7a679146763c5d54e15d9b5a376514e975e67a2f5002a42256012a9d

Analysis

max time kernel
149s
max time network
144s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21-12-2024 21:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_e4bbb97f7a679146763c5d54e15d9b5a376514e975e67a2f5002a42256012a9d.exe
Size

1.3MB
MD5

badabf9e3ba0b14c1532eef6c66f7dbe
SHA1

c9d627cd85202dc1486c3080f46ab36d7f7d1a98
SHA256

e4bbb97f7a679146763c5d54e15d9b5a376514e975e67a2f5002a42256012a9d
SHA512

5d12d5a24532b032b87141854959e59b094a5071cdedc66ab63bdb79caa2ea7ce5ba633eb79c6e4a169c278e1ca4075f0f596c6d2b7b584cbb3de653caa3d93a
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 6 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1732	2084	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2816	2084	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2164	2084	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2064	2084	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2284	2084	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2508	2084	schtasks.exe	34

DCRat payload 9 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0008000000016ce1-9.dat	dcrat
behavioral1/memory/2944-13-0x0000000001110000-0x0000000001220000-memory.dmp	dcrat
behavioral1/memory/2804-37-0x0000000000BA0000-0x0000000000CB0000-memory.dmp	dcrat
behavioral1/memory/2392-103-0x0000000001040000-0x0000000001150000-memory.dmp	dcrat
behavioral1/memory/1712-341-0x0000000001250000-0x0000000001360000-memory.dmp	dcrat
behavioral1/memory/2200-462-0x0000000000250000-0x0000000000360000-memory.dmp	dcrat
behavioral1/memory/1776-522-0x00000000000E0000-0x00000000001F0000-memory.dmp	dcrat
behavioral1/memory/2564-583-0x0000000001230000-0x0000000001340000-memory.dmp	dcrat
behavioral1/memory/2940-643-0x00000000012E0000-0x00000000013F0000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1472	powershell.exe
2908	powershell.exe
2272	powershell.exe

Executes dropped EXE 12 IoCs

pid	Process
2944	DllCommonsvc.exe
2804	spoolsv.exe
2392	spoolsv.exe
2704	spoolsv.exe
2284	spoolsv.exe
1520	spoolsv.exe
1712	spoolsv.exe
2872	spoolsv.exe
2200	spoolsv.exe
1776	spoolsv.exe
2564	spoolsv.exe
2940	spoolsv.exe

Loads dropped DLL 2 IoCs

pid	Process
840	cmd.exe
840	cmd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 11 IoCs

Web Service

T1102

flow	ioc
5	raw.githubusercontent.com
12	raw.githubusercontent.com
23	raw.githubusercontent.com
33	raw.githubusercontent.com
36	raw.githubusercontent.com
4	raw.githubusercontent.com
9	raw.githubusercontent.com
16	raw.githubusercontent.com
19	raw.githubusercontent.com
27	raw.githubusercontent.com
30	raw.githubusercontent.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_e4bbb97f7a679146763c5d54e15d9b5a376514e975e67a2f5002a42256012a9d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1732	schtasks.exe
2816	schtasks.exe
2164	schtasks.exe
2064	schtasks.exe
2284	schtasks.exe
2508	schtasks.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
2944	DllCommonsvc.exe
2272	powershell.exe
1472	powershell.exe
2908	powershell.exe
2804	spoolsv.exe
2392	spoolsv.exe
2704	spoolsv.exe
2284	spoolsv.exe
1520	spoolsv.exe
1712	spoolsv.exe
2872	spoolsv.exe
2200	spoolsv.exe
1776	spoolsv.exe
2564	spoolsv.exe
2940	spoolsv.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeDebugPrivilege	2944	DllCommonsvc.exe
Token: SeDebugPrivilege	2272	powershell.exe
Token: SeDebugPrivilege	1472	powershell.exe
Token: SeDebugPrivilege	2804	spoolsv.exe
Token: SeDebugPrivilege	2908	powershell.exe
Token: SeDebugPrivilege	2392	spoolsv.exe
Token: SeDebugPrivilege	2704	spoolsv.exe
Token: SeDebugPrivilege	2284	spoolsv.exe
Token: SeDebugPrivilege	1520	spoolsv.exe
Token: SeDebugPrivilege	1712	spoolsv.exe
Token: SeDebugPrivilege	2872	spoolsv.exe
Token: SeDebugPrivilege	2200	spoolsv.exe
Token: SeDebugPrivilege	1776	spoolsv.exe
Token: SeDebugPrivilege	2564	spoolsv.exe
Token: SeDebugPrivilege	2940	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 2864	3020	JaffaCakes118_e4bbb97f7a679146763c5d54e15d9b5a376514e975e67a2f5002a42256012a9d.exe	30
PID 3020 wrote to memory of 2864	3020	JaffaCakes118_e4bbb97f7a679146763c5d54e15d9b5a376514e975e67a2f5002a42256012a9d.exe	30
PID 3020 wrote to memory of 2864	3020	JaffaCakes118_e4bbb97f7a679146763c5d54e15d9b5a376514e975e67a2f5002a42256012a9d.exe	30
PID 3020 wrote to memory of 2864	3020	JaffaCakes118_e4bbb97f7a679146763c5d54e15d9b5a376514e975e67a2f5002a42256012a9d.exe	30
PID 2864 wrote to memory of 840	2864	WScript.exe	31
PID 2864 wrote to memory of 840	2864	WScript.exe	31
PID 2864 wrote to memory of 840	2864	WScript.exe	31
PID 2864 wrote to memory of 840	2864	WScript.exe	31
PID 840 wrote to memory of 2944	840	cmd.exe	33
PID 840 wrote to memory of 2944	840	cmd.exe	33
PID 840 wrote to memory of 2944	840	cmd.exe	33
PID 840 wrote to memory of 2944	840	cmd.exe	33
PID 2944 wrote to memory of 1472	2944	DllCommonsvc.exe	41
PID 2944 wrote to memory of 1472	2944	DllCommonsvc.exe	41
PID 2944 wrote to memory of 1472	2944	DllCommonsvc.exe	41
PID 2944 wrote to memory of 2908	2944	DllCommonsvc.exe	42
PID 2944 wrote to memory of 2908	2944	DllCommonsvc.exe	42
PID 2944 wrote to memory of 2908	2944	DllCommonsvc.exe	42
PID 2944 wrote to memory of 2272	2944	DllCommonsvc.exe	43
PID 2944 wrote to memory of 2272	2944	DllCommonsvc.exe	43
PID 2944 wrote to memory of 2272	2944	DllCommonsvc.exe	43
PID 2944 wrote to memory of 2804	2944	DllCommonsvc.exe	47
PID 2944 wrote to memory of 2804	2944	DllCommonsvc.exe	47
PID 2944 wrote to memory of 2804	2944	DllCommonsvc.exe	47
PID 2804 wrote to memory of 1080	2804	spoolsv.exe	48
PID 2804 wrote to memory of 1080	2804	spoolsv.exe	48
PID 2804 wrote to memory of 1080	2804	spoolsv.exe	48
PID 1080 wrote to memory of 2108	1080	cmd.exe	50
PID 1080 wrote to memory of 2108	1080	cmd.exe	50
PID 1080 wrote to memory of 2108	1080	cmd.exe	50
PID 1080 wrote to memory of 2392	1080	cmd.exe	51
PID 1080 wrote to memory of 2392	1080	cmd.exe	51
PID 1080 wrote to memory of 2392	1080	cmd.exe	51
PID 2392 wrote to memory of 1596	2392	spoolsv.exe	52
PID 2392 wrote to memory of 1596	2392	spoolsv.exe	52
PID 2392 wrote to memory of 1596	2392	spoolsv.exe	52
PID 1596 wrote to memory of 2780	1596	cmd.exe	54
PID 1596 wrote to memory of 2780	1596	cmd.exe	54
PID 1596 wrote to memory of 2780	1596	cmd.exe	54
PID 1596 wrote to memory of 2704	1596	cmd.exe	55
PID 1596 wrote to memory of 2704	1596	cmd.exe	55
PID 1596 wrote to memory of 2704	1596	cmd.exe	55
PID 2704 wrote to memory of 2836	2704	spoolsv.exe	56
PID 2704 wrote to memory of 2836	2704	spoolsv.exe	56
PID 2704 wrote to memory of 2836	2704	spoolsv.exe	56
PID 2836 wrote to memory of 1824	2836	cmd.exe	58
PID 2836 wrote to memory of 1824	2836	cmd.exe	58
PID 2836 wrote to memory of 1824	2836	cmd.exe	58
PID 2836 wrote to memory of 2284	2836	cmd.exe	59
PID 2836 wrote to memory of 2284	2836	cmd.exe	59
PID 2836 wrote to memory of 2284	2836	cmd.exe	59
PID 2284 wrote to memory of 672	2284	spoolsv.exe	60
PID 2284 wrote to memory of 672	2284	spoolsv.exe	60
PID 2284 wrote to memory of 672	2284	spoolsv.exe	60
PID 672 wrote to memory of 2100	672	cmd.exe	62
PID 672 wrote to memory of 2100	672	cmd.exe	62
PID 672 wrote to memory of 2100	672	cmd.exe	62
PID 672 wrote to memory of 1520	672	cmd.exe	63
PID 672 wrote to memory of 1520	672	cmd.exe	63
PID 672 wrote to memory of 1520	672	cmd.exe	63
PID 1520 wrote to memory of 1088	1520	spoolsv.exe	64
PID 1520 wrote to memory of 1088	1520	spoolsv.exe	64
PID 1520 wrote to memory of 1088	1520	spoolsv.exe	64
PID 1088 wrote to memory of 872	1088	cmd.exe	66

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e4bbb97f7a679146763c5d54e15d9b5a376514e975e67a2f5002a42256012a9d.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e4bbb97f7a679146763c5d54e15d9b5a376514e975e67a2f5002a42256012a9d.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2864
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:840
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2944
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1472
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\spoolsv.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2908
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\dllhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2272
    - - C:\providercommon\spoolsv.exe
        
        "C:\providercommon\spoolsv.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2804
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\hGj9C4kLBH.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1080
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:2108
        
        C:\providercommon\spoolsv.exe
        
        "C:\providercommon\spoolsv.exe"
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2392
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\DXR1U0Y5m3.bat"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:1596
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:2780
        
        C:\providercommon\spoolsv.exe
        
        "C:\providercommon\spoolsv.exe"
        9⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2704
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\l8nFZEr7oq.bat"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:2836
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:1824
        
        C:\providercommon\spoolsv.exe
        
        "C:\providercommon\spoolsv.exe"
        11⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2284
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\yoQf8QHV2Q.bat"
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:672
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:2100
        
        C:\providercommon\spoolsv.exe
        
        "C:\providercommon\spoolsv.exe"
        13⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1520
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\YNa8GmLI5m.bat"
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:1088
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        15⤵
        
        PID:872
        
        C:\providercommon\spoolsv.exe
        
        "C:\providercommon\spoolsv.exe"
        15⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1712
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\hGj9C4kLBH.bat"
        16⤵
        
        PID:1052
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        17⤵
        
        PID:2640
        
        C:\providercommon\spoolsv.exe
        
        "C:\providercommon\spoolsv.exe"
        17⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2872
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\lHo4kC1bcD.bat"
        18⤵
        
        PID:1620
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        19⤵
        
        PID:2208
        
        C:\providercommon\spoolsv.exe
        
        "C:\providercommon\spoolsv.exe"
        19⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2200
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\RId7nS4uU7.bat"
        20⤵
        
        PID:752
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        21⤵
        
        PID:2080
        
        C:\providercommon\spoolsv.exe
        
        "C:\providercommon\spoolsv.exe"
        21⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1776
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\gZmmY05In2.bat"
        22⤵
        
        PID:1316
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        23⤵
        
        PID:2176
        
        C:\providercommon\spoolsv.exe
        
        "C:\providercommon\spoolsv.exe"
        23⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2564
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\DJG58brWjr.bat"
        24⤵
        
        PID:2416
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        25⤵
        
        PID:860
        
        C:\providercommon\spoolsv.exe
        
        "C:\providercommon\spoolsv.exe"
        25⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 7 /tr "'C:\providercommon\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\providercommon\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 8 /tr "'C:\providercommon\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2164

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f8be351179f1fc2c05a06907adf28733

SHA1
d55eef177dff7bcdeb0c3f35aae3cf079818d30a

SHA256
9ecdc97f28030bbb67d6b629fbeb56af9613fbbd0e00d13de3c195b725cb6df9

SHA512
031c104e2ab7ff44057c4a35e6be44da73cd0d75f3c2c09ae2e3a6a8373967b52e926d055bd14cfd758a79645b1b5b74d7210e8b4f80d1d89d460644f784b457

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1e90ae0901b1e3e63d9251a9b53fcb99

SHA1
ea0af206cd9cc6c9fa1a7f0d984863ca051afeab

SHA256
677087d505209a1de264a052b1744b933f0095b380adda7d32690461075ce537

SHA512
e626eeb4eaf3ea05e3515cdfd8191b11820780f0e9cd88f6760dfba52800710c75e1c24725a7924a010dfe24d944b56ade2a89e64bc96104dccc3c91982b8bab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cf53b4f1193b6e1a7c2d9fbba341c6e5

SHA1
cd5b110fc3f4561237a050f07adae275d0da9aa8

SHA256
b229b2c6ede0f2ade49b57bc255a008595aae5b461a21bb9c18e242ef332e872

SHA512
88d44fc252bb652dcef2214196c434699d4ad5944c5637d3d91483331d34f2bf0d285de5e8441f43524a267a6de4b4e63bbd3b4cc6554ca15a01bfab19aaa8f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5e872b0a2d407c5c7b41bf7ff2cc1338

SHA1
3d8cc5943aa74e508dc2c06ce01b33e1f334c20b

SHA256
51407a7a273a0002b8ad38f8cf90a56a3f68a17ef10e1d9a57ffac5bc0a851ee

SHA512
9b4eb013645f151b3e6c2da304d643e2cee00990539b780706a8a4f1bdd17e19520567d93364e01626a2098e2ef0c98225b043a5aa9dcc47492d47954e62a47d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4f7ab6fde1f6eae95205cdfd1ce9ed22

SHA1
0970599cded504faa9dd79b17523ba3e7f2354cf

SHA256
ada1e81b1a3cd5ef44c79ec5ec7ae4a6e8906245157fdfbad253ab7ae7794185

SHA512
44e4e0ac3e392c51f24cf98fa33c9fc26a9648dc71693511bbaf9005f2608d66f1193bc32116db863fe5f17f4f17576b2f8c0adf94f8da9fa4fac58e8c7ea2c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
197d8717a4f643c5ffece45ccfeb52de

SHA1
501723d8cda63ff407d2aa202b735ca7b65f629b

SHA256
9bd50ef55dfa85e9f8d55ef84572dcb230ee50ed86cc6dfc99196ce165e5c3a8

SHA512
79a4fed3f59d2b59ce9bd37ac3ad574d95b54a74365a905ef0e1e341bc56d3bf00c344f49958382b5de1159a01985d862eb0c3b603f397a4b9b9f2dd3938f15f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
be62e117bca0ba6e69b13cffed573ac0

SHA1
fea6b21662fd2b9e14a0c5dd49b1bef99688fe16

SHA256
624b83d42b585a71c453c61c3459e39c91f379e8aab966c45a222424d77d2b65

SHA512
7272b8bd1c294a4485d6f9e453137417038af0a2dbb0128e0d91fcfab9b8661e529cf0f597210186f2c8689ead34dcea9ebbef2a067645f8440527868df8676b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
38e8d88ff091f76b2b11c79e305679a9

SHA1
853106f5b59b59c54dabd55163f6e4aa4475eb54

SHA256
af85f73d6a66c51bd5c6a4cc1e2692e954cfbb35d344274aac8599a5f61ff4fa

SHA512
4f16cff916ac66e79a6d05cc48f3969d0c8b68566540e5cf10840ec6ace4e518eba71b44709842f2549e4853ac092f48b4a60c560a30347017aa446f50ba3b3a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5f7e0b19c22bbf01ae80be7d2fcb68bd

SHA1
f29f2a4d8a2b367e98eaec63fecd865dd1427607

SHA256
134163b1f69a849e6d8d80c416f17b3dd0fe025f817f5d4a7916b0d14f3e4828

SHA512
b2293a5ad4f2f5127f15fb97711b1407df26e6370c5631b0625542a734e6653c104f73053165a20f65835d2c8b0e35489ec496d5ea2fddfd8a530172d17e767f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab41A4.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\DJG58brWjr.bat

Filesize
194B

MD5
09c574ee28b72366c1d783ec123cc99a

SHA1
1c63a583e5bad8e6f7e229f6cd66f4ecf343e134

SHA256
f2f339d43fdf3beca8c81bc5a33fed6ff1d86c1230ad3c930394fb6b2fd22f79

SHA512
f5f61c32cc630170f64dd680863f955b748d98640a45525144567a7c693dd02ceecf547e8ed326f94257baece053396c4f15c3247321e3e2b470f2cfd11d3766

Download Submit
C:\Users\Admin\AppData\Local\Temp\DXR1U0Y5m3.bat

Filesize
194B

MD5
50bdc5a0b5ed1efef6358cd9b1277164

SHA1
1bc30ec45d15faa22f6d31f1605a1084034e2f01

SHA256
6da2f337e036b996f2713e23e89467c7dca7757fd55fae946b009ae063437b79

SHA512
6aa8fb012ec394e61c8dc3cbe9ae0ec3452881e9a623badbfedc5737350de487c78020cfad0b4df7cb35d44e5611a24b0cb89ffde221c8a5b26a1bbc756c7893

Download Submit
C:\Users\Admin\AppData\Local\Temp\RId7nS4uU7.bat

Filesize
194B

MD5
08be74ba4cfc45c3ebf249edaf987275

SHA1
49d2deb2171427af32e67827f8feff02d74a003a

SHA256
007ebc9055b39cad426e587d5bc249abca08d1908366828402c6b2288610ac34

SHA512
c038b750485aacc07c4242f0f516e9a964981b8790adc52c383d04413ddf43c74bd53ff75bad8fbdaebcf065611c770f1b3a6facdf09028b9ae6517e9fd699c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar41B7.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\YNa8GmLI5m.bat

Filesize
194B

MD5
25e7763b8cb2f535ee5452b32bb35f62

SHA1
55539fe5a76b5b51077a05a88549a8d7e0a659a7

SHA256
fa533369b81ee42ed51b5b4051f791d640177a77b720d091c75759ca72c5d7ce

SHA512
144a78363b1f9c4223d09cc66ba0808d15b235366ef6dbb95223d3070df62a08d0d27ab25276a2ce5a52526a6d5e9083caae7ca4bba5eb7056a8c9cba43f88c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\gZmmY05In2.bat

Filesize
194B

MD5
c5a4b17c74f3dfe606dc38da94505032

SHA1
d4227ebd275fb9858dac33cbb6c8b0e24c576388

SHA256
894dad1fb8fe6f3ba2d72869c4b0a1752de4501b6f4a6914d9d7699e8df39e6f

SHA512
83d540d53d3b015de239cee1179d2599175a987ac8583c508298e843cdd7f0fe7db27eb3bebdc2b1b6e3de0498bc4b77ddb4287e1f8f3ba36da1ebdd6d84e5b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\hGj9C4kLBH.bat

Filesize
194B

MD5
b5d3efab0b39be7abcd623bfdaf19f4a

SHA1
758b971235c8c9061e69fb4df76590ffbb83d9fb

SHA256
664024d742243e9f99f21102463f613420a3ac186ba64694d54918bd739dfb16

SHA512
4e84ef441878c9aed755a6e41e689e6db89603d141827292d57830cfd4a921ebb27c746a6001dd79c612d2d8bc3bd6b226b8cfebf14e1196be4eb9450d0b091f

Download Submit
C:\Users\Admin\AppData\Local\Temp\l8nFZEr7oq.bat

Filesize
194B

MD5
14866b0b33e1312b9df0b8e8b6505a74

SHA1
437c2cfa99fb29813bbb9837f862c4f23f624135

SHA256
f52716a3092b3ff03459c7140a4fb33758ee1a4f94d7c93d39f52cf54623c915

SHA512
030bea053677fb560bd0ed4c2f0b166aea68e9511129b613ce75c5098baf03fee1d2c2f59ddc1903ff339f5bdc360fe3e3180eb77f1bd015786cb24d9f99e9e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\lHo4kC1bcD.bat

Filesize
194B

MD5
f268efaf91c2a307dafc2f2345b55870

SHA1
3f574cd54c7e3b4d69d0610ed13a0107ca21b877

SHA256
8ac126aeadbedebc7849383badeb76946926aa997c4e7e3c092d1f4e53ad7a6d

SHA512
d50567c06ee21d9fbbb0d7fe606808556b6581c6d90b45f31f40c2cc478eb4ee71deb9850436b1474b8aa3f4fd9fcc3c6ff09d71b1aa8417a3986ade5b11d747

Download Submit
C:\Users\Admin\AppData\Local\Temp\yoQf8QHV2Q.bat

Filesize
194B

MD5
5612fa4859b0b5bf8f2f2d850da48415

SHA1
ad568464b07c2fc2f48bcf47c4b306aae221a4d9

SHA256
336702106efe85504444f6b59513b83e8f89a2a8f57e228fcaf111d28f6466ea

SHA512
f8b552f70cda8b02bd193b111eae5510bad1a23021efa8796bff62a09d6bbcd168bcce8735fe7cd9e10c45d49daa7ac225976857e6b0767fe0765cbb3c0f7c7c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
4ccb0ee5e8edbabc257b244865af0613

SHA1
24e8dd3d4b15f108ce976bc4c39afebf5b559bde

SHA256
904fd872208fb22135d0b76c708062f5816fbbb03aa4abdabb629d8e618b097b

SHA512
991cec40daf3ed310fc0b12a42d4c73c4f97516a882f27aa5838f044c737a533875496bfcd158dbcc45f0624c43881a7073d2b35d1f288066dd07f8242d43243

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
memory/1472-39-0x000000001B430000-0x000000001B712000-memory.dmp

Filesize
2.9MB

Download
memory/1712-341-0x0000000001250000-0x0000000001360000-memory.dmp

Filesize
1.1MB

Download
memory/1712-342-0x0000000000250000-0x0000000000262000-memory.dmp

Filesize
72KB

Download
memory/1776-522-0x00000000000E0000-0x00000000001F0000-memory.dmp

Filesize
1.1MB

Download
memory/1776-523-0x0000000000250000-0x0000000000262000-memory.dmp

Filesize
72KB

Download
memory/2200-462-0x0000000000250000-0x0000000000360000-memory.dmp

Filesize
1.1MB

Download
memory/2272-38-0x0000000002810000-0x0000000002818000-memory.dmp

Filesize
32KB

Download
memory/2392-103-0x0000000001040000-0x0000000001150000-memory.dmp

Filesize
1.1MB

Download
memory/2564-583-0x0000000001230000-0x0000000001340000-memory.dmp

Filesize
1.1MB

Download
memory/2704-163-0x0000000000150000-0x0000000000162000-memory.dmp

Filesize
72KB

Download
memory/2804-37-0x0000000000BA0000-0x0000000000CB0000-memory.dmp

Filesize
1.1MB

Download
memory/2872-402-0x00000000002B0000-0x00000000002C2000-memory.dmp

Filesize
72KB

Download
memory/2940-643-0x00000000012E0000-0x00000000013F0000-memory.dmp

Filesize
1.1MB

Download
memory/2944-15-0x00000000002E0000-0x00000000002EC000-memory.dmp

Filesize
48KB

Download
memory/2944-14-0x00000000002C0000-0x00000000002D2000-memory.dmp

Filesize
72KB

Download
memory/2944-13-0x0000000001110000-0x0000000001220000-memory.dmp

Filesize
1.1MB

Download
memory/2944-16-0x00000000002D0000-0x00000000002DC000-memory.dmp

Filesize
48KB

Download
memory/2944-17-0x00000000002F0000-0x00000000002FC000-memory.dmp

Filesize
48KB

Download