dcrat | 3c8f846d26452cc241065278b2f18f16d389a506fcb7d1052d568f746ccfce4f

Analysis

max time kernel
143s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2024 00:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_3c8f846d26452cc241065278b2f18f16d389a506fcb7d1052d568f746ccfce4f.exe
Size

1.3MB
MD5

7d7ef23a8491ae7204bfc24de5794577
SHA1

254ba6066a2d51f707a9b16b57fbe70b144e6687
SHA256

3c8f846d26452cc241065278b2f18f16d389a506fcb7d1052d568f746ccfce4f
SHA512

cfc44ee4128e8206f127e5770360c51863a25f0a456b31e72fafcb8f5a1a7e30651d30b1c42c46a78669c9553bfab73ead58d50ebd5034c8cd3ef713806c51fb
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 9 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4504	1152	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1760	1152	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4104	1152	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3068	1152	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2676	1152	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2524	1152	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4856	1152	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4192	1152	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5112	1152	schtasks.exe	87

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x0007000000023c9c-10.dat	dcrat
behavioral2/memory/3280-13-0x0000000000960000-0x0000000000A70000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1188	powershell.exe
4892	powershell.exe
2836	powershell.exe
4348	powershell.exe

Checks computer location settings 2 TTPs 16 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	Registry.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	Registry.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	Registry.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	Registry.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	Registry.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	Registry.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	Registry.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	Registry.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	Registry.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	JaffaCakes118_3c8f846d26452cc241065278b2f18f16d389a506fcb7d1052d568f746ccfce4f.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	Registry.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	Registry.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	Registry.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	Registry.exe

Executes dropped EXE 15 IoCs

pid	Process
3280	DllCommonsvc.exe
2964	Registry.exe
3764	Registry.exe
2384	Registry.exe
4588	Registry.exe
828	Registry.exe
1124	Registry.exe
4416	Registry.exe
3044	Registry.exe
4424	Registry.exe
4268	Registry.exe
384	Registry.exe
4856	Registry.exe
3704	Registry.exe
2252	Registry.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 14 IoCs

Web Service

T1102

flow	ioc
14	raw.githubusercontent.com
45	raw.githubusercontent.com
53	raw.githubusercontent.com
55	raw.githubusercontent.com
52	raw.githubusercontent.com
54	raw.githubusercontent.com
20	raw.githubusercontent.com
26	raw.githubusercontent.com
40	raw.githubusercontent.com
41	raw.githubusercontent.com
46	raw.githubusercontent.com
51	raw.githubusercontent.com
15	raw.githubusercontent.com
44	raw.githubusercontent.com

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\Registry.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\ee2ad38f3d4382	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_3c8f846d26452cc241065278b2f18f16d389a506fcb7d1052d568f746ccfce4f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 14 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	Registry.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	Registry.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	Registry.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	Registry.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	Registry.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	Registry.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	Registry.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	Registry.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	Registry.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	JaffaCakes118_3c8f846d26452cc241065278b2f18f16d389a506fcb7d1052d568f746ccfce4f.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	Registry.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	Registry.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	Registry.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	Registry.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 9 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4504	schtasks.exe
4104	schtasks.exe
2524	schtasks.exe
4856	schtasks.exe
4192	schtasks.exe
1760	schtasks.exe
3068	schtasks.exe
2676	schtasks.exe
5112	schtasks.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
3280	DllCommonsvc.exe
4892	powershell.exe
1188	powershell.exe
4348	powershell.exe
2836	powershell.exe
4348	powershell.exe
4892	powershell.exe
1188	powershell.exe
2964	Registry.exe
2836	powershell.exe
3764	Registry.exe
2384	Registry.exe
4588	Registry.exe
828	Registry.exe
1124	Registry.exe
4416	Registry.exe
3044	Registry.exe
4424	Registry.exe
4268	Registry.exe
384	Registry.exe
4856	Registry.exe
3704	Registry.exe
2252	Registry.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	3280	DllCommonsvc.exe
Token: SeDebugPrivilege	4892	powershell.exe
Token: SeDebugPrivilege	1188	powershell.exe
Token: SeDebugPrivilege	4348	powershell.exe
Token: SeDebugPrivilege	2836	powershell.exe
Token: SeDebugPrivilege	2964	Registry.exe
Token: SeDebugPrivilege	3764	Registry.exe
Token: SeDebugPrivilege	2384	Registry.exe
Token: SeDebugPrivilege	4588	Registry.exe
Token: SeDebugPrivilege	828	Registry.exe
Token: SeDebugPrivilege	1124	Registry.exe
Token: SeDebugPrivilege	4416	Registry.exe
Token: SeDebugPrivilege	3044	Registry.exe
Token: SeDebugPrivilege	4424	Registry.exe
Token: SeDebugPrivilege	4268	Registry.exe
Token: SeDebugPrivilege	384	Registry.exe
Token: SeDebugPrivilege	4856	Registry.exe
Token: SeDebugPrivilege	3704	Registry.exe
Token: SeDebugPrivilege	2252	Registry.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1264 wrote to memory of 3668	1264	JaffaCakes118_3c8f846d26452cc241065278b2f18f16d389a506fcb7d1052d568f746ccfce4f.exe	83
PID 1264 wrote to memory of 3668	1264	JaffaCakes118_3c8f846d26452cc241065278b2f18f16d389a506fcb7d1052d568f746ccfce4f.exe	83
PID 1264 wrote to memory of 3668	1264	JaffaCakes118_3c8f846d26452cc241065278b2f18f16d389a506fcb7d1052d568f746ccfce4f.exe	83
PID 3668 wrote to memory of 2180	3668	WScript.exe	84
PID 3668 wrote to memory of 2180	3668	WScript.exe	84
PID 3668 wrote to memory of 2180	3668	WScript.exe	84
PID 2180 wrote to memory of 3280	2180	cmd.exe	86
PID 2180 wrote to memory of 3280	2180	cmd.exe	86
PID 3280 wrote to memory of 2836	3280	DllCommonsvc.exe	98
PID 3280 wrote to memory of 2836	3280	DllCommonsvc.exe	98
PID 3280 wrote to memory of 4892	3280	DllCommonsvc.exe	99
PID 3280 wrote to memory of 4892	3280	DllCommonsvc.exe	99
PID 3280 wrote to memory of 1188	3280	DllCommonsvc.exe	100
PID 3280 wrote to memory of 1188	3280	DllCommonsvc.exe	100
PID 3280 wrote to memory of 4348	3280	DllCommonsvc.exe	101
PID 3280 wrote to memory of 4348	3280	DllCommonsvc.exe	101
PID 3280 wrote to memory of 2964	3280	DllCommonsvc.exe	106
PID 3280 wrote to memory of 2964	3280	DllCommonsvc.exe	106
PID 2964 wrote to memory of 4456	2964	Registry.exe	108
PID 2964 wrote to memory of 4456	2964	Registry.exe	108
PID 4456 wrote to memory of 916	4456	cmd.exe	110
PID 4456 wrote to memory of 916	4456	cmd.exe	110
PID 4456 wrote to memory of 3764	4456	cmd.exe	117
PID 4456 wrote to memory of 3764	4456	cmd.exe	117
PID 3764 wrote to memory of 2560	3764	Registry.exe	121
PID 3764 wrote to memory of 2560	3764	Registry.exe	121
PID 2560 wrote to memory of 1344	2560	cmd.exe	123
PID 2560 wrote to memory of 1344	2560	cmd.exe	123
PID 2560 wrote to memory of 2384	2560	cmd.exe	129
PID 2560 wrote to memory of 2384	2560	cmd.exe	129
PID 2384 wrote to memory of 1268	2384	Registry.exe	131
PID 2384 wrote to memory of 1268	2384	Registry.exe	131
PID 1268 wrote to memory of 3960	1268	cmd.exe	133
PID 1268 wrote to memory of 3960	1268	cmd.exe	133
PID 1268 wrote to memory of 4588	1268	cmd.exe	138
PID 1268 wrote to memory of 4588	1268	cmd.exe	138
PID 4588 wrote to memory of 1532	4588	Registry.exe	140
PID 4588 wrote to memory of 1532	4588	Registry.exe	140
PID 1532 wrote to memory of 4268	1532	cmd.exe	142
PID 1532 wrote to memory of 4268	1532	cmd.exe	142
PID 1532 wrote to memory of 828	1532	cmd.exe	144
PID 1532 wrote to memory of 828	1532	cmd.exe	144
PID 828 wrote to memory of 4088	828	Registry.exe	146
PID 828 wrote to memory of 4088	828	Registry.exe	146
PID 4088 wrote to memory of 1008	4088	cmd.exe	148
PID 4088 wrote to memory of 1008	4088	cmd.exe	148
PID 4088 wrote to memory of 1124	4088	cmd.exe	150
PID 4088 wrote to memory of 1124	4088	cmd.exe	150
PID 1124 wrote to memory of 1388	1124	Registry.exe	152
PID 1124 wrote to memory of 1388	1124	Registry.exe	152
PID 1388 wrote to memory of 3896	1388	cmd.exe	154
PID 1388 wrote to memory of 3896	1388	cmd.exe	154
PID 1388 wrote to memory of 4416	1388	cmd.exe	156
PID 1388 wrote to memory of 4416	1388	cmd.exe	156
PID 4416 wrote to memory of 4288	4416	Registry.exe	158
PID 4416 wrote to memory of 4288	4416	Registry.exe	158
PID 4288 wrote to memory of 1896	4288	cmd.exe	160
PID 4288 wrote to memory of 1896	4288	cmd.exe	160
PID 4288 wrote to memory of 3044	4288	cmd.exe	162
PID 4288 wrote to memory of 3044	4288	cmd.exe	162
PID 3044 wrote to memory of 3576	3044	Registry.exe	164
PID 3044 wrote to memory of 3576	3044	Registry.exe	164
PID 3576 wrote to memory of 3004	3576	cmd.exe	166
PID 3576 wrote to memory of 3004	3576	cmd.exe	166

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3c8f846d26452cc241065278b2f18f16d389a506fcb7d1052d568f746ccfce4f.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3c8f846d26452cc241065278b2f18f16d389a506fcb7d1052d568f746ccfce4f.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1264
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3668
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2180
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3280
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2836
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\wininit.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4892
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\StartMenuExperienceHost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1188
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Mozilla Maintenance Service\logs\Registry.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4348
    - - C:\Program Files (x86)\Mozilla Maintenance Service\logs\Registry.exe
        
        "C:\Program Files (x86)\Mozilla Maintenance Service\logs\Registry.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2964
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\be8zRZs4e0.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4456
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:916
        
        C:\Program Files (x86)\Mozilla Maintenance Service\logs\Registry.exe
        
        "C:\Program Files (x86)\Mozilla Maintenance Service\logs\Registry.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3764
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\wKGJ2NUoAL.bat"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:2560
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:1344
        
        C:\Program Files (x86)\Mozilla Maintenance Service\logs\Registry.exe
        
        "C:\Program Files (x86)\Mozilla Maintenance Service\logs\Registry.exe"
        9⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2384
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\EtrZeLjFvq.bat"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:1268
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:3960
        
        C:\Program Files (x86)\Mozilla Maintenance Service\logs\Registry.exe
        
        "C:\Program Files (x86)\Mozilla Maintenance Service\logs\Registry.exe"
        11⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4588
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\fcYyv3mAUp.bat"
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:1532
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:4268
        
        C:\Program Files (x86)\Mozilla Maintenance Service\logs\Registry.exe
        
        "C:\Program Files (x86)\Mozilla Maintenance Service\logs\Registry.exe"
        13⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:828
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\oLfAgN0jmw.bat"
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:4088
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        15⤵
        
        PID:1008
        
        C:\Program Files (x86)\Mozilla Maintenance Service\logs\Registry.exe
        
        "C:\Program Files (x86)\Mozilla Maintenance Service\logs\Registry.exe"
        15⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1124
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\8xeM6k5O3T.bat"
        16⤵
        Suspicious use of WriteProcessMemory
        
        PID:1388
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        17⤵
        
        PID:3896
        
        C:\Program Files (x86)\Mozilla Maintenance Service\logs\Registry.exe
        
        "C:\Program Files (x86)\Mozilla Maintenance Service\logs\Registry.exe"
        17⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4416
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\sJ59Arupck.bat"
        18⤵
        Suspicious use of WriteProcessMemory
        
        PID:4288
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        19⤵
        
        PID:1896
        
        C:\Program Files (x86)\Mozilla Maintenance Service\logs\Registry.exe
        
        "C:\Program Files (x86)\Mozilla Maintenance Service\logs\Registry.exe"
        19⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3044
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\1CKPPXbanu.bat"
        20⤵
        Suspicious use of WriteProcessMemory
        
        PID:3576
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        21⤵
        
        PID:3004
        
        C:\Program Files (x86)\Mozilla Maintenance Service\logs\Registry.exe
        
        "C:\Program Files (x86)\Mozilla Maintenance Service\logs\Registry.exe"
        21⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4424
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\XdxpZ3I66P.bat"
        22⤵
        
        PID:536
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        23⤵
        
        PID:3848
        
        C:\Program Files (x86)\Mozilla Maintenance Service\logs\Registry.exe
        
        "C:\Program Files (x86)\Mozilla Maintenance Service\logs\Registry.exe"
        23⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4268
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\hYa1c8p3ob.bat"
        24⤵
        
        PID:3536
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        25⤵
        
        PID:4804
        
        C:\Program Files (x86)\Mozilla Maintenance Service\logs\Registry.exe
        
        "C:\Program Files (x86)\Mozilla Maintenance Service\logs\Registry.exe"
        25⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:384
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\D9KWG0zl28.bat"
        26⤵
        
        PID:4968
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        27⤵
        
        PID:1760
        
        C:\Program Files (x86)\Mozilla Maintenance Service\logs\Registry.exe
        
        "C:\Program Files (x86)\Mozilla Maintenance Service\logs\Registry.exe"
        27⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4856
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\tDjG3X7WPV.bat"
        28⤵
        
        PID:3916
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        29⤵
        
        PID:2572
        
        C:\Program Files (x86)\Mozilla Maintenance Service\logs\Registry.exe
        
        "C:\Program Files (x86)\Mozilla Maintenance Service\logs\Registry.exe"
        29⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3704
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\1CKPPXbanu.bat"
        30⤵
        
        PID:4928
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        31⤵
        
        PID:1788
        
        C:\Program Files (x86)\Mozilla Maintenance Service\logs\Registry.exe
        
        "C:\Program Files (x86)\Mozilla Maintenance Service\logs\Registry.exe"
        31⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2252

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\providercommon\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\providercommon\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\providercommon\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 5 /tr "'C:\Users\Public\AccountPictures\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Users\Public\AccountPictures\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 11 /tr "'C:\Users\Public\AccountPictures\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Registry.exe.log

Filesize
1KB

MD5
baf55b95da4a601229647f25dad12878

SHA1
abc16954ebfd213733c4493fc1910164d825cac8

SHA256
ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

SHA512
24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
77d622bb1a5b250869a3238b9bc1402b

SHA1
d47f4003c2554b9dfc4c16f22460b331886b191b

SHA256
f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

SHA512
d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6d42b6da621e8df5674e26b799c8e2aa

SHA1
ab3ce1327ea1eeedb987ec823d5e0cb146bafa48

SHA256
5ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c

SHA512
53faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29

Download Submit
C:\Users\Admin\AppData\Local\Temp\1CKPPXbanu.bat

Filesize
233B

MD5
733e7a0c7fd2dc8c72e515c4d8659790

SHA1
7259775cc201f19e3f0c97870d13c65a5a05ebc1

SHA256
4c83eb0c60d41c8cbb75609c445225b2401c7ccb78094abff3d992c0139af28d

SHA512
8da60000d5b123df089690f297837d0f6b1b56517f78f1bea3e039753590aff04c43c86cb28ea410683553b7f8dc4161edf193bb630a85f81fea2be5c6b279d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\8xeM6k5O3T.bat

Filesize
233B

MD5
6996059e97ae34730d4b272c5a5b7890

SHA1
1c130d5e7be85bd0b627186ef2a6a74ea3af748c

SHA256
a4d58e2067554125f9c4d705d07ad07ffd2dd9eec9a0da3ac8aebce6e8f4ba12

SHA512
525b0edb3e15e826cab40d9832ca310066a0c6c03a9cbe3efd0f1caba6d47154d5d354d888cf66240e1807e1e31a682caf3deebb21887fc258a2394349c0bbad

Download Submit
C:\Users\Admin\AppData\Local\Temp\D9KWG0zl28.bat

Filesize
233B

MD5
53ea4105dc6ea8c6b47c6b6710ba21fe

SHA1
68ca16ffa8b54dd65751751bfce906366e7fec85

SHA256
0a365235327a47167a2984df49e2275bfaa097a78741a82397cdffdb29ad5e74

SHA512
59ddb91e316d46154622071b55784af9b2b7242949eb75763efeb4ab412aecf866b6fa26147e8e14e2577000eca50c7e830232534bcb093849d2c16224c1669d

Download Submit
C:\Users\Admin\AppData\Local\Temp\EtrZeLjFvq.bat

Filesize
233B

MD5
6cb5c0a153dd6448cc706af34301a104

SHA1
5dad7060cea3208c617769aed74bd0bfc260fca7

SHA256
8f486073b1140073efbd351f3e72072a6a17782189e5f99229fb024ea638b479

SHA512
b7f0d880a8a25dc85f60ced32c66c14389f392d231d1ee35b9109429cded582b2225d2babfaafe4fbc6957affd37000cc3c274d57495e2cfab5d19024b81905a

Download Submit
C:\Users\Admin\AppData\Local\Temp\XdxpZ3I66P.bat

Filesize
233B

MD5
1b7b4d1441e7483f2b399bbfce58fea2

SHA1
2964da5ca1e0afe8bb9e3366f56d774ded7d072e

SHA256
7a00372c65f88a1e38b8c8b71149e3c68a851f2df957ea405ccd89f85bd8c408

SHA512
4f1e0077d0952ca6a11758b4eb8e44943fd8bfa56e032bf4de1d8de88dac52930f3c21753e2cc5ce2d128feee9c83d1ea82e409a8cbbe77f23cbe3584edd7d44

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_odjp15i5.aql.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\be8zRZs4e0.bat

Filesize
233B

MD5
e0e1bc1576139254143d534e27c290ac

SHA1
f2537dd3a1ccb3fe2ce7ca0ee985e906ed28a739

SHA256
e26e24a483746c4de9ea25878f3827260e455adeb1dc0b01dd6e58d393f14e15

SHA512
5df23179f47f5e43af8d05f75047b0c38e177e35328c7d23f4bc98e3dc55bb2081e1e5f1b750965240875f49cb28e1f9be6f1f8916fd4fefd777ec3d519657e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\fcYyv3mAUp.bat

Filesize
233B

MD5
e613c2d275d9df348f774767bc0205f1

SHA1
e9fc2f8e6182b598dd6eb7b084b1bffd6afcea20

SHA256
f429842add9c71c88300bd1e6f71d639e4a5234f6dc36474eca412fed9cba6ef

SHA512
b0b7beb09675bf1b9b0eb9a45244ffeccebf87a7e8008e3bcd61f39f1d294b445f68d4913bc2b210db1ac6a2d47f0ed17f51db1298eb294b82c08ab7f64a1cfc

Download Submit
C:\Users\Admin\AppData\Local\Temp\hYa1c8p3ob.bat

Filesize
233B

MD5
cbba34b3fed2d186c99c713fa0b732bb

SHA1
4251187b5e483927c2d7455f535d5fbc172722f3

SHA256
cf7a2711783ab56407d8dee9fad3eb5437818848c9af5121afc72512f2b72150

SHA512
73f91d5944f7a866e59690108342a987bef59aab0120db61525e52461361b91e78b415b538dcaa53f3394cb79733395b5f4405adbab075cc9e3a400e2d9f3c79

Download Submit
C:\Users\Admin\AppData\Local\Temp\oLfAgN0jmw.bat

Filesize
233B

MD5
b1f3d22b0e1b4b8262d11975db8cb9ae

SHA1
7f59ee5458a1c384eb2e59ea86384aa73de5c7c7

SHA256
870d1f749f724eb5a13ce52b140d942de40aec12db72b4a2d4623e390403285d

SHA512
c4d3b08c370691213e62e5b8a694c1000f68dcb9dede7ea7cd65219996727fb11bed8fa194d2976bb24bc46b428eab2deefc2df942bb11f179f7cedcd10f9249

Download Submit
C:\Users\Admin\AppData\Local\Temp\sJ59Arupck.bat

Filesize
233B

MD5
0f5f62c13949f43f355cf5e37389c45e

SHA1
3141608f8a1e08ceb7ea0f26390c73c769fbc88c

SHA256
5f1426e08ad1492dba81922d9d9ec8c33b6c81bf4e7626d15aa1c965d1e4cd65

SHA512
ac0ba27ba1cc38a52452bbafee72fae1f7652ecd07900e400a5b08fc5d76528ba4596328c966e1ff659352d0a4ec150f6cb91fbec8864e2382990464d696b0a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\tDjG3X7WPV.bat

Filesize
233B

MD5
e920ae1a31765ccca6c32feefd013567

SHA1
7dd64618458f32e9e5deb03c37f8f6e00295de9e

SHA256
16a93c30a46cc2c91abde0f11eedf8daeda46f0254f36c24c68910e07eed8059

SHA512
88e85f0bcc6367af4e73208c8b1bdd5af87ae5320523ffc13d8af0d754204e901ce53f04f6c0421dbe5a63d2ca46b13e79abd2264bd7f3a18028456ca76aaf2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\wKGJ2NUoAL.bat

Filesize
233B

MD5
d608f1bb2692fd712cf56e0251ef7da3

SHA1
4a15b68c66da65d97119edc2fba9fcb986beca85

SHA256
d8512aae6ae4d262e14c2c75f29cfdc773e049969eb87e135cd1633274c3f588

SHA512
0a2a5faebcda3f531babda1ca57b2d83d30de3706f1a6b21cf5f52b1d42c24420a76a2cb07877ce3887911d167d0272cecca82f396056f722a841f6dc553b4bd

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/1188-60-0x0000012C72550000-0x0000012C72572000-memory.dmp

Filesize
136KB

Download
memory/2964-72-0x0000000000DC0000-0x0000000000DD2000-memory.dmp

Filesize
72KB

Download
memory/3280-14-0x0000000001350000-0x0000000001362000-memory.dmp

Filesize
72KB

Download
memory/3280-12-0x00007FFA5D983000-0x00007FFA5D985000-memory.dmp

Filesize
8KB

Download
memory/3280-13-0x0000000000960000-0x0000000000A70000-memory.dmp

Filesize
1.1MB

Download
memory/3280-15-0x000000001B640000-0x000000001B64C000-memory.dmp

Filesize
48KB

Download
memory/3280-17-0x000000001B650000-0x000000001B65C000-memory.dmp

Filesize
48KB

Download
memory/3280-16-0x0000000001360000-0x000000000136C000-memory.dmp

Filesize
48KB

Download
memory/4268-139-0x0000000002B40000-0x0000000002B52000-memory.dmp

Filesize
72KB

Download
memory/4424-132-0x0000000001300000-0x0000000001312000-memory.dmp

Filesize
72KB

Download