dcrat | 951380a32786bfa1415fa4c01c24d9c0f130a9f248ed9d0e03cfd95cdb453c42

Analysis

max time kernel
148s
max time network
150s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21-12-2024 20:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_951380a32786bfa1415fa4c01c24d9c0f130a9f248ed9d0e03cfd95cdb453c42.exe
Size

1.3MB
MD5

431ee704cf04cd1fbf267f4d835e47fe
SHA1

cbaf204ae8426f3cf935b5509a33d9c01bc1f0c9
SHA256

951380a32786bfa1415fa4c01c24d9c0f130a9f248ed9d0e03cfd95cdb453c42
SHA512

b472bd1ace9cc7e47f8979a93d7dac7ee512ee3885454b8854828ed6cb348bc5e5c7fcc34df0aab13ca0101a8ca26ab20af0ad3de433b47ec40d49c067e12f31
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 12 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3000	2616	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2172	2616	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1980	2616	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1852	2616	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1860	2616	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2892	2616	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2676	2616	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2040	2616	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1556	2616	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1988	2616	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2084	2616	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1632	2616	schtasks.exe	34

DCRat payload 5 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x00070000000173f3-12.dat	dcrat
behavioral1/memory/2812-13-0x00000000001A0000-0x00000000002B0000-memory.dmp	dcrat
behavioral1/memory/1760-58-0x0000000000F10000-0x0000000001020000-memory.dmp	dcrat
behavioral1/memory/1672-236-0x0000000001270000-0x0000000001380000-memory.dmp	dcrat
behavioral1/memory/2928-712-0x00000000000E0000-0x00000000001F0000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1364	powershell.exe
1908	powershell.exe
1300	powershell.exe
1624	powershell.exe
1972	powershell.exe

Executes dropped EXE 13 IoCs

pid	Process
2812	DllCommonsvc.exe
1760	audiodg.exe
2028	audiodg.exe
1516	audiodg.exe
1672	audiodg.exe
836	audiodg.exe
2316	audiodg.exe
2780	audiodg.exe
2200	audiodg.exe
1304	audiodg.exe
2072	audiodg.exe
2100	audiodg.exe
2928	audiodg.exe

Loads dropped DLL 2 IoCs

pid	Process
2848	cmd.exe
2848	cmd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 12 IoCs

Web Service

T1102

flow	ioc
12	raw.githubusercontent.com
18	raw.githubusercontent.com
21	raw.githubusercontent.com
25	raw.githubusercontent.com
34	raw.githubusercontent.com
37	raw.githubusercontent.com
4	raw.githubusercontent.com
5	raw.githubusercontent.com
9	raw.githubusercontent.com
15	raw.githubusercontent.com
28	raw.githubusercontent.com
31	raw.githubusercontent.com

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files\Uninstall Information\audiodg.exe	DllCommonsvc.exe
File created	C:\Program Files\Uninstall Information\42af1c969fbb7b	DllCommonsvc.exe
File created	C:\Program Files\Windows Media Player\taskhost.exe	DllCommonsvc.exe
File opened for modification	C:\Program Files\Windows Media Player\taskhost.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Media Player\b75386f1303e64	DllCommonsvc.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Web\Wallpaper\Architecture\conhost.exe	DllCommonsvc.exe
File created	C:\Windows\Web\Wallpaper\Architecture\088424020bedd6	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_951380a32786bfa1415fa4c01c24d9c0f130a9f248ed9d0e03cfd95cdb453c42.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 12 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1860	schtasks.exe
2676	schtasks.exe
2040	schtasks.exe
1556	schtasks.exe
3000	schtasks.exe
2172	schtasks.exe
1980	schtasks.exe
1852	schtasks.exe
1988	schtasks.exe
2084	schtasks.exe
2892	schtasks.exe
1632	schtasks.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
2812	DllCommonsvc.exe
1972	powershell.exe
1364	powershell.exe
1908	powershell.exe
1300	powershell.exe
1624	powershell.exe
1760	audiodg.exe
2028	audiodg.exe
1516	audiodg.exe
1672	audiodg.exe
836	audiodg.exe
2316	audiodg.exe
2780	audiodg.exe
2200	audiodg.exe
1304	audiodg.exe
2072	audiodg.exe
2100	audiodg.exe
2928	audiodg.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeDebugPrivilege	2812	DllCommonsvc.exe
Token: SeDebugPrivilege	1972	powershell.exe
Token: SeDebugPrivilege	1364	powershell.exe
Token: SeDebugPrivilege	1908	powershell.exe
Token: SeDebugPrivilege	1300	powershell.exe
Token: SeDebugPrivilege	1624	powershell.exe
Token: SeDebugPrivilege	1760	audiodg.exe
Token: SeDebugPrivilege	2028	audiodg.exe
Token: SeDebugPrivilege	1516	audiodg.exe
Token: SeDebugPrivilege	1672	audiodg.exe
Token: SeDebugPrivilege	836	audiodg.exe
Token: SeDebugPrivilege	2316	audiodg.exe
Token: SeDebugPrivilege	2780	audiodg.exe
Token: SeDebugPrivilege	2200	audiodg.exe
Token: SeDebugPrivilege	1304	audiodg.exe
Token: SeDebugPrivilege	2072	audiodg.exe
Token: SeDebugPrivilege	2100	audiodg.exe
Token: SeDebugPrivilege	2928	audiodg.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2668 wrote to memory of 2804	2668	JaffaCakes118_951380a32786bfa1415fa4c01c24d9c0f130a9f248ed9d0e03cfd95cdb453c42.exe	30
PID 2668 wrote to memory of 2804	2668	JaffaCakes118_951380a32786bfa1415fa4c01c24d9c0f130a9f248ed9d0e03cfd95cdb453c42.exe	30
PID 2668 wrote to memory of 2804	2668	JaffaCakes118_951380a32786bfa1415fa4c01c24d9c0f130a9f248ed9d0e03cfd95cdb453c42.exe	30
PID 2668 wrote to memory of 2804	2668	JaffaCakes118_951380a32786bfa1415fa4c01c24d9c0f130a9f248ed9d0e03cfd95cdb453c42.exe	30
PID 2804 wrote to memory of 2848	2804	WScript.exe	31
PID 2804 wrote to memory of 2848	2804	WScript.exe	31
PID 2804 wrote to memory of 2848	2804	WScript.exe	31
PID 2804 wrote to memory of 2848	2804	WScript.exe	31
PID 2848 wrote to memory of 2812	2848	cmd.exe	33
PID 2848 wrote to memory of 2812	2848	cmd.exe	33
PID 2848 wrote to memory of 2812	2848	cmd.exe	33
PID 2848 wrote to memory of 2812	2848	cmd.exe	33
PID 2812 wrote to memory of 1972	2812	DllCommonsvc.exe	47
PID 2812 wrote to memory of 1972	2812	DllCommonsvc.exe	47
PID 2812 wrote to memory of 1972	2812	DllCommonsvc.exe	47
PID 2812 wrote to memory of 1364	2812	DllCommonsvc.exe	48
PID 2812 wrote to memory of 1364	2812	DllCommonsvc.exe	48
PID 2812 wrote to memory of 1364	2812	DllCommonsvc.exe	48
PID 2812 wrote to memory of 1908	2812	DllCommonsvc.exe	49
PID 2812 wrote to memory of 1908	2812	DllCommonsvc.exe	49
PID 2812 wrote to memory of 1908	2812	DllCommonsvc.exe	49
PID 2812 wrote to memory of 1300	2812	DllCommonsvc.exe	50
PID 2812 wrote to memory of 1300	2812	DllCommonsvc.exe	50
PID 2812 wrote to memory of 1300	2812	DllCommonsvc.exe	50
PID 2812 wrote to memory of 1624	2812	DllCommonsvc.exe	51
PID 2812 wrote to memory of 1624	2812	DllCommonsvc.exe	51
PID 2812 wrote to memory of 1624	2812	DllCommonsvc.exe	51
PID 2812 wrote to memory of 1760	2812	DllCommonsvc.exe	57
PID 2812 wrote to memory of 1760	2812	DllCommonsvc.exe	57
PID 2812 wrote to memory of 1760	2812	DllCommonsvc.exe	57
PID 1760 wrote to memory of 2064	1760	audiodg.exe	58
PID 1760 wrote to memory of 2064	1760	audiodg.exe	58
PID 1760 wrote to memory of 2064	1760	audiodg.exe	58
PID 2064 wrote to memory of 2032	2064	cmd.exe	60
PID 2064 wrote to memory of 2032	2064	cmd.exe	60
PID 2064 wrote to memory of 2032	2064	cmd.exe	60
PID 2064 wrote to memory of 2028	2064	cmd.exe	61
PID 2064 wrote to memory of 2028	2064	cmd.exe	61
PID 2064 wrote to memory of 2028	2064	cmd.exe	61
PID 2028 wrote to memory of 1728	2028	audiodg.exe	62
PID 2028 wrote to memory of 1728	2028	audiodg.exe	62
PID 2028 wrote to memory of 1728	2028	audiodg.exe	62
PID 1728 wrote to memory of 296	1728	cmd.exe	64
PID 1728 wrote to memory of 296	1728	cmd.exe	64
PID 1728 wrote to memory of 296	1728	cmd.exe	64
PID 1728 wrote to memory of 1516	1728	cmd.exe	65
PID 1728 wrote to memory of 1516	1728	cmd.exe	65
PID 1728 wrote to memory of 1516	1728	cmd.exe	65
PID 1516 wrote to memory of 2008	1516	audiodg.exe	66
PID 1516 wrote to memory of 2008	1516	audiodg.exe	66
PID 1516 wrote to memory of 2008	1516	audiodg.exe	66
PID 2008 wrote to memory of 2676	2008	cmd.exe	68
PID 2008 wrote to memory of 2676	2008	cmd.exe	68
PID 2008 wrote to memory of 2676	2008	cmd.exe	68
PID 2008 wrote to memory of 1672	2008	cmd.exe	69
PID 2008 wrote to memory of 1672	2008	cmd.exe	69
PID 2008 wrote to memory of 1672	2008	cmd.exe	69
PID 1672 wrote to memory of 2656	1672	audiodg.exe	70
PID 1672 wrote to memory of 2656	1672	audiodg.exe	70
PID 1672 wrote to memory of 2656	1672	audiodg.exe	70
PID 2656 wrote to memory of 2456	2656	cmd.exe	72
PID 2656 wrote to memory of 2456	2656	cmd.exe	72
PID 2656 wrote to memory of 2456	2656	cmd.exe	72
PID 2656 wrote to memory of 836	2656	cmd.exe	73

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_951380a32786bfa1415fa4c01c24d9c0f130a9f248ed9d0e03cfd95cdb453c42.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_951380a32786bfa1415fa4c01c24d9c0f130a9f248ed9d0e03cfd95cdb453c42.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2668
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2804
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2848
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2812
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1972
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Media Player\taskhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1364
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\explorer.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1908
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Uninstall Information\audiodg.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1300
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Web\Wallpaper\Architecture\conhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1624
    - - C:\Program Files\Uninstall Information\audiodg.exe
        
        "C:\Program Files\Uninstall Information\audiodg.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1760
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\X8VSEkwS9E.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2064
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:2032
        
        C:\Program Files\Uninstall Information\audiodg.exe
        
        "C:\Program Files\Uninstall Information\audiodg.exe"
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2028
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\F82V1kRox2.bat"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:1728
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:296
        
        C:\Program Files\Uninstall Information\audiodg.exe
        
        "C:\Program Files\Uninstall Information\audiodg.exe"
        9⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1516
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\QVLs15dYuc.bat"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:2008
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:2676
        
        C:\Program Files\Uninstall Information\audiodg.exe
        
        "C:\Program Files\Uninstall Information\audiodg.exe"
        11⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1672
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\VCTPXfsZqS.bat"
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:2656
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:2456
        
        C:\Program Files\Uninstall Information\audiodg.exe
        
        "C:\Program Files\Uninstall Information\audiodg.exe"
        13⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:836
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\3Bw8qtkvcA.bat"
        14⤵
        
        PID:2880
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        15⤵
        
        PID:1400
        
        C:\Program Files\Uninstall Information\audiodg.exe
        
        "C:\Program Files\Uninstall Information\audiodg.exe"
        15⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2316
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\nDwMkfOC2e.bat"
        16⤵
        
        PID:1296
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        17⤵
        
        PID:2144
        
        C:\Program Files\Uninstall Information\audiodg.exe
        
        "C:\Program Files\Uninstall Information\audiodg.exe"
        17⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2780
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\7bDnwPuEug.bat"
        18⤵
        
        PID:2336
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        19⤵
        
        PID:1328
        
        C:\Program Files\Uninstall Information\audiodg.exe
        
        "C:\Program Files\Uninstall Information\audiodg.exe"
        19⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2200
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\TmtjCtAJTq.bat"
        20⤵
        
        PID:680
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        21⤵
        
        PID:2000
        
        C:\Program Files\Uninstall Information\audiodg.exe
        
        "C:\Program Files\Uninstall Information\audiodg.exe"
        21⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1304
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\QwDZd8tkMK.bat"
        22⤵
        
        PID:780
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        23⤵
        
        PID:308
        
        C:\Program Files\Uninstall Information\audiodg.exe
        
        "C:\Program Files\Uninstall Information\audiodg.exe"
        23⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2072
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Kq4mDwN7mD.bat"
        24⤵
        
        PID:1656
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        25⤵
        
        PID:1032
        
        C:\Program Files\Uninstall Information\audiodg.exe
        
        "C:\Program Files\Uninstall Information\audiodg.exe"
        25⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2100
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\hbGxgnDDQj.bat"
        26⤵
        
        PID:2364
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        27⤵
        
        PID:2324
        
        C:\Program Files\Uninstall Information\audiodg.exe
        
        "C:\Program Files\Uninstall Information\audiodg.exe"
        27⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Media Player\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Program Files\Windows Media Player\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2172

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Media Player\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 9 /tr "'C:\Program Files\Uninstall Information\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 9 /tr "'C:\Program Files\Uninstall Information\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 9 /tr "'C:\Windows\Web\Wallpaper\Architecture\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Windows\Web\Wallpaper\Architecture\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 12 /tr "'C:\Windows\Web\Wallpaper\Architecture\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d1b3b3004f9a21a1476e25c6c2ee8797

SHA1
9bda3aa363d81db3b69b43df02180204f65cbfb1

SHA256
2d20b1961ad28bbbb1cae12072163e58c2e97b6469abff7007dbaf8b95cc5dac

SHA512
2ec5e98e6240aafb24bb5be0e34652a4fc8761b76ed0e127bcb8237ace8eefc734c2a2aa401ced5752edf92e285e16a038f9dfba5537112f8b02243a8ea566c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8e7404881929423799a86ffb390c8f4f

SHA1
1794aea8ed30e2c29d45a92e66786dd22f110f05

SHA256
9babb17467739b4b57fdd22e4aa0baa9d5c427fbc93a7805915e3eb31a756b9b

SHA512
6dcf4ea84a5a777dd2474ac36ea8841652604f353d65b6e13e483a2bd716ec06d82f06a4661bbf53372d64842dc435cf02bbabdce5545c27cec1d7c0cf11f14e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d0e9a8b0fd13771da662f631c3ef723c

SHA1
de20c6976f09b7f74620936c06ed7c7b027bee2a

SHA256
a12800c3bff811b70ef2f057a9d4701bef57f844c8e793b59de7216e0121e6ed

SHA512
970fcc3aaa4d0bde7e08b69bbbcdfa59043cbd836e0500d00f75a9526efa7379561269eca356312bf20aebbeaf6c375be3496bc8706b572a7337aa877dafe9eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6c9a243e32c94df84c746824dadb53cf

SHA1
5078b4a39bdd0003c84d488da667f8f0b156adce

SHA256
4fec649568704ebdbb3ac6acfbf70f876f7eceaf0e582e14bf5df1aaf5703c6b

SHA512
60484a3568a5aa01b6567027075c1a15b5715a559436c7c21648634f148a59b84d03436df0e9da2e5ec57adccd52959893347d307dfffdfdf6ad4141a3fd5437

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6340e807c29ac73e2598dfe60bf23d08

SHA1
dbce5e96e0f92d59208417362fe52b251dd51b18

SHA256
e7cc820a8771b9a954d59f9bf2f76ca93c156f2e3800d01accc2d33c0619e2b7

SHA512
8ca7dcbb7ac01fae4887496f3b5e6ab59badcf3dd1f0634887562c711416a1a23401ed8ccb0db6aec3eba4d1abede6d2ab803110f16e16bee58f769c64834e7f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6e51bfece473dd6bef01e0fb829fb5b0

SHA1
f3d9f7401d5e83418c6add6b89e029903d481648

SHA256
d2440a4945206ac0c1a498ccae139c43e2f502bf91f076627f269cdd0d87e255

SHA512
d794524f8b3fc7a367d98f9925ae21dd030f116fbbd9daed4f87c29a2a6eaa67669e797a8a59fb88999f8a27751f0d7084173eae12f4b88da6468ff0fdaaf961

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3ecca23185e46a01ad06117bac2213ed

SHA1
1f4051bff32fa7756ef4a7b04ebeb4b573e320cd

SHA256
ca75c366580773caaec00c07ab9908f92057a480bd9a7252922dc12996b182d6

SHA512
62f6351cf2a603df2b07ed3598fa408c3b5ae771cd0e2881dd75e05c953cb8cfc40e69b9709ea5be7ec3659495f3e778c1e4d920e2a244290112e6539377d111

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
59da8808be5a1c092895cc05aebb5981

SHA1
5375e33fc2ec794741789700a30b204c113bc5ba

SHA256
c19a360f187f7baf712f044a774831ad22d978a1484beedabd610f619dd7d366

SHA512
72675da782f6e05dffdeba4cd1ef22f325e5adc58fb078f97d430d008e47ea4490f662729f13ab5263df623d175fbc698ad4c6355e755011bec38ed87a9d04eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d7ca07d816dba6d292f06cffeb29e85f

SHA1
7072c3d007e27229cb75fe074b2614f6d1b62a9e

SHA256
e45b7b14d329ac5b21985479ba5636c6fed22e1f46205e2e06445790fb207a66

SHA512
001c2d7247f57e6e89a536d097d2fcc545c5c704168c32d13824e4cb744f52529dd742ecdcf870ed42775ce292cfa1da462550914bb392a23ad730ca970557b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
27c4d17c6be7a181c13b6ad309cc400f

SHA1
0d55d775cac314aee172785c0da63f52395d744b

SHA256
eb077d1a7ef36b6a9a7328624a054bb64d1598c2c63ad988e48ff6288f2bf33c

SHA512
8d8edceefff7e3ec50ce78341e142128f300f1c65ef8ce2ea636987569b29c0027a4e776cfffff06afe3a06198671e93457c24757328375fd88450ac50e0541e

Download Submit
C:\Users\Admin\AppData\Local\Temp\3Bw8qtkvcA.bat

Filesize
215B

MD5
7a4f9d5afc37a145dcacabb136f09c10

SHA1
adc568ccfa33525fabeadff6256f799bec203caf

SHA256
bb66f3ea6429587f5cf8e9e3c5fd3cf725e0eaee70d8870f71b193f356fda0cc

SHA512
9f2a23e01641245cc884c9bf4261f491fbcc0d0d273b69ff22ed6adf88c52cbe2a9c2a6c327c56a84739df889ff3b8a7f1310034db71a7a90ab1e77ff89964fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\7bDnwPuEug.bat

Filesize
215B

MD5
6efadd99127110eb6b389e23213bb14a

SHA1
b156523eb5c6bd8804ecfd49ebf87fb9969bbdd1

SHA256
736b6b4db6853f2c6a55236ffe39d94d67df6abeb05cd9a5c907a4bd59a92f1f

SHA512
59fbb7462037b66e610307f3e21638cfec432af00696f8444359ea998664d2b649123aeeebe6305c5d694365b6f218501aa79e96f40b5f1e91b173333ffb9437

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2898.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\F82V1kRox2.bat

Filesize
215B

MD5
0b7c834385bf2e57df730227514d27c5

SHA1
c7c3e1145a094fe532f989960fc381340d0a3894

SHA256
bd431d4dd7d3ed6596a20499daa1fe7597f7b0ab3dd369075c86381fdc86f683

SHA512
c791ab85a18320b4e8b39ac2eaeabf933abd75e274fdddc7ec68f25448b41253ea344a208f6ea6be5db4d1a963474b7f3aa9b85d53528025e5fbdd596f18887b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Kq4mDwN7mD.bat

Filesize
215B

MD5
18c0660495345a1ab25766ea0e7cc5e5

SHA1
5df46dc41a97cf2a14d4cc3a873f8725b02dda7d

SHA256
d9ccbddd4349aecf1429c01b795faa671416805320297a24ce7e9b7cc63cf444

SHA512
5764879c22ff4f8aa2ca70c352cf6e3141b5514a90d67267ef94028f2fc876dbaf9d233887c8c0be13afbba70ec495e2a651e09e335f043447d33a480c09d34b

Download Submit
C:\Users\Admin\AppData\Local\Temp\QVLs15dYuc.bat

Filesize
215B

MD5
a957a0f28944b4a670b451d0f6403e09

SHA1
f4ae2c40edcb58cf300791c6ad6a49dc80da2140

SHA256
dc40fa8f702bf6fa9e14202ae6cb4a505df199a709dfe8a46a0cfbe6f5659954

SHA512
dbeebd984102e3f856e5c7d60d27b6cedf4ff494b79da6eb81e8516a9640e4dbcda906b2e50fcf784babd76bcc81436b2b38befdf7a199eb9cd969f914046dd4

Download Submit
C:\Users\Admin\AppData\Local\Temp\QwDZd8tkMK.bat

Filesize
215B

MD5
1457f72f92d3063707a06ad82e01c8ff

SHA1
a427e948e16e4b1a8847272bb27ebf045422032b

SHA256
089983c1f006e8640ac8d43d574e0840d7d0e555224ad3d949f3dc265e64dd44

SHA512
b393e5d80ad20fc026c7e47dcd40cdff3a0fb5a1c2dde9d6b36bab714db35b0972cf74f4238ac398329568db55b88738e163971ee3e9ddb305d994852ba879e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar289B.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmtjCtAJTq.bat

Filesize
215B

MD5
edf172546534081bd707b498432a8283

SHA1
4ca9131a84e3476a7efa37a30b43547ac4d11a6f

SHA256
956cc2a00c37d8e48ecd3465cd5d889cb8b5726d50ea06ef3d323cc0a52e7958

SHA512
b91702dcbdc1c6ea278de53ba9bc97b553b44c7596e3f8e3ef8064993ab126a62a74fb837e878bba6c4f56f569d17088b3450785e8aa87981fb10762d73aeaea

Download Submit
C:\Users\Admin\AppData\Local\Temp\VCTPXfsZqS.bat

Filesize
215B

MD5
d48c875ca55e5c291f81398fd220bb80

SHA1
af1b348896647bc6da31c0f0ab1faaeb520f4d48

SHA256
8fdd4c315498324f61db417f0add9316c9c126c1b2e27ab6997b902c0913e6df

SHA512
76fdca3951fe0efc2c66cf3987bbed9de8db5b413916b6df25c7f3f1a354f4df241a38c5d9d6bfcb835ffef7d8d24b86321d3ff9165e870dbae4c0fff06d3949

Download Submit
C:\Users\Admin\AppData\Local\Temp\X8VSEkwS9E.bat

Filesize
215B

MD5
972ae278554f2345321c15e9996e247b

SHA1
9b52da0644d776e89b71b8925ff303c05712241b

SHA256
ead7477ea673a8949c64105ec5c98c9445ba4a578b2b8789c579652d41abc0db

SHA512
9280d36e62c258a2040fee09367baf0ce895713ef9cf850674947438a91fca04448585e338e6f15bddd3c770a56066e5a2357013cda7eca28acc7f8985280512

Download Submit
C:\Users\Admin\AppData\Local\Temp\hbGxgnDDQj.bat

Filesize
215B

MD5
7df77dda32399b596bb7bc9a2cf50ba9

SHA1
5d84ed31c1e64616079582d8efcf47bcad36967f

SHA256
c82cc0e772dc8f883d95f591839399b5d193857817bab5cccb812941505f5044

SHA512
8214efb7bfe7435b55015bdd47288357e4861dd189bc9b9d4ef44878634f7e6355f9e6c0e7ea96a251defd6f7ebbb9085df71f5acd61443e9300dfe166f8e607

Download Submit
C:\Users\Admin\AppData\Local\Temp\nDwMkfOC2e.bat

Filesize
215B

MD5
cd5230d962b52f9307933ffe0276ef7e

SHA1
e9f701d2ade900eb6cb7b6445c98ef79b3ad080e

SHA256
bc08154af45421ac991d6368407128c210c75ec90beaa5bbf952160eafc5134d

SHA512
4c9d0c68c17909079d2b96c3646bb10ce2985c01bfc334b286a84666aab7c376fabe0473410f8e39764f7843185b3366d94c879e54321758ea0fef72d5de0bc6

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\9QOU6SLLSLZEWSTTUHCY.temp

Filesize
7KB

MD5
464a121d06a486649c223c0a4683593e

SHA1
70d5be970da6770a315498c4b2d67c1a8e3e09bc

SHA256
85a67eb3bd24c99455ce32b70e56a777f7065bbdeaadaf422d6778ce56b11422

SHA512
8db65e8bfd64065cf073f4cb3a9e435afb7090dde25ed5c5553023ba589b3565f4fb476548c2c5e556cb0795f8a64e6981a5b95d10ce0a45e20c3f317fea15e6

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/836-297-0x00000000002C0000-0x00000000002D2000-memory.dmp

Filesize
72KB

Download
memory/1516-176-0x00000000003C0000-0x00000000003D2000-memory.dmp

Filesize
72KB

Download
memory/1672-236-0x0000000001270000-0x0000000001380000-memory.dmp

Filesize
1.1MB

Download
memory/1672-237-0x00000000001D0000-0x00000000001E2000-memory.dmp

Filesize
72KB

Download
memory/1760-58-0x0000000000F10000-0x0000000001020000-memory.dmp

Filesize
1.1MB

Download
memory/1972-36-0x000000001B6D0000-0x000000001B9B2000-memory.dmp

Filesize
2.9MB

Download
memory/1972-37-0x00000000026D0000-0x00000000026D8000-memory.dmp

Filesize
32KB

Download
memory/2200-475-0x0000000000830000-0x0000000000842000-memory.dmp

Filesize
72KB

Download
memory/2812-17-0x0000000000180000-0x000000000018C000-memory.dmp

Filesize
48KB

Download
memory/2812-16-0x0000000000150000-0x000000000015C000-memory.dmp

Filesize
48KB

Download
memory/2812-15-0x0000000000170000-0x000000000017C000-memory.dmp

Filesize
48KB

Download
memory/2812-14-0x0000000000140000-0x0000000000152000-memory.dmp

Filesize
72KB

Download
memory/2812-13-0x00000000001A0000-0x00000000002B0000-memory.dmp

Filesize
1.1MB

Download
memory/2928-712-0x00000000000E0000-0x00000000001F0000-memory.dmp

Filesize
1.1MB

Download
memory/2928-713-0x0000000000460000-0x0000000000472000-memory.dmp

Filesize
72KB

Download