Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22/12/2024, 00:25
Behavioral task
behavioral1
Sample
JaffaCakes118_230aae467f83c1ae425b2fdb0784cd37a30f132b795c392264349259c542dfde.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_230aae467f83c1ae425b2fdb0784cd37a30f132b795c392264349259c542dfde.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_230aae467f83c1ae425b2fdb0784cd37a30f132b795c392264349259c542dfde.exe
-
Size
1.3MB
-
MD5
8c6e53853dc49576ea358ba4f80a9de8
-
SHA1
0a75ca262f3ba2fb18f8917a9eb7f09b3c381fb2
-
SHA256
230aae467f83c1ae425b2fdb0784cd37a30f132b795c392264349259c542dfde
-
SHA512
efbf7eab849266bd571c190bb092a44e4a7b9fbfcb8c47920267de5cd867c6d73461da7328571680933cb1b9107de3f38ee41cdad6e9d4f0916c02142111b054
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Process spawned unexpected child process 15 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4776 1004 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1556 1004 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3308 1004 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 792 1004 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4192 1004 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4000 1004 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2116 1004 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3288 1004 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4632 1004 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 228 1004 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4672 1004 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2424 1004 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2712 1004 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3748 1004 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1896 1004 schtasks.exe 88 -
resource yara_rule behavioral2/files/0x000a000000023b65-9.dat dcrat behavioral2/memory/2176-13-0x00000000002C0000-0x00000000003D0000-memory.dmp dcrat -
Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 4972 powershell.exe 3756 powershell.exe 3544 powershell.exe 1052 powershell.exe 4316 powershell.exe 3896 powershell.exe -
Checks computer location settings 2 TTPs 17 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation TextInputHost.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation DllCommonsvc.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation TextInputHost.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation TextInputHost.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation TextInputHost.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation JaffaCakes118_230aae467f83c1ae425b2fdb0784cd37a30f132b795c392264349259c542dfde.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation TextInputHost.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation TextInputHost.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation TextInputHost.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation TextInputHost.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation TextInputHost.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation TextInputHost.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation TextInputHost.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation TextInputHost.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation TextInputHost.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation TextInputHost.exe -
Executes dropped EXE 16 IoCs
pid Process 2176 DllCommonsvc.exe 836 TextInputHost.exe 5064 TextInputHost.exe 2692 TextInputHost.exe 4348 TextInputHost.exe 1156 TextInputHost.exe 1492 TextInputHost.exe 3876 TextInputHost.exe 2344 TextInputHost.exe 4276 TextInputHost.exe 4368 TextInputHost.exe 4408 TextInputHost.exe 3056 TextInputHost.exe 5064 TextInputHost.exe 784 TextInputHost.exe 2920 TextInputHost.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 15 IoCs
flow ioc 38 raw.githubusercontent.com 41 raw.githubusercontent.com 45 raw.githubusercontent.com 46 raw.githubusercontent.com 57 raw.githubusercontent.com 16 raw.githubusercontent.com 39 raw.githubusercontent.com 47 raw.githubusercontent.com 40 raw.githubusercontent.com 55 raw.githubusercontent.com 56 raw.githubusercontent.com 58 raw.githubusercontent.com 17 raw.githubusercontent.com 24 raw.githubusercontent.com 54 raw.githubusercontent.com -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\StartMenuExperienceHost.exe DllCommonsvc.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\55b276f4edf653 DllCommonsvc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_230aae467f83c1ae425b2fdb0784cd37a30f132b795c392264349259c542dfde.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies registry class 15 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings TextInputHost.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings TextInputHost.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings TextInputHost.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings TextInputHost.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings TextInputHost.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings TextInputHost.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings TextInputHost.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings TextInputHost.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings TextInputHost.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings TextInputHost.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings TextInputHost.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings JaffaCakes118_230aae467f83c1ae425b2fdb0784cd37a30f132b795c392264349259c542dfde.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings TextInputHost.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings TextInputHost.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings TextInputHost.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 15 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4632 schtasks.exe 4776 schtasks.exe 3308 schtasks.exe 228 schtasks.exe 2424 schtasks.exe 3288 schtasks.exe 4672 schtasks.exe 1556 schtasks.exe 4192 schtasks.exe 4000 schtasks.exe 2116 schtasks.exe 792 schtasks.exe 2712 schtasks.exe 3748 schtasks.exe 1896 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 2176 DllCommonsvc.exe 1052 powershell.exe 3544 powershell.exe 3756 powershell.exe 4316 powershell.exe 3896 powershell.exe 3756 powershell.exe 4972 powershell.exe 4972 powershell.exe 3544 powershell.exe 836 TextInputHost.exe 1052 powershell.exe 4316 powershell.exe 3896 powershell.exe 5064 TextInputHost.exe 2692 TextInputHost.exe 4348 TextInputHost.exe 1156 TextInputHost.exe 1492 TextInputHost.exe 3876 TextInputHost.exe 2344 TextInputHost.exe 4276 TextInputHost.exe 4368 TextInputHost.exe 4408 TextInputHost.exe 3056 TextInputHost.exe 5064 TextInputHost.exe 784 TextInputHost.exe 2920 TextInputHost.exe -
Suspicious use of AdjustPrivilegeToken 22 IoCs
description pid Process Token: SeDebugPrivilege 2176 DllCommonsvc.exe Token: SeDebugPrivilege 1052 powershell.exe Token: SeDebugPrivilege 3756 powershell.exe Token: SeDebugPrivilege 3544 powershell.exe Token: SeDebugPrivilege 4316 powershell.exe Token: SeDebugPrivilege 3896 powershell.exe Token: SeDebugPrivilege 836 TextInputHost.exe Token: SeDebugPrivilege 4972 powershell.exe Token: SeDebugPrivilege 5064 TextInputHost.exe Token: SeDebugPrivilege 2692 TextInputHost.exe Token: SeDebugPrivilege 4348 TextInputHost.exe Token: SeDebugPrivilege 1156 TextInputHost.exe Token: SeDebugPrivilege 1492 TextInputHost.exe Token: SeDebugPrivilege 3876 TextInputHost.exe Token: SeDebugPrivilege 2344 TextInputHost.exe Token: SeDebugPrivilege 4276 TextInputHost.exe Token: SeDebugPrivilege 4368 TextInputHost.exe Token: SeDebugPrivilege 4408 TextInputHost.exe Token: SeDebugPrivilege 3056 TextInputHost.exe Token: SeDebugPrivilege 5064 TextInputHost.exe Token: SeDebugPrivilege 784 TextInputHost.exe Token: SeDebugPrivilege 2920 TextInputHost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4496 wrote to memory of 4312 4496 JaffaCakes118_230aae467f83c1ae425b2fdb0784cd37a30f132b795c392264349259c542dfde.exe 83 PID 4496 wrote to memory of 4312 4496 JaffaCakes118_230aae467f83c1ae425b2fdb0784cd37a30f132b795c392264349259c542dfde.exe 83 PID 4496 wrote to memory of 4312 4496 JaffaCakes118_230aae467f83c1ae425b2fdb0784cd37a30f132b795c392264349259c542dfde.exe 83 PID 4312 wrote to memory of 4468 4312 WScript.exe 85 PID 4312 wrote to memory of 4468 4312 WScript.exe 85 PID 4312 wrote to memory of 4468 4312 WScript.exe 85 PID 4468 wrote to memory of 2176 4468 cmd.exe 87 PID 4468 wrote to memory of 2176 4468 cmd.exe 87 PID 2176 wrote to memory of 4972 2176 DllCommonsvc.exe 105 PID 2176 wrote to memory of 4972 2176 DllCommonsvc.exe 105 PID 2176 wrote to memory of 1052 2176 DllCommonsvc.exe 106 PID 2176 wrote to memory of 1052 2176 DllCommonsvc.exe 106 PID 2176 wrote to memory of 3756 2176 DllCommonsvc.exe 107 PID 2176 wrote to memory of 3756 2176 DllCommonsvc.exe 107 PID 2176 wrote to memory of 3544 2176 DllCommonsvc.exe 108 PID 2176 wrote to memory of 3544 2176 DllCommonsvc.exe 108 PID 2176 wrote to memory of 4316 2176 DllCommonsvc.exe 110 PID 2176 wrote to memory of 4316 2176 DllCommonsvc.exe 110 PID 2176 wrote to memory of 3896 2176 DllCommonsvc.exe 111 PID 2176 wrote to memory of 3896 2176 DllCommonsvc.exe 111 PID 2176 wrote to memory of 836 2176 DllCommonsvc.exe 116 PID 2176 wrote to memory of 836 2176 DllCommonsvc.exe 116 PID 836 wrote to memory of 5000 836 TextInputHost.exe 124 PID 836 wrote to memory of 5000 836 TextInputHost.exe 124 PID 5000 wrote to memory of 2660 5000 cmd.exe 126 PID 5000 wrote to memory of 2660 5000 cmd.exe 126 PID 5000 wrote to memory of 5064 5000 cmd.exe 134 PID 5000 wrote to memory of 5064 5000 cmd.exe 134 PID 5064 wrote to memory of 532 5064 TextInputHost.exe 136 PID 5064 wrote to memory of 532 5064 TextInputHost.exe 136 PID 532 wrote to memory of 3532 532 cmd.exe 138 PID 532 wrote to memory of 3532 532 cmd.exe 138 PID 532 wrote to memory of 2692 532 cmd.exe 140 PID 532 wrote to memory of 2692 532 cmd.exe 140 PID 2692 wrote to memory of 4504 2692 TextInputHost.exe 145 PID 2692 wrote to memory of 4504 2692 TextInputHost.exe 145 PID 4504 wrote to memory of 2200 4504 cmd.exe 147 PID 4504 wrote to memory of 2200 4504 cmd.exe 147 PID 4504 wrote to memory of 4348 4504 cmd.exe 149 PID 4504 wrote to memory of 4348 4504 cmd.exe 149 PID 4348 wrote to memory of 408 4348 TextInputHost.exe 151 PID 4348 wrote to memory of 408 4348 TextInputHost.exe 151 PID 408 wrote to memory of 4912 408 cmd.exe 153 PID 408 wrote to memory of 4912 408 cmd.exe 153 PID 408 wrote to memory of 1156 408 cmd.exe 155 PID 408 wrote to memory of 1156 408 cmd.exe 155 PID 1156 wrote to memory of 4408 1156 TextInputHost.exe 157 PID 1156 wrote to memory of 4408 1156 TextInputHost.exe 157 PID 4408 wrote to memory of 3288 4408 cmd.exe 159 PID 4408 wrote to memory of 3288 4408 cmd.exe 159 PID 4408 wrote to memory of 1492 4408 cmd.exe 161 PID 4408 wrote to memory of 1492 4408 cmd.exe 161 PID 1492 wrote to memory of 2916 1492 TextInputHost.exe 163 PID 1492 wrote to memory of 2916 1492 TextInputHost.exe 163 PID 2916 wrote to memory of 4272 2916 cmd.exe 165 PID 2916 wrote to memory of 4272 2916 cmd.exe 165 PID 2916 wrote to memory of 3876 2916 cmd.exe 168 PID 2916 wrote to memory of 3876 2916 cmd.exe 168 PID 3876 wrote to memory of 4108 3876 TextInputHost.exe 170 PID 3876 wrote to memory of 4108 3876 TextInputHost.exe 170 PID 4108 wrote to memory of 2292 4108 cmd.exe 172 PID 4108 wrote to memory of 2292 4108 cmd.exe 172 PID 4108 wrote to memory of 2344 4108 cmd.exe 174 PID 4108 wrote to memory of 2344 4108 cmd.exe 174 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_230aae467f83c1ae425b2fdb0784cd37a30f132b795c392264349259c542dfde.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_230aae467f83c1ae425b2fdb0784cd37a30f132b795c392264349259c542dfde.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\providercommon\DllCommonsvc.exe"C:\providercommon\DllCommonsvc.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4972
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Packages\Microsoft.549981C3F5F10_8wekyb3d8bbwe\dllhost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1052
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\Registry.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3756
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\StartMenuExperienceHost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3544
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Libraries\SearchApp.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4316
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Documents\TextInputHost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3896
-
-
C:\Users\All Users\Documents\TextInputHost.exe"C:\Users\All Users\Documents\TextInputHost.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:836 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\niOj6yjqzp.bat"6⤵
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:27⤵PID:2660
-
-
C:\Users\All Users\Documents\TextInputHost.exe"C:\Users\All Users\Documents\TextInputHost.exe"7⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\W0gPze1DKI.bat"8⤵
- Suspicious use of WriteProcessMemory
PID:532 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:29⤵PID:3532
-
-
C:\Users\All Users\Documents\TextInputHost.exe"C:\Users\All Users\Documents\TextInputHost.exe"9⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\H7eFR6a9mI.bat"10⤵
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:211⤵PID:2200
-
-
C:\Users\All Users\Documents\TextInputHost.exe"C:\Users\All Users\Documents\TextInputHost.exe"11⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\yTtrehocny.bat"12⤵
- Suspicious use of WriteProcessMemory
PID:408 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:213⤵PID:4912
-
-
C:\Users\All Users\Documents\TextInputHost.exe"C:\Users\All Users\Documents\TextInputHost.exe"13⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\wYroxckjTC.bat"14⤵
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:215⤵PID:3288
-
-
C:\Users\All Users\Documents\TextInputHost.exe"C:\Users\All Users\Documents\TextInputHost.exe"15⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\tlxpltA24S.bat"16⤵
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:217⤵PID:4272
-
-
C:\Users\All Users\Documents\TextInputHost.exe"C:\Users\All Users\Documents\TextInputHost.exe"17⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3876 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\H7eFR6a9mI.bat"18⤵
- Suspicious use of WriteProcessMemory
PID:4108 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:219⤵PID:2292
-
-
C:\Users\All Users\Documents\TextInputHost.exe"C:\Users\All Users\Documents\TextInputHost.exe"19⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2344 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\K3fI8Bd254.bat"20⤵PID:2004
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:221⤵PID:4496
-
-
C:\Users\All Users\Documents\TextInputHost.exe"C:\Users\All Users\Documents\TextInputHost.exe"21⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4276 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\4WSxKcEorb.bat"22⤵PID:3912
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:223⤵PID:2656
-
-
C:\Users\All Users\Documents\TextInputHost.exe"C:\Users\All Users\Documents\TextInputHost.exe"23⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4368 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\S2GQUB77UU.bat"24⤵PID:876
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:225⤵PID:2312
-
-
C:\Users\All Users\Documents\TextInputHost.exe"C:\Users\All Users\Documents\TextInputHost.exe"25⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4408 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\AKY6NrPTox.bat"26⤵PID:464
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:227⤵PID:980
-
-
C:\Users\All Users\Documents\TextInputHost.exe"C:\Users\All Users\Documents\TextInputHost.exe"27⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3056 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\W0gPze1DKI.bat"28⤵PID:1916
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:229⤵PID:1988
-
-
C:\Users\All Users\Documents\TextInputHost.exe"C:\Users\All Users\Documents\TextInputHost.exe"29⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5064 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\3fa1oyizme.bat"30⤵PID:4972
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:231⤵PID:116
-
-
C:\Users\All Users\Documents\TextInputHost.exe"C:\Users\All Users\Documents\TextInputHost.exe"31⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:784 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\S2GQUB77UU.bat"32⤵PID:4740
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:233⤵PID:3360
-
-
C:\Users\All Users\Documents\TextInputHost.exe"C:\Users\All Users\Documents\TextInputHost.exe"33⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2920
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\Packages\Microsoft.549981C3F5F10_8wekyb3d8bbwe\dllhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4776
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\All Users\Packages\Microsoft.549981C3F5F10_8wekyb3d8bbwe\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1556
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\Packages\Microsoft.549981C3F5F10_8wekyb3d8bbwe\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3308
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\Registry.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:792
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4192
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4000
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\StartMenuExperienceHost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2116
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\StartMenuExperienceHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3288
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\StartMenuExperienceHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4632
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 9 /tr "'C:\Users\Public\Libraries\SearchApp.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:228
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Users\Public\Libraries\SearchApp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4672
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 13 /tr "'C:\Users\Public\Libraries\SearchApp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2424
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 6 /tr "'C:\Users\All Users\Documents\TextInputHost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2712
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Users\All Users\Documents\TextInputHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3748
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\Documents\TextInputHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1896
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5baf55b95da4a601229647f25dad12878
SHA1abc16954ebfd213733c4493fc1910164d825cac8
SHA256ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
SHA51224f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD5d28a889fd956d5cb3accfbaf1143eb6f
SHA1157ba54b365341f8ff06707d996b3635da8446f7
SHA25621e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45
SHA5120b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c
-
Filesize
944B
MD56d3e9c29fe44e90aae6ed30ccf799ca8
SHA1c7974ef72264bbdf13a2793ccf1aed11bc565dce
SHA2562360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d
SHA51260c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a
-
Filesize
211B
MD5f48ef2f9bec1cc25a355d6fb853e875f
SHA137340a1acf652c0fd1f7ee67c727a117faf64020
SHA2564be32fdc036a864f80eb3af181b2117518e642117b68d946e5e228f74601fc5d
SHA5124bea2275170073f795afef0eff6eca8df84f701ee0c0f27e441981824ab8f5064579dbcce6dd025a67d421bffcbaf92e7ea9d5cf32a3b3ba4daa5b694bac8d2c
-
Filesize
211B
MD5d52ed2df88c7cc5e11c4c43a23cf6c32
SHA1332c6c8e7cb0bbd855e510c57526960295642b39
SHA256247d813a56fec350272203885eb2a0f8bfc2e3e0edffb39efb96fe1b0322e677
SHA512d4471f4b0d53c5d47945202e0024dd200b12e6960ac8cc3014eceb43b57bfe242062bb713630869b07447fdf09b1de576bacc08552da32c83cebfdcdb95c3c48
-
Filesize
211B
MD5f4192e02f0a88b4cce53cb790d948e42
SHA1885b72d0324d06135ae0a3341f7c57c33168c368
SHA25669ce0d869c97b53d8ce575119833ed7b142fb3aeaf672a73084aa58f917b0fd5
SHA51212b06687ffe5c347984f81c1ab470ba53b89ce5e1faa0c96789b1d4dea90d38733e1e758db1ff45ab3f49231335dbba73fcf3a5fcdfff3b4e6816f878f208d9f
-
Filesize
211B
MD59421ca2ed8462ac1f14c34aa34edd305
SHA1e32fbd10afe76572677f1f0d99428350a83c6fec
SHA256a499f9afaee11f694793285b0502cb9cb67cf116993b6c702cf05bc0b21e6dbe
SHA512e940d71913bf348287306dd286ae55d5374411a055f1efde50464af9b08e7a00bbbcf3b6bc649660919387e0aeb1756927c3ceddf2d19ebfb7737314712a4770
-
Filesize
211B
MD504757763ea33c268d9fddd78ad8c3a29
SHA1fc7d07ff7149d2dfb91db5e5e6acc6232b205612
SHA256da339e11c1fa184f9a4ab5bc8ef679a976341c02332d22b2070152b5b812a5a1
SHA512c71d8291df82657fe6d0b5546ac5ce8e4686c60ce21f6f15de6abd0f3c71096510fe0443f0da6c6cb5b5c4840a900988b1ba109a9a07a49dc39324c8f26adaf8
-
Filesize
211B
MD581a38b189da9c7266f9c28e20d1592cc
SHA132276348e28f422431d1a49f4955265d68e31a00
SHA256bc0c1cbd702f8e0f81798be8d5b89b09565af4fa6e61e4614c1601367952c3d5
SHA512865d43661060bb18ee176ae6dee86078504f4a83e4c1606dd409482d4aa195e2e60ffddd3538d929d48f51fce72929b3b41df1cb820d92b02b3d5b32e3103ae3
-
Filesize
211B
MD503442058f07bf778ed72ca910bfd20b1
SHA191367e1c953f664f0e1f1216320aaee42683647b
SHA256b1129f0f2027d4782f7a4ae60799fc0f0762f6905da02c10076553c5928fad96
SHA512772b8fd236c0cc65ebdc8c6a5ec27c9a2b31122356105ac1cae6b33a0469d39cd2f0f9bdea5e8bff127e49f33fab349e501f0be2870c28f35aba4bfb1d767429
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
211B
MD51ab429b9c029192a4331115d9b129b58
SHA130266a7933fd0ee506f73cf2b78792fbff201e0a
SHA25648850420adcab242d61558a9751f7d00485ec28d8cb0af587dbd220bc5039a16
SHA5123acf5bea1023d07fe35b9318933dc2fef48dd5fd18b033c84a43663e60eee0b0cd9745649e467a73eac114b454ceb167185334099d742db299de0bb5e44f2dc4
-
Filesize
211B
MD5488feb50071b7a4170c2b6a516387b3c
SHA1c544154814905bb86ac7fcd7ab9a95f48e25a005
SHA25690f04c79c86df7163963aa526d40bfc495a787a407910b0d29a4ed58569b080e
SHA5125295738e5a71f26fd18b35eca9eae880c9d186d3deaca19f50b020e5fe9af05b82ad5e80a59a00b8d7383351792e6a38d4a90d067da703477765b4af4ae60fe4
-
Filesize
211B
MD540f0fb9d3f3e02ba49cb591d1389ea0f
SHA1d23666739f4e348802a0a6e59045959b66028702
SHA25658b713d51de3dc2b896facf67b48e200e9cc2193ba381a151917535dd87dbb55
SHA51269deb954bdd0ae2838c502f535e327c1cf34181e6110d781fdca94ec7a31c50ba2f81cc6f4076f77e64411778f34b57c319bc94a0a1c34cb3ddbac21cabe0318
-
Filesize
211B
MD553020206bf9641b62cd714b943bf73e3
SHA177e90334768997eb4976b614466fbd58202239be
SHA256de44d1263dba8767b71414160ca3df0f6f7106d5c83a1e9d311012a203088f04
SHA5128ad3eb253c091c1ec7d1e944e41b395f18b6e165166e22f97b3fbd72a429ef7d65d170c4bfea94a54ff4d1456c593ee89f936e0c19c0b210e560d954014eeb14
-
Filesize
36B
MD56783c3ee07c7d151ceac57f1f9c8bed7
SHA117468f98f95bf504cc1f83c49e49a78526b3ea03
SHA2568ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322
SHA512c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8
-
Filesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
Filesize
197B
MD58088241160261560a02c84025d107592
SHA1083121f7027557570994c9fc211df61730455bb5
SHA2562072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1
SHA51220d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478