dcrat | 3d679bc62e2ef1bd605b59e1c36747a96d799c0c494bae02f4c73b259b4b8d73

Analysis

max time kernel
144s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2024 00:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_3d679bc62e2ef1bd605b59e1c36747a96d799c0c494bae02f4c73b259b4b8d73.exe
Size

1.3MB
MD5

28d3885200ecc9a0a0e7ebbb02fb4ed5
SHA1

09b23287d1222540650eeeca94d27714313e6953
SHA256

3d679bc62e2ef1bd605b59e1c36747a96d799c0c494bae02f4c73b259b4b8d73
SHA512

a3eab6cb06826e1a19868c43380edf86a337a0ab377427679b74b64bc3992340a93950d05b7272d602affb2a664b368303d004cc1d2da0d31402f87edebdeb8a
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 9 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1140	5012	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1816	5012	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2416	5012	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3284	5012	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1628	5012	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2268	5012	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2720	5012	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1100	5012	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3228	5012	schtasks.exe	87

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x000a000000023b80-9.dat	dcrat
behavioral2/memory/1360-13-0x0000000000BB0000-0x0000000000CC0000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4472	powershell.exe
2964	powershell.exe
4972	powershell.exe
3064	powershell.exe

Checks computer location settings 2 TTPs 14 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	wininit.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	wininit.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	wininit.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	wininit.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	wininit.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	JaffaCakes118_3d679bc62e2ef1bd605b59e1c36747a96d799c0c494bae02f4c73b259b4b8d73.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	wininit.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	wininit.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	wininit.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	wininit.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	wininit.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	wininit.exe

Executes dropped EXE 13 IoCs

pid	Process
1360	DllCommonsvc.exe
1624	wininit.exe
1100	wininit.exe
3616	wininit.exe
624	wininit.exe
1912	wininit.exe
1176	wininit.exe
5092	wininit.exe
2480	wininit.exe
4912	wininit.exe
1892	wininit.exe
3976	wininit.exe
5084	wininit.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 12 IoCs

Web Service

T1102

flow	ioc
20	raw.githubusercontent.com
37	raw.githubusercontent.com
41	raw.githubusercontent.com
42	raw.githubusercontent.com
49	raw.githubusercontent.com
51	raw.githubusercontent.com
19	raw.githubusercontent.com
22	raw.githubusercontent.com
36	raw.githubusercontent.com
40	raw.githubusercontent.com
50	raw.githubusercontent.com
52	raw.githubusercontent.com

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jre-1.8\sppsvc.exe	DllCommonsvc.exe
File created	C:\Program Files\Java\jre-1.8\0a1fd5f707cd16	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_3d679bc62e2ef1bd605b59e1c36747a96d799c0c494bae02f4c73b259b4b8d73.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 13 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	wininit.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	wininit.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	wininit.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	wininit.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	wininit.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	wininit.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	wininit.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	JaffaCakes118_3d679bc62e2ef1bd605b59e1c36747a96d799c0c494bae02f4c73b259b4b8d73.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	wininit.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	wininit.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	wininit.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	wininit.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 9 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3284	schtasks.exe
1628	schtasks.exe
2720	schtasks.exe
3228	schtasks.exe
1816	schtasks.exe
2416	schtasks.exe
2268	schtasks.exe
1100	schtasks.exe
1140	schtasks.exe

Suspicious behavior: EnumeratesProcesses 27 IoCs

pid	Process
1360	DllCommonsvc.exe
1360	DllCommonsvc.exe
1360	DllCommonsvc.exe
1360	DllCommonsvc.exe
1360	DllCommonsvc.exe
1360	DllCommonsvc.exe
1360	DllCommonsvc.exe
2964	powershell.exe
4972	powershell.exe
3064	powershell.exe
4472	powershell.exe
2964	powershell.exe
3064	powershell.exe
4472	powershell.exe
4972	powershell.exe
1624	wininit.exe
1100	wininit.exe
3616	wininit.exe
624	wininit.exe
1912	wininit.exe
1176	wininit.exe
5092	wininit.exe
2480	wininit.exe
4912	wininit.exe
1892	wininit.exe
3976	wininit.exe
5084	wininit.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeDebugPrivilege	1360	DllCommonsvc.exe
Token: SeDebugPrivilege	2964	powershell.exe
Token: SeDebugPrivilege	4972	powershell.exe
Token: SeDebugPrivilege	3064	powershell.exe
Token: SeDebugPrivilege	4472	powershell.exe
Token: SeDebugPrivilege	1624	wininit.exe
Token: SeDebugPrivilege	1100	wininit.exe
Token: SeDebugPrivilege	3616	wininit.exe
Token: SeDebugPrivilege	624	wininit.exe
Token: SeDebugPrivilege	1912	wininit.exe
Token: SeDebugPrivilege	1176	wininit.exe
Token: SeDebugPrivilege	5092	wininit.exe
Token: SeDebugPrivilege	2480	wininit.exe
Token: SeDebugPrivilege	4912	wininit.exe
Token: SeDebugPrivilege	1892	wininit.exe
Token: SeDebugPrivilege	3976	wininit.exe
Token: SeDebugPrivilege	5084	wininit.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4480 wrote to memory of 3568	4480	JaffaCakes118_3d679bc62e2ef1bd605b59e1c36747a96d799c0c494bae02f4c73b259b4b8d73.exe	83
PID 4480 wrote to memory of 3568	4480	JaffaCakes118_3d679bc62e2ef1bd605b59e1c36747a96d799c0c494bae02f4c73b259b4b8d73.exe	83
PID 4480 wrote to memory of 3568	4480	JaffaCakes118_3d679bc62e2ef1bd605b59e1c36747a96d799c0c494bae02f4c73b259b4b8d73.exe	83
PID 3568 wrote to memory of 812	3568	WScript.exe	84
PID 3568 wrote to memory of 812	3568	WScript.exe	84
PID 3568 wrote to memory of 812	3568	WScript.exe	84
PID 812 wrote to memory of 1360	812	cmd.exe	86
PID 812 wrote to memory of 1360	812	cmd.exe	86
PID 1360 wrote to memory of 4472	1360	DllCommonsvc.exe	98
PID 1360 wrote to memory of 4472	1360	DllCommonsvc.exe	98
PID 1360 wrote to memory of 3064	1360	DllCommonsvc.exe	99
PID 1360 wrote to memory of 3064	1360	DllCommonsvc.exe	99
PID 1360 wrote to memory of 4972	1360	DllCommonsvc.exe	100
PID 1360 wrote to memory of 4972	1360	DllCommonsvc.exe	100
PID 1360 wrote to memory of 2964	1360	DllCommonsvc.exe	101
PID 1360 wrote to memory of 2964	1360	DllCommonsvc.exe	101
PID 1360 wrote to memory of 1876	1360	DllCommonsvc.exe	106
PID 1360 wrote to memory of 1876	1360	DllCommonsvc.exe	106
PID 1876 wrote to memory of 3320	1876	cmd.exe	108
PID 1876 wrote to memory of 3320	1876	cmd.exe	108
PID 1876 wrote to memory of 1624	1876	cmd.exe	114
PID 1876 wrote to memory of 1624	1876	cmd.exe	114
PID 1624 wrote to memory of 3684	1624	wininit.exe	122
PID 1624 wrote to memory of 3684	1624	wininit.exe	122
PID 3684 wrote to memory of 548	3684	cmd.exe	124
PID 3684 wrote to memory of 548	3684	cmd.exe	124
PID 3684 wrote to memory of 1100	3684	cmd.exe	126
PID 3684 wrote to memory of 1100	3684	cmd.exe	126
PID 1100 wrote to memory of 3060	1100	wininit.exe	128
PID 1100 wrote to memory of 3060	1100	wininit.exe	128
PID 3060 wrote to memory of 4776	3060	cmd.exe	130
PID 3060 wrote to memory of 4776	3060	cmd.exe	130
PID 3060 wrote to memory of 3616	3060	cmd.exe	135
PID 3060 wrote to memory of 3616	3060	cmd.exe	135
PID 3616 wrote to memory of 3136	3616	wininit.exe	137
PID 3616 wrote to memory of 3136	3616	wininit.exe	137
PID 3136 wrote to memory of 1544	3136	cmd.exe	139
PID 3136 wrote to memory of 1544	3136	cmd.exe	139
PID 3136 wrote to memory of 624	3136	cmd.exe	141
PID 3136 wrote to memory of 624	3136	cmd.exe	141
PID 624 wrote to memory of 2356	624	wininit.exe	143
PID 624 wrote to memory of 2356	624	wininit.exe	143
PID 2356 wrote to memory of 3548	2356	cmd.exe	145
PID 2356 wrote to memory of 3548	2356	cmd.exe	145
PID 2356 wrote to memory of 1912	2356	cmd.exe	147
PID 2356 wrote to memory of 1912	2356	cmd.exe	147
PID 1912 wrote to memory of 4980	1912	wininit.exe	149
PID 1912 wrote to memory of 4980	1912	wininit.exe	149
PID 4980 wrote to memory of 2140	4980	cmd.exe	151
PID 4980 wrote to memory of 2140	4980	cmd.exe	151
PID 4980 wrote to memory of 1176	4980	cmd.exe	153
PID 4980 wrote to memory of 1176	4980	cmd.exe	153
PID 1176 wrote to memory of 2132	1176	wininit.exe	155
PID 1176 wrote to memory of 2132	1176	wininit.exe	155
PID 2132 wrote to memory of 2136	2132	cmd.exe	157
PID 2132 wrote to memory of 2136	2132	cmd.exe	157
PID 2132 wrote to memory of 5092	2132	cmd.exe	159
PID 2132 wrote to memory of 5092	2132	cmd.exe	159
PID 5092 wrote to memory of 4028	5092	wininit.exe	161
PID 5092 wrote to memory of 4028	5092	wininit.exe	161
PID 4028 wrote to memory of 312	4028	cmd.exe	163
PID 4028 wrote to memory of 312	4028	cmd.exe	163
PID 4028 wrote to memory of 2480	4028	cmd.exe	165
PID 4028 wrote to memory of 2480	4028	cmd.exe	165

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3d679bc62e2ef1bd605b59e1c36747a96d799c0c494bae02f4c73b259b4b8d73.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3d679bc62e2ef1bd605b59e1c36747a96d799c0c494bae02f4c73b259b4b8d73.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4480
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3568
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:812
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Program Files directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1360
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4472
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\wininit.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3064
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\sppsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4972
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Java\jre-1.8\sppsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2964
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\stXbKLwhfO.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1876
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:3320
      - C:\Recovery\WindowsRE\wininit.exe
        
        "C:\Recovery\WindowsRE\wininit.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1624
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\CooinIVsng.bat"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:3684
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:548
        
        C:\Recovery\WindowsRE\wininit.exe
        
        "C:\Recovery\WindowsRE\wininit.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1100
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\OZJpL0Zeaq.bat"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:3060
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:4776
        
        C:\Recovery\WindowsRE\wininit.exe
        
        "C:\Recovery\WindowsRE\wininit.exe"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3616
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\r7gOBUt9HL.bat"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:3136
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:1544
        
        C:\Recovery\WindowsRE\wininit.exe
        
        "C:\Recovery\WindowsRE\wininit.exe"
        12⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:624
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\fH1ASKIIFN.bat"
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:2356
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        14⤵
        
        PID:3548
        
        C:\Recovery\WindowsRE\wininit.exe
        
        "C:\Recovery\WindowsRE\wininit.exe"
        14⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1912
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\q3WH03M43W.bat"
        15⤵
        Suspicious use of WriteProcessMemory
        
        PID:4980
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        16⤵
        
        PID:2140
        
        C:\Recovery\WindowsRE\wininit.exe
        
        "C:\Recovery\WindowsRE\wininit.exe"
        16⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1176
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\r7gOBUt9HL.bat"
        17⤵
        Suspicious use of WriteProcessMemory
        
        PID:2132
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        18⤵
        
        PID:2136
        
        C:\Recovery\WindowsRE\wininit.exe
        
        "C:\Recovery\WindowsRE\wininit.exe"
        18⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5092
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\vFDRBKGR2C.bat"
        19⤵
        Suspicious use of WriteProcessMemory
        
        PID:4028
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        20⤵
        
        PID:312
        
        C:\Recovery\WindowsRE\wininit.exe
        
        "C:\Recovery\WindowsRE\wininit.exe"
        20⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2480
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\j95GpUP4tv.bat"
        21⤵
        
        PID:2964
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        22⤵
        
        PID:4488
        
        C:\Recovery\WindowsRE\wininit.exe
        
        "C:\Recovery\WindowsRE\wininit.exe"
        22⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4912
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Asmf6CRzTu.bat"
        23⤵
        
        PID:4008
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        24⤵
        
        PID:1820
        
        C:\Recovery\WindowsRE\wininit.exe
        
        "C:\Recovery\WindowsRE\wininit.exe"
        24⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1892
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\vFDRBKGR2C.bat"
        25⤵
        
        PID:2236
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        26⤵
        
        PID:2368
        
        C:\Recovery\WindowsRE\wininit.exe
        
        "C:\Recovery\WindowsRE\wininit.exe"
        26⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3976
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\CooinIVsng.bat"
        27⤵
        
        PID:3900
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        28⤵
        
        PID:4352
        
        C:\Recovery\WindowsRE\wininit.exe
        
        "C:\Recovery\WindowsRE\wininit.exe"
        28⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1140

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 10 /tr "'C:\providercommon\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\providercommon\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 13 /tr "'C:\providercommon\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\Program Files\Java\jre-1.8\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files\Java\jre-1.8\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1100

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 13 /tr "'C:\Program Files\Java\jre-1.8\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\wininit.exe.log

Filesize
1KB

MD5
baf55b95da4a601229647f25dad12878

SHA1
abc16954ebfd213733c4493fc1910164d825cac8

SHA256
ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

SHA512
24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
2e907f77659a6601fcc408274894da2e

SHA1
9f5b72abef1cd7145bf37547cdb1b9254b4efe9d

SHA256
385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233

SHA512
34fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
77d622bb1a5b250869a3238b9bc1402b

SHA1
d47f4003c2554b9dfc4c16f22460b331886b191b

SHA256
f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

SHA512
d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
62623d22bd9e037191765d5083ce16a3

SHA1
4a07da6872672f715a4780513d95ed8ddeefd259

SHA256
95d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010

SHA512
9a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992

Download Submit
C:\Users\Admin\AppData\Local\Temp\Asmf6CRzTu.bat

Filesize
198B

MD5
3eb9524c7a2b9192f9a4de4ff39bfaba

SHA1
5f9d2f6baf51f01984c62b6f239065b1250282cb

SHA256
f60b041f2bea05e10e52ff7233ca13f9acc99e6424e028a601147a1392b46263

SHA512
e7ae6a39b12db841a85f9f43826283ce5c222dada6b18a6f0fd327080579d964f2466bd876925b7e57592ef7d2e441e2ca19df035bde3219a25f897d65ccc5e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\CooinIVsng.bat

Filesize
198B

MD5
ee4aee9bde7a1d76e230da85e92775a2

SHA1
0fb25f89d0514bd0765a62e84b8787daaa5689e9

SHA256
429ad4a51281a209294fc868ddd0e423e4247701ace7acd12ae3a7fce7818a5f

SHA512
e4809bdf765005109f49c584b54c9421c5f101ffaf64e045050d062b059cb22bb9cd075c2402c32126771052c21c58564310aaaf6b5b8be1c4246b96eedcd4bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\OZJpL0Zeaq.bat

Filesize
198B

MD5
9148981b5be843a2eefe717e5f4cdb30

SHA1
bb53fb141ecfe591417dd026251cdeb6e4b441ff

SHA256
f88bdfe2ed6d1c8ef441f1604f196d6671ca7c1ef571d123be0317cbb6cd256b

SHA512
d54e1c0d12b7540167eb0426a406ea6bf055cd79571eac91c06bd49f800ff8e94c987e371e45d903453201ac1e3ab7b4a4a23664dd0b66999bb29138d1e53968

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_20vuilvv.kts.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\fH1ASKIIFN.bat

Filesize
198B

MD5
2a38db75e19fbf08625c25220f37eaf5

SHA1
674025a6af6ebc5e5dac9afc70155d515a1e5750

SHA256
ff300f426251b0c00f857952a77d1758841e5928a479261442f96d01530dca28

SHA512
984dc32290046bacbfbb7ccb7902157ef93f3db3ec91c8a7bc0e7d7f4fe714350ed94e52aeae5229edae9cb674bec38caa6e22c2829d057d700aa77b23517e0b

Download Submit
C:\Users\Admin\AppData\Local\Temp\j95GpUP4tv.bat

Filesize
198B

MD5
d8de917379fb1036be220a9e45cbc86b

SHA1
3aae717131e1af7dac83215369932c05c56bd255

SHA256
bec1e48a18042248bb1b424a18b7e3fc991a0648d11dffae4c689d104113a262

SHA512
098237e90eec3a8d8d49f6edcb83ef91000f14ceff04e46fd35198d4bf76f02a12b2ac6d1dac389a8ddd6ae6f9997660d5d21db84f8435243fd95e7f15df6097

Download Submit
C:\Users\Admin\AppData\Local\Temp\q3WH03M43W.bat

Filesize
198B

MD5
e0fa156c515f095c60ad06c7c03a74b3

SHA1
57c82a56cfe0247c8411cf6025b168a9f3bf6824

SHA256
0f7cb686205ed6e22a4dfe60ce1e593b88f7c736bd0de62ddebc32d65c2568f0

SHA512
bee0e13d3a99d09e686060000fe48ec3137821e3928bc0b3138ee0206e92e1e29e9228ad1478a5ca6d9765400a52a655d62c768a41eed9f5689ae359db219271

Download Submit
C:\Users\Admin\AppData\Local\Temp\r7gOBUt9HL.bat

Filesize
198B

MD5
1c8e31fd7533786df610bcfd06741941

SHA1
c7a7091317f2c4e3fdc652bd79c799d237a0550d

SHA256
7d435eb44fbdf80ec6a636ffd2186f0f99c57234d36dc39997bce16451f3dd81

SHA512
d0553ab40fb2e24e9eca6cb62f10b08f02a29c30bcfd1db8d7989525a476323d7e35da7b9eb3ab067cf0ce11d414fd42cddcc292006e754eeecadc6c7c3433f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\stXbKLwhfO.bat

Filesize
198B

MD5
b9e3ec5300bab477fb8d3df15e8927be

SHA1
ecd885de64d6514f29243cfb49e64a945ed3ac3c

SHA256
8b03826161c493658f52a042a974566a3ffa2cb7bbc534eb7c40223919a798ed

SHA512
44b76e5fef5af58817235d124cda9c6b05816e0ca1f864ced5f4c3289509a57ae3278ab65c68b3d21761707db17227c7f7572225114bb0743f470db1206e0b07

Download Submit
C:\Users\Admin\AppData\Local\Temp\vFDRBKGR2C.bat

Filesize
198B

MD5
51f9203e539ffabfdd290dd51ea6e2e4

SHA1
a0ff5cda0cf7652f5feb2584d13c8b5976f3a14e

SHA256
88eb1d860061bab06e042f5c522e631b7e1e896015f295f9b67e07454c3f0be6

SHA512
360041c68c3d54eebf4001725841de32cb50c98bf157444d66ffdb7f95d05b1734dc4a1b5ee38c3942ca5c6dd376f807c7bc823ccbf8482a40dc9cf386b80f89

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/1360-15-0x0000000003120000-0x000000000312C000-memory.dmp

Filesize
48KB

Download
memory/1360-12-0x00007FFEFA9C3000-0x00007FFEFA9C5000-memory.dmp

Filesize
8KB

Download
memory/1360-13-0x0000000000BB0000-0x0000000000CC0000-memory.dmp

Filesize
1.1MB

Download
memory/1360-14-0x0000000003100000-0x0000000003112000-memory.dmp

Filesize
72KB

Download
memory/1360-16-0x0000000003110000-0x000000000311C000-memory.dmp

Filesize
48KB

Download
memory/1360-17-0x0000000003130000-0x000000000313C000-memory.dmp

Filesize
48KB

Download
memory/1912-106-0x0000000002FF0000-0x0000000003002000-memory.dmp

Filesize
72KB

Download
memory/2964-38-0x0000024DEFFC0000-0x0000024DEFFE2000-memory.dmp

Filesize
136KB

Download
memory/3616-93-0x00000000015C0000-0x00000000015D2000-memory.dmp

Filesize
72KB

Download
memory/4912-131-0x00000000013C0000-0x00000000013D2000-memory.dmp

Filesize
72KB

Download