dcrat | 8067b18f35f1408759ffeebba8de82ebde46d578d15dcc1ac63ad9c5942bfe75

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
22/12/2024, 01:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_8067b18f35f1408759ffeebba8de82ebde46d578d15dcc1ac63ad9c5942bfe75.exe
Size

1.3MB
MD5

e3d73bad0715fdcc4d6fe0130270af0d
SHA1

80158491fbb4561c70d6795da05183edab198ae9
SHA256

8067b18f35f1408759ffeebba8de82ebde46d578d15dcc1ac63ad9c5942bfe75
SHA512

7d3052d82b540281bc013dbc52f082c01f64805f1713b61b37afa4f8a8eae5003eb09460b3feb1d75fbb1d97f8fd96aa2552b010a715aff3d3b4d68511203986
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 39 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2924	2784	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2960	2784	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1256	2784	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2772	2784	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2656	2784	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2724	2784	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2748	2784	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2256	2784	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2376	2784	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2412	2784	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2536	2784	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1776	2784	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	824	2784	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2952	2784	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2268	2784	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1016	2784	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1276	2784	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1716	2784	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	352	2784	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1472	2784	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1880	2784	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1240	2784	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	988	2784	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2180	2784	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2516	2784	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1628	2784	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1012	2784	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2400	2784	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	972	2784	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3052	2784	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2172	2784	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1980	2784	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1920	2784	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1808	2784	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1636	2784	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1304	2784	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2124	2784	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2128	2784	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2096	2784	schtasks.exe	34

DCRat payload 10 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0008000000015d79-10.dat	dcrat
behavioral1/memory/908-13-0x0000000000130000-0x0000000000240000-memory.dmp	dcrat
behavioral1/memory/1172-44-0x00000000013D0000-0x00000000014E0000-memory.dmp	dcrat
behavioral1/memory/2104-88-0x0000000000180000-0x0000000000290000-memory.dmp	dcrat
behavioral1/memory/852-194-0x0000000000C80000-0x0000000000D90000-memory.dmp	dcrat
behavioral1/memory/2248-313-0x00000000003B0000-0x00000000004C0000-memory.dmp	dcrat
behavioral1/memory/2532-373-0x0000000001310000-0x0000000001420000-memory.dmp	dcrat
behavioral1/memory/2088-492-0x00000000000F0000-0x0000000000200000-memory.dmp	dcrat
behavioral1/memory/2516-552-0x0000000000250000-0x0000000000360000-memory.dmp	dcrat
behavioral1/memory/904-612-0x0000000001240000-0x0000000001350000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 15 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2204	powershell.exe
2688	powershell.exe
2940	powershell.exe
2564	powershell.exe
2592	powershell.exe
2660	powershell.exe
2832	powershell.exe
2192	powershell.exe
2712	powershell.exe
2572	powershell.exe
1188	powershell.exe
2164	powershell.exe
2508	powershell.exe
2560	powershell.exe
2912	powershell.exe

Executes dropped EXE 11 IoCs

pid	Process
908	DllCommonsvc.exe
1172	DllCommonsvc.exe
2104	WmiPrvSE.exe
852	WmiPrvSE.exe
2632	WmiPrvSE.exe
2248	WmiPrvSE.exe
2532	WmiPrvSE.exe
768	WmiPrvSE.exe
2088	WmiPrvSE.exe
2516	WmiPrvSE.exe
904	WmiPrvSE.exe

Loads dropped DLL 2 IoCs

pid	Process
2360	cmd.exe
2360	cmd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 10 IoCs

Web Service

T1102

flow	ioc
18	raw.githubusercontent.com
22	raw.githubusercontent.com
25	raw.githubusercontent.com
32	raw.githubusercontent.com
4	raw.githubusercontent.com
5	raw.githubusercontent.com
9	raw.githubusercontent.com
12	raw.githubusercontent.com
15	raw.githubusercontent.com
29	raw.githubusercontent.com

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\dwm.exe	DllCommonsvc.exe
File created	C:\Program Files\Internet Explorer\de-DE\WmiPrvSE.exe	DllCommonsvc.exe
File created	C:\Program Files\DVD Maker\wininit.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Internet Explorer\fr-FR\27d1bcfc3c54e0	DllCommonsvc.exe
File created	C:\Program Files\DVD Maker\56085415360792	DllCommonsvc.exe
File created	C:\Program Files (x86)\Internet Explorer\fr-FR\System.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\cmd.exe	DllCommonsvc.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\cmd.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\ebf1f9fa8afd6d	DllCommonsvc.exe
File opened for modification	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\dwm.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\6cb0b6c459d5d3	DllCommonsvc.exe
File created	C:\Program Files\Internet Explorer\de-DE\24dbde2999530e	DllCommonsvc.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\csrss.exe	DllCommonsvc.exe
File created	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\886983d96e3d3e	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_8067b18f35f1408759ffeebba8de82ebde46d578d15dcc1ac63ad9c5942bfe75.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 39 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2960	schtasks.exe
2748	schtasks.exe
2516	schtasks.exe
1628	schtasks.exe
1808	schtasks.exe
2128	schtasks.exe
2096	schtasks.exe
2772	schtasks.exe
1776	schtasks.exe
2180	schtasks.exe
1012	schtasks.exe
2924	schtasks.exe
2412	schtasks.exe
2952	schtasks.exe
1016	schtasks.exe
1636	schtasks.exe
2268	schtasks.exe
1716	schtasks.exe
1880	schtasks.exe
1240	schtasks.exe
972	schtasks.exe
2172	schtasks.exe
1304	schtasks.exe
2656	schtasks.exe
2256	schtasks.exe
1276	schtasks.exe
1980	schtasks.exe
352	schtasks.exe
1472	schtasks.exe
988	schtasks.exe
2400	schtasks.exe
3052	schtasks.exe
1256	schtasks.exe
2724	schtasks.exe
2536	schtasks.exe
2124	schtasks.exe
2376	schtasks.exe
824	schtasks.exe
1920	schtasks.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
908	DllCommonsvc.exe
2712	powershell.exe
2192	powershell.exe
2204	powershell.exe
1172	DllCommonsvc.exe
2592	powershell.exe
2164	powershell.exe
2560	powershell.exe
1188	powershell.exe
2572	powershell.exe
2660	powershell.exe
2832	powershell.exe
2940	powershell.exe
2688	powershell.exe
2508	powershell.exe
2912	powershell.exe
2564	powershell.exe
2104	WmiPrvSE.exe
852	WmiPrvSE.exe
2632	WmiPrvSE.exe
2248	WmiPrvSE.exe
2532	WmiPrvSE.exe
768	WmiPrvSE.exe
2088	WmiPrvSE.exe
2516	WmiPrvSE.exe
904	WmiPrvSE.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: SeDebugPrivilege	908	DllCommonsvc.exe
Token: SeDebugPrivilege	2712	powershell.exe
Token: SeDebugPrivilege	2192	powershell.exe
Token: SeDebugPrivilege	2204	powershell.exe
Token: SeDebugPrivilege	1172	DllCommonsvc.exe
Token: SeDebugPrivilege	2592	powershell.exe
Token: SeDebugPrivilege	2164	powershell.exe
Token: SeDebugPrivilege	2560	powershell.exe
Token: SeDebugPrivilege	1188	powershell.exe
Token: SeDebugPrivilege	2572	powershell.exe
Token: SeDebugPrivilege	2660	powershell.exe
Token: SeDebugPrivilege	2832	powershell.exe
Token: SeDebugPrivilege	2940	powershell.exe
Token: SeDebugPrivilege	2688	powershell.exe
Token: SeDebugPrivilege	2508	powershell.exe
Token: SeDebugPrivilege	2912	powershell.exe
Token: SeDebugPrivilege	2564	powershell.exe
Token: SeDebugPrivilege	2104	WmiPrvSE.exe
Token: SeDebugPrivilege	852	WmiPrvSE.exe
Token: SeDebugPrivilege	2632	WmiPrvSE.exe
Token: SeDebugPrivilege	2248	WmiPrvSE.exe
Token: SeDebugPrivilege	2532	WmiPrvSE.exe
Token: SeDebugPrivilege	768	WmiPrvSE.exe
Token: SeDebugPrivilege	2088	WmiPrvSE.exe
Token: SeDebugPrivilege	2516	WmiPrvSE.exe
Token: SeDebugPrivilege	904	WmiPrvSE.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 2592	1968	JaffaCakes118_8067b18f35f1408759ffeebba8de82ebde46d578d15dcc1ac63ad9c5942bfe75.exe	30
PID 1968 wrote to memory of 2592	1968	JaffaCakes118_8067b18f35f1408759ffeebba8de82ebde46d578d15dcc1ac63ad9c5942bfe75.exe	30
PID 1968 wrote to memory of 2592	1968	JaffaCakes118_8067b18f35f1408759ffeebba8de82ebde46d578d15dcc1ac63ad9c5942bfe75.exe	30
PID 1968 wrote to memory of 2592	1968	JaffaCakes118_8067b18f35f1408759ffeebba8de82ebde46d578d15dcc1ac63ad9c5942bfe75.exe	30
PID 2592 wrote to memory of 2360	2592	WScript.exe	31
PID 2592 wrote to memory of 2360	2592	WScript.exe	31
PID 2592 wrote to memory of 2360	2592	WScript.exe	31
PID 2592 wrote to memory of 2360	2592	WScript.exe	31
PID 2360 wrote to memory of 908	2360	cmd.exe	33
PID 2360 wrote to memory of 908	2360	cmd.exe	33
PID 2360 wrote to memory of 908	2360	cmd.exe	33
PID 2360 wrote to memory of 908	2360	cmd.exe	33
PID 908 wrote to memory of 2192	908	DllCommonsvc.exe	41
PID 908 wrote to memory of 2192	908	DllCommonsvc.exe	41
PID 908 wrote to memory of 2192	908	DllCommonsvc.exe	41
PID 908 wrote to memory of 2204	908	DllCommonsvc.exe	42
PID 908 wrote to memory of 2204	908	DllCommonsvc.exe	42
PID 908 wrote to memory of 2204	908	DllCommonsvc.exe	42
PID 908 wrote to memory of 2712	908	DllCommonsvc.exe	43
PID 908 wrote to memory of 2712	908	DllCommonsvc.exe	43
PID 908 wrote to memory of 2712	908	DllCommonsvc.exe	43
PID 908 wrote to memory of 1844	908	DllCommonsvc.exe	47
PID 908 wrote to memory of 1844	908	DllCommonsvc.exe	47
PID 908 wrote to memory of 1844	908	DllCommonsvc.exe	47
PID 1844 wrote to memory of 1212	1844	cmd.exe	49
PID 1844 wrote to memory of 1212	1844	cmd.exe	49
PID 1844 wrote to memory of 1212	1844	cmd.exe	49
PID 1844 wrote to memory of 1172	1844	cmd.exe	50
PID 1844 wrote to memory of 1172	1844	cmd.exe	50
PID 1844 wrote to memory of 1172	1844	cmd.exe	50
PID 1172 wrote to memory of 2564	1172	DllCommonsvc.exe	84
PID 1172 wrote to memory of 2564	1172	DllCommonsvc.exe	84
PID 1172 wrote to memory of 2564	1172	DllCommonsvc.exe	84
PID 1172 wrote to memory of 2560	1172	DllCommonsvc.exe	85
PID 1172 wrote to memory of 2560	1172	DllCommonsvc.exe	85
PID 1172 wrote to memory of 2560	1172	DllCommonsvc.exe	85
PID 1172 wrote to memory of 1188	1172	DllCommonsvc.exe	86
PID 1172 wrote to memory of 1188	1172	DllCommonsvc.exe	86
PID 1172 wrote to memory of 1188	1172	DllCommonsvc.exe	86
PID 1172 wrote to memory of 2592	1172	DllCommonsvc.exe	87
PID 1172 wrote to memory of 2592	1172	DllCommonsvc.exe	87
PID 1172 wrote to memory of 2592	1172	DllCommonsvc.exe	87
PID 1172 wrote to memory of 2572	1172	DllCommonsvc.exe	88
PID 1172 wrote to memory of 2572	1172	DllCommonsvc.exe	88
PID 1172 wrote to memory of 2572	1172	DllCommonsvc.exe	88
PID 1172 wrote to memory of 2164	1172	DllCommonsvc.exe	89
PID 1172 wrote to memory of 2164	1172	DllCommonsvc.exe	89
PID 1172 wrote to memory of 2164	1172	DllCommonsvc.exe	89
PID 1172 wrote to memory of 2508	1172	DllCommonsvc.exe	90
PID 1172 wrote to memory of 2508	1172	DllCommonsvc.exe	90
PID 1172 wrote to memory of 2508	1172	DllCommonsvc.exe	90
PID 1172 wrote to memory of 2912	1172	DllCommonsvc.exe	93
PID 1172 wrote to memory of 2912	1172	DllCommonsvc.exe	93
PID 1172 wrote to memory of 2912	1172	DllCommonsvc.exe	93
PID 1172 wrote to memory of 2940	1172	DllCommonsvc.exe	94
PID 1172 wrote to memory of 2940	1172	DllCommonsvc.exe	94
PID 1172 wrote to memory of 2940	1172	DllCommonsvc.exe	94
PID 1172 wrote to memory of 2688	1172	DllCommonsvc.exe	96
PID 1172 wrote to memory of 2688	1172	DllCommonsvc.exe	96
PID 1172 wrote to memory of 2688	1172	DllCommonsvc.exe	96
PID 1172 wrote to memory of 2832	1172	DllCommonsvc.exe	97
PID 1172 wrote to memory of 2832	1172	DllCommonsvc.exe	97
PID 1172 wrote to memory of 2832	1172	DllCommonsvc.exe	97
PID 1172 wrote to memory of 2660	1172	DllCommonsvc.exe	98

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8067b18f35f1408759ffeebba8de82ebde46d578d15dcc1ac63ad9c5942bfe75.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8067b18f35f1408759ffeebba8de82ebde46d578d15dcc1ac63ad9c5942bfe75.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2592
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2360
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:908
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2192
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft Visual Studio 8\cmd.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2204
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2712
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\tdnSJsnH3X.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1844
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:1212
      - C:\providercommon\DllCommonsvc.exe
        
        "C:\providercommon\DllCommonsvc.exe"
        6⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1172
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2564
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\dwm.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2560
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\WmiPrvSE.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1188
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Desktop\Idle.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2592
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\audiodg.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2572
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Desktop\csrss.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2164
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\audiodg.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2508
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Internet Explorer\de-DE\WmiPrvSE.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2912
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\lsass.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2940
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\DVD Maker\wininit.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2688
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\lsm.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2832
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Internet Explorer\fr-FR\System.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2660
        
        C:\Users\Public\WmiPrvSE.exe
        
        "C:\Users\Public\WmiPrvSE.exe"
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2104
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ATZuYpZxcK.bat"
        8⤵
        
        PID:1804
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:2452
        
        C:\Users\Public\WmiPrvSE.exe
        
        "C:\Users\Public\WmiPrvSE.exe"
        9⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:852
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\t3iRsZx2b7.bat"
        10⤵
        
        PID:2284
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:1520
        
        C:\Users\Public\WmiPrvSE.exe
        
        "C:\Users\Public\WmiPrvSE.exe"
        11⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2632
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\3Bw8qtkvcA.bat"
        12⤵
        
        PID:1852
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:2508
        
        C:\Users\Public\WmiPrvSE.exe
        
        "C:\Users\Public\WmiPrvSE.exe"
        13⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2248
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\eTpA0L9dlX.bat"
        14⤵
        
        PID:484
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        15⤵
        
        PID:2556
        
        C:\Users\Public\WmiPrvSE.exe
        
        "C:\Users\Public\WmiPrvSE.exe"
        15⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2532
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\nDq7RH5Uwz.bat"
        16⤵
        
        PID:1496
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        17⤵
        
        PID:2992
        
        C:\Users\Public\WmiPrvSE.exe
        
        "C:\Users\Public\WmiPrvSE.exe"
        17⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:768
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Z87Ce65nyU.bat"
        18⤵
        
        PID:2760
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        19⤵
        
        PID:2632
        
        C:\Users\Public\WmiPrvSE.exe
        
        "C:\Users\Public\WmiPrvSE.exe"
        19⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2088
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\00pP7nIBMq.bat"
        20⤵
        
        PID:2884
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        21⤵
        
        PID:2140
        
        C:\Users\Public\WmiPrvSE.exe
        
        "C:\Users\Public\WmiPrvSE.exe"
        21⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2516
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\UMOyPGkKXB.bat"
        22⤵
        
        PID:880
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        23⤵
        
        PID:2016
        
        C:\Users\Public\WmiPrvSE.exe
        
        "C:\Users\Public\WmiPrvSE.exe"
        23⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:904
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\2Odt5WJZ2f.bat"
        24⤵
        
        PID:2420
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        25⤵
        
        PID:2900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1256

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2256

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 10 /tr "'C:\Users\Public\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Users\Public\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 6 /tr "'C:\Users\Public\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\Desktop\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Users\Admin\Desktop\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\Desktop\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\MSOCache\All Users\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1276

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Users\Public\Desktop\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Public\Desktop\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Users\Public\Desktop\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 13 /tr "'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1240

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 11 /tr "'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2180

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 8 /tr "'C:\Program Files\Internet Explorer\de-DE\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\de-DE\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 8 /tr "'C:\Program Files\Internet Explorer\de-DE\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\providercommon\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\providercommon\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\providercommon\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\Program Files\DVD Maker\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2172

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files\DVD Maker\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 8 /tr "'C:\Program Files\DVD Maker\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 8 /tr "'C:\providercommon\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\providercommon\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 5 /tr "'C:\providercommon\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Internet Explorer\fr-FR\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2124

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\fr-FR\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2128

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Internet Explorer\fr-FR\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
701657adeedb56fbdec809e00c7f7622

SHA1
703031746aaff7a3f398a2570e963c6c38a5e192

SHA256
9c31a347e8603643277ada7a91fae9b2dd13e5de5ed79db087c6ba3b20b5c73e

SHA512
b35513609530f8361d12ea995dc14e2c0d4a3aa88bfc83bad9f4f906b34875636353105edd1a00e073cc86d9ac94d5f6b287b39b88267153952ec48e2e2179b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f4a158469a4a84c616cc4cb57e8f2bc1

SHA1
3fc0ff71376efd6eb30856d740ea338f8c2dca03

SHA256
f64b9e235d2bf40f3da3d1493183b3b86882de6e39800115f08dc1bb1037f9f2

SHA512
cc334d3858a4b19b0d61d47d4c3fc54f1716bc5fe3106c81497e8da11af83c0eab727bd89f9bf179d529d33d3978c7b05cc6a5b685a56b04b512eb579bdaaa26

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
649de573a7f5304f3478b1bab86e89a5

SHA1
19ee9f96b1db2e09bf30bf781750cf6db6b6fe11

SHA256
bf0b55f5d633bece1e5b196d982ce12d49416453e461151a6779365967760375

SHA512
933f90b8f0100ef5520cff1129f8770626f70ddf4fa2d6c28c45e770b4bb9a40ca818cf79658fa934100f90d55ea73c56867026bdc386a49bafe99f01dcadca0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1c1241f12141be6e50b5f9de820fb689

SHA1
a25e2eb7066c8b1d67578c60ffc6a943f3033a43

SHA256
71622574c3d641d6ce2fb9b2f14eda872dc401616c095871b6609f92a4d8e725

SHA512
f310d8d478be052ad59c8c34af7a8096680eabba48332cae6421db462185d04036a11478e0153f80b95f0f66bec5ec6c74cd66aaef9e9584ec438c2cc2756200

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
113cb9bb0567a24434af04017905e32c

SHA1
4c2adc583953188b49703db78d84168b67f3041b

SHA256
fda1a07dbd6569ac542eedeef95c5f49f213485190879d3d795adbc6a381abb7

SHA512
4fee05eef89764cc21615c84630c1d7e3bf592c04041840dc53ebb1e98e4f5afbaca9b684828bda96a342a9e0fea518cc36b1952fda509858ba0bedf021348e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d8849833ef185519faa258add2556e2f

SHA1
2335405ea5d0e8eb9cae22e7dfeb8bd87242979e

SHA256
827abdb6d43e10fbe67fed6add70554ca6ff73405238472839226668e47b7e43

SHA512
88b2f2784c1b61655d36ed3d94904f0b50e7f47a888a374962f13f3edc9a6e3a94dbec0976367d2ad011cd32bb5cecc94ce1feafe20dfabf6c0c1f0588490b0a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3bfb2ba2b0656ccdc927f009de9f4508

SHA1
e9f90687cab0870bcb6772a78cc1b5165d6b06ae

SHA256
a15755936f03d2a5a192edc0d5677214d802648af6ac6b8effce1c4a0e276c6c

SHA512
5b5397eb31cda9f2b294497150857339f2c47ca161689a241519454591172cf8f728d67c6db115dc74c8e1137f618237b623aa9d3d2cdc292ce99a30d9701dde

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fd5f14c48e991ac09fc1e65bbc247b7c

SHA1
2a69be163db8fbfa9b50fbf6cabf56b4022794df

SHA256
66bd4925b38c7b268506a27f8ad283d5a221addec36cccd8f5f73a833e1d0908

SHA512
5ce74e2841e5e50b65708d9c128fa443324d087c40018f5a9a6ce8cf3967833dd2425b0e1df281cbdb0d8c636cb36a80d3a61d267896f6d3ecc8b22bb10a2d26

Download Submit
C:\Users\Admin\AppData\Local\Temp\00pP7nIBMq.bat

Filesize
193B

MD5
c04332ffab479334dbeee4cf09fb54ab

SHA1
3ffcd2c6f97ac01eb3a2b0fa4896dbf2f2b03d29

SHA256
24a76d595d2500cbcc3d452435629c264b2f388fd27cd30ed9fcd291228f19b8

SHA512
868d1224e8056327a72f58b9cd2eea3ab0959fba101f0732514c8127a346d4b1b80f85a0b767fae813ff5c46176dd12ab69f09199468d9edc9f47406f6850b9e

Download Submit
C:\Users\Admin\AppData\Local\Temp\2Odt5WJZ2f.bat

Filesize
193B

MD5
6f8895dcf79ec915a70eca45fcdfb3e1

SHA1
2e4a50c0144cd5d80309e35c54f4bfa799879269

SHA256
2d76bfc3b106a6c6e8c01a91fa778496d17280d2d3543938330484010e9fde71

SHA512
f58505656dc937e6e0a4e20acc3245295375345f7b70e691c346b2dd0fabc63b9f9bdd0acbc3055149cf96e9325f6a9243c679d1deefb364e40c40d1e74afdda

Download Submit
C:\Users\Admin\AppData\Local\Temp\3Bw8qtkvcA.bat

Filesize
193B

MD5
4021955fe45705ed44e8e4e0112321bc

SHA1
bd646a73ae8464fa9bf96336d06e78a7d7310638

SHA256
0b31e3a66cd742276c4f9705390b8248661e08bc36e58b1f52e62291cd7206b1

SHA512
a04b623e81be79a00fce5e9c1ff1a048514b21458a04315a5c763296d53c18bf83057aaa21547972ad599f44ac740cb7721fd2b09b19b43e718c3aef8995e817

Download Submit
C:\Users\Admin\AppData\Local\Temp\ATZuYpZxcK.bat

Filesize
193B

MD5
b82d2d817d9712740e412676dafcb65c

SHA1
d7aaea328e97183e8ca860705f3d000fdc18559c

SHA256
ef8a2dac0a8edf39462c29f62e75e2e81c923c2633f9fb0fe9fe132ca3c2ae6d

SHA512
b8f77a79f4170c3f614bbb632b8a7ca19b7b0dadd1c75ed3bad634c2cfd2277a8ab8e92741c42d05727a4480de4bb737633ae30106adda1fbb54308f52ab8623

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF52A.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF54C.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\UMOyPGkKXB.bat

Filesize
193B

MD5
be9fc640d0c27ae5739574ed79d31ac7

SHA1
37d475f557353b82b0e48eceac3bf2e001cde0f4

SHA256
1dbaaebad7b698b4b63e5ef399db2f83abd49ab03d045328cb77a82faff06bba

SHA512
477686e2d2087ba4f7d8d0a45136a10c1253902f4f1678aeae785595f7527fbd7bca13d306b25c448d1055b131ea3ae7e3df9ac167863f403cb57d2356652a61

Download Submit
C:\Users\Admin\AppData\Local\Temp\Z87Ce65nyU.bat

Filesize
193B

MD5
4eb279faefd60893ed27bf8f0657785a

SHA1
399e3cb21295155c18758d601d7f4d49b92c9916

SHA256
20ceffc9bfdecd99c33a4810ff4341e0193d124266adeec5defb6abcc71ef904

SHA512
38f10e02e2c192a079dba2bcea578b98347d53e7d646979ca8c95dc5f3d44eacf60232b83c372e5f71da56f4ab68361eaad6f4cea92bd9bc0f2c9bee6a500069

Download Submit
C:\Users\Admin\AppData\Local\Temp\eTpA0L9dlX.bat

Filesize
193B

MD5
0e6e0625945703efcf049b66b210ddb6

SHA1
5752e959dcfd129c9d824160f092d32c0ade7c9d

SHA256
3416d69a4d1e1300b5766ea4aa601c5fcf82bcd76aa0ef18832497abf7b12621

SHA512
a0ce61ab8487fe9114b0a789d4027adb0a45440b61a8616472315b43b7c9305c535c786d3c716a1329d817ddbc706c2557d9f86a644c11ee18c2abe62cd87db6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nDq7RH5Uwz.bat

Filesize
193B

MD5
d74136b1474fc02b1cef9f6d04943fb6

SHA1
0475b2e8964d97874f5d8858ecda40f4ecf43cee

SHA256
7b3e301f822721e1432b93f0740c7a7331e928ba8956d4e078a6bc25082900d9

SHA512
32b3d22a86947b6212a44666d84f43eea72b0e58d35c2ec8cd0ee5403ee0590903cd61c28d22ff532e9874f28c7b2066bb1de4d147d8adbd74fc8dd4e7211dcb

Download Submit
C:\Users\Admin\AppData\Local\Temp\t3iRsZx2b7.bat

Filesize
193B

MD5
b7c62f25008f3ff9f23926ed9fa239e6

SHA1
75adb81c544916456ad3029bc2e77bc9b8bfdac5

SHA256
cc37c18d61e117691b62fa65178b3e3afc6d146ee7d59043b6a94c5527ab3d1d

SHA512
abfe8a50c7fae3128db15fda5554cea257a4ef0abf846ab3d342acc7db077f495f08759b4226eef90aa90047d504a4c38a4a0b3c1d180a8ffd9de4c6133933cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\tdnSJsnH3X.bat

Filesize
199B

MD5
e67e2fdd9fcb32b043c088ff05b89e91

SHA1
3827a7bc48d4eab88316e656a9a20eb8e82bb13f

SHA256
8425c8d3f347a9f464197c2c98d48dea4b90188dc9a4259c335230aba17205f0

SHA512
a568071e0c6123877f8b6ef7dcaa2412169a1a14b1c9198836a7b9785ba3ff068f2917cf2bfbd7354704ac848dfdb20d9ae941e077c32bd05811a2e5815e98a7

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\XRBLEKX0WJKLEQI6PH3I.temp

Filesize
7KB

MD5
92cf0346d5d0ae42ed6bc2a152e7615f

SHA1
ace4da3f109b33839eaa1368e9cd97a4bf95be13

SHA256
9dc4921345e4f3d5ffc79b2e671272c9248746c9503c5e1a54d2d9319e3be3d5

SHA512
0064f74dc712a2f2d1e360878417a0adc8531f818722d27d667772c1ad403ee34f02f8c59b541a5e7fa4728a6f9e624d0d278daef2ae3008ea2c1aa37348acea

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/852-194-0x0000000000C80000-0x0000000000D90000-memory.dmp

Filesize
1.1MB

Download
memory/904-612-0x0000000001240000-0x0000000001350000-memory.dmp

Filesize
1.1MB

Download
memory/908-14-0x0000000000260000-0x0000000000272000-memory.dmp

Filesize
72KB

Download
memory/908-15-0x0000000000280000-0x000000000028C000-memory.dmp

Filesize
48KB

Download
memory/908-17-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/908-13-0x0000000000130000-0x0000000000240000-memory.dmp

Filesize
1.1MB

Download
memory/908-16-0x0000000000270000-0x000000000027C000-memory.dmp

Filesize
48KB

Download
memory/1172-44-0x00000000013D0000-0x00000000014E0000-memory.dmp

Filesize
1.1MB

Download
memory/2088-492-0x00000000000F0000-0x0000000000200000-memory.dmp

Filesize
1.1MB

Download
memory/2104-88-0x0000000000180000-0x0000000000290000-memory.dmp

Filesize
1.1MB

Download
memory/2164-89-0x000000001B690000-0x000000001B972000-memory.dmp

Filesize
2.9MB

Download
memory/2248-313-0x00000000003B0000-0x00000000004C0000-memory.dmp

Filesize
1.1MB

Download
memory/2516-552-0x0000000000250000-0x0000000000360000-memory.dmp

Filesize
1.1MB

Download
memory/2532-373-0x0000000001310000-0x0000000001420000-memory.dmp

Filesize
1.1MB

Download
memory/2592-95-0x0000000001F30000-0x0000000001F38000-memory.dmp

Filesize
32KB

Download
memory/2712-42-0x0000000001E80000-0x0000000001E88000-memory.dmp

Filesize
32KB

Download
memory/2712-41-0x000000001B790000-0x000000001BA72000-memory.dmp

Filesize
2.9MB

Download