dcrat | 63f95f6ff73ce356dc7d20943f3a6ec8c2b7d6021235478648822558cee8577c

Analysis

max time kernel
150s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2024 00:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_63f95f6ff73ce356dc7d20943f3a6ec8c2b7d6021235478648822558cee8577c.exe
Size

1.3MB
MD5

2dfd7b96c6c19970a53dee83725e9e39
SHA1

c4a2837f05a464013514da1b9100a75613f1038a
SHA256

63f95f6ff73ce356dc7d20943f3a6ec8c2b7d6021235478648822558cee8577c
SHA512

7af353cc074d4daac7143d7efa543f6506185ca0a87d5a76de92483f47f85dc11f8d8004e3ef6b57ae1be2bc40cc517260c88c2db956bb55d1ac2b9bc17473d3
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 6 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3584	4524	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2156	4524	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2652	4524	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4848	4524	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	656	4524	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1180	4524	schtasks.exe	88

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x0007000000023c95-9.dat	dcrat
behavioral2/memory/3852-13-0x0000000000880000-0x0000000000990000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1132	powershell.exe
5108	powershell.exe
4564	powershell.exe

Checks computer location settings 2 TTPs 15 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	TextInputHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	TextInputHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	TextInputHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	TextInputHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	JaffaCakes118_63f95f6ff73ce356dc7d20943f3a6ec8c2b7d6021235478648822558cee8577c.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	TextInputHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	TextInputHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	TextInputHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	TextInputHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	TextInputHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	TextInputHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	TextInputHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	TextInputHost.exe

Executes dropped EXE 14 IoCs

pid	Process
3852	DllCommonsvc.exe
1944	TextInputHost.exe
1908	TextInputHost.exe
5008	TextInputHost.exe
4284	TextInputHost.exe
3108	TextInputHost.exe
3956	TextInputHost.exe
1172	TextInputHost.exe
2208	TextInputHost.exe
4172	TextInputHost.exe
684	TextInputHost.exe
2476	TextInputHost.exe
460	TextInputHost.exe
4596	TextInputHost.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 13 IoCs

Web Service

T1102

flow	ioc
42	raw.githubusercontent.com
43	raw.githubusercontent.com
51	raw.githubusercontent.com
52	raw.githubusercontent.com
54	raw.githubusercontent.com
55	raw.githubusercontent.com
24	raw.githubusercontent.com
38	raw.githubusercontent.com
39	raw.githubusercontent.com
44	raw.githubusercontent.com
53	raw.githubusercontent.com
16	raw.githubusercontent.com
17	raw.githubusercontent.com

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Multimedia Platform\TextInputHost.exe	DllCommonsvc.exe
File opened for modification	C:\Program Files\Windows Multimedia Platform\TextInputHost.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Multimedia Platform\22eafd247d37c3	DllCommonsvc.exe
File created	C:\Program Files\7-Zip\Lang\upfc.exe	DllCommonsvc.exe
File created	C:\Program Files\7-Zip\Lang\ea1d8f6d871115	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_63f95f6ff73ce356dc7d20943f3a6ec8c2b7d6021235478648822558cee8577c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 13 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	JaffaCakes118_63f95f6ff73ce356dc7d20943f3a6ec8c2b7d6021235478648822558cee8577c.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	TextInputHost.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2156	schtasks.exe
2652	schtasks.exe
4848	schtasks.exe
656	schtasks.exe
1180	schtasks.exe
3584	schtasks.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
3852	DllCommonsvc.exe
5108	powershell.exe
4564	powershell.exe
1132	powershell.exe
4564	powershell.exe
5108	powershell.exe
1132	powershell.exe
1944	TextInputHost.exe
1908	TextInputHost.exe
5008	TextInputHost.exe
4284	TextInputHost.exe
3108	TextInputHost.exe
3956	TextInputHost.exe
1172	TextInputHost.exe
2208	TextInputHost.exe
4172	TextInputHost.exe
684	TextInputHost.exe
2476	TextInputHost.exe
460	TextInputHost.exe
4596	TextInputHost.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeDebugPrivilege	3852	DllCommonsvc.exe
Token: SeDebugPrivilege	5108	powershell.exe
Token: SeDebugPrivilege	4564	powershell.exe
Token: SeDebugPrivilege	1132	powershell.exe
Token: SeDebugPrivilege	1944	TextInputHost.exe
Token: SeDebugPrivilege	1908	TextInputHost.exe
Token: SeDebugPrivilege	5008	TextInputHost.exe
Token: SeDebugPrivilege	4284	TextInputHost.exe
Token: SeDebugPrivilege	3108	TextInputHost.exe
Token: SeDebugPrivilege	3956	TextInputHost.exe
Token: SeDebugPrivilege	1172	TextInputHost.exe
Token: SeDebugPrivilege	2208	TextInputHost.exe
Token: SeDebugPrivilege	4172	TextInputHost.exe
Token: SeDebugPrivilege	684	TextInputHost.exe
Token: SeDebugPrivilege	2476	TextInputHost.exe
Token: SeDebugPrivilege	460	TextInputHost.exe
Token: SeDebugPrivilege	4596	TextInputHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1080 wrote to memory of 3668	1080	JaffaCakes118_63f95f6ff73ce356dc7d20943f3a6ec8c2b7d6021235478648822558cee8577c.exe	83
PID 1080 wrote to memory of 3668	1080	JaffaCakes118_63f95f6ff73ce356dc7d20943f3a6ec8c2b7d6021235478648822558cee8577c.exe	83
PID 1080 wrote to memory of 3668	1080	JaffaCakes118_63f95f6ff73ce356dc7d20943f3a6ec8c2b7d6021235478648822558cee8577c.exe	83
PID 3668 wrote to memory of 1200	3668	WScript.exe	85
PID 3668 wrote to memory of 1200	3668	WScript.exe	85
PID 3668 wrote to memory of 1200	3668	WScript.exe	85
PID 1200 wrote to memory of 3852	1200	cmd.exe	87
PID 1200 wrote to memory of 3852	1200	cmd.exe	87
PID 3852 wrote to memory of 1132	3852	DllCommonsvc.exe	96
PID 3852 wrote to memory of 1132	3852	DllCommonsvc.exe	96
PID 3852 wrote to memory of 5108	3852	DllCommonsvc.exe	97
PID 3852 wrote to memory of 5108	3852	DllCommonsvc.exe	97
PID 3852 wrote to memory of 4564	3852	DllCommonsvc.exe	98
PID 3852 wrote to memory of 4564	3852	DllCommonsvc.exe	98
PID 3852 wrote to memory of 1944	3852	DllCommonsvc.exe	102
PID 3852 wrote to memory of 1944	3852	DllCommonsvc.exe	102
PID 1944 wrote to memory of 2004	1944	TextInputHost.exe	111
PID 1944 wrote to memory of 2004	1944	TextInputHost.exe	111
PID 2004 wrote to memory of 2576	2004	cmd.exe	113
PID 2004 wrote to memory of 2576	2004	cmd.exe	113
PID 2004 wrote to memory of 1908	2004	cmd.exe	119
PID 2004 wrote to memory of 1908	2004	cmd.exe	119
PID 1908 wrote to memory of 2652	1908	TextInputHost.exe	121
PID 1908 wrote to memory of 2652	1908	TextInputHost.exe	121
PID 2652 wrote to memory of 3040	2652	cmd.exe	123
PID 2652 wrote to memory of 3040	2652	cmd.exe	123
PID 2652 wrote to memory of 5008	2652	cmd.exe	127
PID 2652 wrote to memory of 5008	2652	cmd.exe	127
PID 5008 wrote to memory of 2288	5008	TextInputHost.exe	130
PID 5008 wrote to memory of 2288	5008	TextInputHost.exe	130
PID 2288 wrote to memory of 4380	2288	cmd.exe	132
PID 2288 wrote to memory of 4380	2288	cmd.exe	132
PID 2288 wrote to memory of 4284	2288	cmd.exe	134
PID 2288 wrote to memory of 4284	2288	cmd.exe	134
PID 4284 wrote to memory of 960	4284	TextInputHost.exe	136
PID 4284 wrote to memory of 960	4284	TextInputHost.exe	136
PID 960 wrote to memory of 4840	960	cmd.exe	138
PID 960 wrote to memory of 4840	960	cmd.exe	138
PID 960 wrote to memory of 3108	960	cmd.exe	140
PID 960 wrote to memory of 3108	960	cmd.exe	140
PID 3108 wrote to memory of 1640	3108	TextInputHost.exe	142
PID 3108 wrote to memory of 1640	3108	TextInputHost.exe	142
PID 1640 wrote to memory of 2476	1640	cmd.exe	144
PID 1640 wrote to memory of 2476	1640	cmd.exe	144
PID 1640 wrote to memory of 3956	1640	cmd.exe	146
PID 1640 wrote to memory of 3956	1640	cmd.exe	146
PID 3956 wrote to memory of 3668	3956	TextInputHost.exe	148
PID 3956 wrote to memory of 3668	3956	TextInputHost.exe	148
PID 3668 wrote to memory of 1648	3668	cmd.exe	150
PID 3668 wrote to memory of 1648	3668	cmd.exe	150
PID 3668 wrote to memory of 1172	3668	cmd.exe	152
PID 3668 wrote to memory of 1172	3668	cmd.exe	152
PID 1172 wrote to memory of 3040	1172	TextInputHost.exe	154
PID 1172 wrote to memory of 3040	1172	TextInputHost.exe	154
PID 3040 wrote to memory of 3340	3040	cmd.exe	156
PID 3040 wrote to memory of 3340	3040	cmd.exe	156
PID 3040 wrote to memory of 2208	3040	cmd.exe	158
PID 3040 wrote to memory of 2208	3040	cmd.exe	158
PID 2208 wrote to memory of 3860	2208	TextInputHost.exe	160
PID 2208 wrote to memory of 3860	2208	TextInputHost.exe	160
PID 3860 wrote to memory of 4184	3860	cmd.exe	162
PID 3860 wrote to memory of 4184	3860	cmd.exe	162
PID 3860 wrote to memory of 4172	3860	cmd.exe	164
PID 3860 wrote to memory of 4172	3860	cmd.exe	164

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_63f95f6ff73ce356dc7d20943f3a6ec8c2b7d6021235478648822558cee8577c.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_63f95f6ff73ce356dc7d20943f3a6ec8c2b7d6021235478648822558cee8577c.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1080
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3668
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1200
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3852
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1132
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Multimedia Platform\TextInputHost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5108
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\7-Zip\Lang\upfc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4564
    - - C:\Program Files\Windows Multimedia Platform\TextInputHost.exe
        
        "C:\Program Files\Windows Multimedia Platform\TextInputHost.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1944
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\PeSwWR6joe.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2004
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:2576
        
        C:\Program Files\Windows Multimedia Platform\TextInputHost.exe
        
        "C:\Program Files\Windows Multimedia Platform\TextInputHost.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1908
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\syYKg8QxNI.bat"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:2652
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:3040
        
        C:\Program Files\Windows Multimedia Platform\TextInputHost.exe
        
        "C:\Program Files\Windows Multimedia Platform\TextInputHost.exe"
        9⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5008
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\UMOyPGkKXB.bat"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:2288
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:4380
        
        C:\Program Files\Windows Multimedia Platform\TextInputHost.exe
        
        "C:\Program Files\Windows Multimedia Platform\TextInputHost.exe"
        11⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4284
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\NiQtqM3qVs.bat"
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:960
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:4840
        
        C:\Program Files\Windows Multimedia Platform\TextInputHost.exe
        
        "C:\Program Files\Windows Multimedia Platform\TextInputHost.exe"
        13⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3108
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\5pDZQI1oOH.bat"
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:1640
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        15⤵
        
        PID:2476
        
        C:\Program Files\Windows Multimedia Platform\TextInputHost.exe
        
        "C:\Program Files\Windows Multimedia Platform\TextInputHost.exe"
        15⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3956
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\2tBWjDxv5U.bat"
        16⤵
        Suspicious use of WriteProcessMemory
        
        PID:3668
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        17⤵
        
        PID:1648
        
        C:\Program Files\Windows Multimedia Platform\TextInputHost.exe
        
        "C:\Program Files\Windows Multimedia Platform\TextInputHost.exe"
        17⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1172
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\JhFjyqSsxH.bat"
        18⤵
        Suspicious use of WriteProcessMemory
        
        PID:3040
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        19⤵
        
        PID:3340
        
        C:\Program Files\Windows Multimedia Platform\TextInputHost.exe
        
        "C:\Program Files\Windows Multimedia Platform\TextInputHost.exe"
        19⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2208
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\5pDZQI1oOH.bat"
        20⤵
        Suspicious use of WriteProcessMemory
        
        PID:3860
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        21⤵
        
        PID:4184
        
        C:\Program Files\Windows Multimedia Platform\TextInputHost.exe
        
        "C:\Program Files\Windows Multimedia Platform\TextInputHost.exe"
        21⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4172
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\IrNnSCw4rJ.bat"
        22⤵
        
        PID:4308
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        23⤵
        
        PID:4840
        
        C:\Program Files\Windows Multimedia Platform\TextInputHost.exe
        
        "C:\Program Files\Windows Multimedia Platform\TextInputHost.exe"
        23⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:684
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Asmf6CRzTu.bat"
        24⤵
        
        PID:3336
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        25⤵
        
        PID:628
        
        C:\Program Files\Windows Multimedia Platform\TextInputHost.exe
        
        "C:\Program Files\Windows Multimedia Platform\TextInputHost.exe"
        25⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2476
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\zDcPfnAXs0.bat"
        26⤵
        
        PID:3568
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        27⤵
        
        PID:3572
        
        C:\Program Files\Windows Multimedia Platform\TextInputHost.exe
        
        "C:\Program Files\Windows Multimedia Platform\TextInputHost.exe"
        27⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:460
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\cLz7lFEPwa.bat"
        28⤵
        
        PID:2652
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        29⤵
        
        PID:2824
        
        C:\Program Files\Windows Multimedia Platform\TextInputHost.exe
        
        "C:\Program Files\Windows Multimedia Platform\TextInputHost.exe"
        29⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Multimedia Platform\TextInputHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Program Files\Windows Multimedia Platform\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Multimedia Platform\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 8 /tr "'C:\Program Files\7-Zip\Lang\upfc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Program Files\7-Zip\Lang\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 9 /tr "'C:\Program Files\7-Zip\Lang\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\TextInputHost.exe.log

Filesize
1KB

MD5
baf55b95da4a601229647f25dad12878

SHA1
abc16954ebfd213733c4493fc1910164d825cac8

SHA256
ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

SHA512
24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
77d622bb1a5b250869a3238b9bc1402b

SHA1
d47f4003c2554b9dfc4c16f22460b331886b191b

SHA256
f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

SHA512
d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

Download Submit
C:\Users\Admin\AppData\Local\Temp\2tBWjDxv5U.bat

Filesize
227B

MD5
9f1fb9e763a5a539c1ec88b5c7596024

SHA1
a39884eccbf2823b0f40334268564c623371d1d2

SHA256
24ad804b0893b41e063e9de29194d346ddf1ea6a56fd4181c28bbd9b64d031d9

SHA512
34d678bde1394225a7f3f1974e066e01887e7c0197dbefb5005aa962957b1a302c580367a8952387bd9123a103084f9f10247aebd966e96d151baa7bcafb7db8

Download Submit
C:\Users\Admin\AppData\Local\Temp\5pDZQI1oOH.bat

Filesize
227B

MD5
80fd23862e2b121ab4019c85000f87d5

SHA1
c3495a9e3581ec5c4f4b85b4a67354199d7c675a

SHA256
d657a02062e8441963b246ab7104f4161dc1498439ed48116ea0b9cea6064807

SHA512
5ba63ed6be38bd9b412b0a300c8845d1b1bab2613166543d66266a8f8426ac68c88aba95152891fb690f94f733079cfa2557aedfa4e447e07643f8b9883b432b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Asmf6CRzTu.bat

Filesize
227B

MD5
124a87f7e633693ee5e261d4af3a1821

SHA1
4f4d24708f12702ef08d4d87b08ee7724d89056c

SHA256
27c6bb73ba5c9ad19865dd52792d7981be5f551556790c9973d89d24b0c97a2f

SHA512
a97dfab70dbbec795f8c883b400550e019e05de2efcae537bbd5e9643888d5fbeb3a5f68d733d6ae6084db1f62b34ba38bda0ba2067d5ad99c21cfdfbcd2cc8c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IrNnSCw4rJ.bat

Filesize
227B

MD5
6f2b9b7071d53bab9a0e2297db551ad3

SHA1
4347a96df39c4666b89b635aa02e65b6ac11f0ce

SHA256
52d7452b77b38624bfad23fe893bb273b33366acbd130ea6484d8cba8435fada

SHA512
dd056a070bc06b30b1d1a82615598d55c0e081b05d9ba9ebca00202882fb5839e671e7b0aba58e1ed7c08b314a690a81ea5b6d12cac10bb4c386fff0423d5fb0

Download Submit
C:\Users\Admin\AppData\Local\Temp\JhFjyqSsxH.bat

Filesize
227B

MD5
47d28961edb439f84ef7e99c5c23afa3

SHA1
b89db257fa09b5e3c2ecfb82cddd6fe7a7d67ce8

SHA256
726f5b96356c4536dc8819bd849375d89dc5a570f4cb2a58f3d9828e598213ac

SHA512
697b94067d75e3abe644fd7ac90916599f82ca6e9fb696067e2c006cc5367866263714ae56b76904ec05d4fb9b96b57c22122dff7e596ff255da0ba44491e66c

Download Submit
C:\Users\Admin\AppData\Local\Temp\NiQtqM3qVs.bat

Filesize
227B

MD5
d222dc8d4bf83d7bb181b838da521627

SHA1
7a3e0ed4d7e50634af74561013ae1ac3b43efeec

SHA256
b4607a285358c3eb1f9551fdb553881b2daf332d41906f16787d5d9df5522951

SHA512
ce848aaa94dcf68363b8d8e91b57c3639c9ff3677f07bacd4bbacf5a498c73cb2a35cafc994cdb03ebe626779f781cb4b406d270406d92a1790c8c8975f916a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\PeSwWR6joe.bat

Filesize
227B

MD5
de49b7cfaebc17dd10324ed34425268d

SHA1
d46c7c94f02b0e71f255bbd1a0caa8e4f6d35baa

SHA256
a9d65a8749b480f12775ff2cfeed244ef72c58c7258a83056961787a2ec16cae

SHA512
7b805043e9d2947a3884ec9692543d114548672d6776365865f527cd3cc9d85c681b10c504a61ee879cdba3d1c925180b0395a0ed9e5a4184c432ad9601c6bb0

Download Submit
C:\Users\Admin\AppData\Local\Temp\UMOyPGkKXB.bat

Filesize
227B

MD5
bccde546829879c58d2dd667e0b1207e

SHA1
03370b694784610f10b95dba138f2e978c7af720

SHA256
87476f165817c14cff0c334a835c89290ff74d45a8907f3f83e0c8acbe2c5c72

SHA512
d66b0915ff077f870a377ad48a049269ea8a8f349175bc9830688586b29cf7db61b7a29f2243d7beeff49752ca4ad3704a4db75555e622c950ae032e49caba0d

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mszv1tp2.x33.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\cLz7lFEPwa.bat

Filesize
227B

MD5
946760171a342e0a9b460faad4d2c5dc

SHA1
fb52c0427445124ec1ac319695caf0e4f5f12c2b

SHA256
aa589eea3497a031aed3a237cac3a0f089f09c4dee52986b1fa97f6328c96f8c

SHA512
64534f05166b8c8cc20e5b3a4a0ddbbe9c3f6400d2835a5346ff64a61c4efab408d88d7dfba1a13cf2dc583f9aaa4f3fae36d71dd94894d81a1cab7dc7173e7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\syYKg8QxNI.bat

Filesize
227B

MD5
f62d5631b7ddcc5cbebcc03427f79c4b

SHA1
9e4cf51787cd1b4840c4b68664cce9e83968f421

SHA256
23222d6fcaff30cae3b636eaae8cd1df2f55910a50370bc4998c5bbd83a0e0f7

SHA512
688097cb77446c8f2c61002681db2ead7aa6ebf5838af3474b45efe8dcf0a84d7c89548f4f00b27ba8c1ad4ff48ddd3dc66144549ab21c95f466ae2a8864500a

Download Submit
C:\Users\Admin\AppData\Local\Temp\zDcPfnAXs0.bat

Filesize
227B

MD5
fa6ec24fc107be90330e9c40d6a16ee9

SHA1
db417b6f5319ebe717630ebed6b17f58b105af0e

SHA256
8668127a4c1edb71caae1ac212f6034bfc97514e377c3efb69bdf81c0b0ee8a6

SHA512
e34e77657f5c83ad9c9e1b1a54a156dc6c92852250e8062ac6caf197e589ef2ec25cbbdb6d2e77e481fa1705cba480ced673db9fd5fa548a37c4dafbed7045d0

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/2476-135-0x0000000002C50000-0x0000000002C62000-memory.dmp

Filesize
72KB

Download
memory/3108-101-0x000000001BFA0000-0x000000001C10A000-memory.dmp

Filesize
1.4MB

Download
memory/3108-96-0x0000000002640000-0x0000000002652000-memory.dmp

Filesize
72KB

Download
memory/3852-17-0x000000001B5C0000-0x000000001B5CC000-memory.dmp

Filesize
48KB

Download
memory/3852-16-0x000000001B5B0000-0x000000001B5BC000-memory.dmp

Filesize
48KB

Download
memory/3852-15-0x0000000002CD0000-0x0000000002CDC000-memory.dmp

Filesize
48KB

Download
memory/3852-14-0x0000000002CC0000-0x0000000002CD2000-memory.dmp

Filesize
72KB

Download
memory/3852-13-0x0000000000880000-0x0000000000990000-memory.dmp

Filesize
1.1MB

Download
memory/3852-12-0x00007FF9546C3000-0x00007FF9546C5000-memory.dmp

Filesize
8KB

Download
memory/3956-108-0x000000001C1D0000-0x000000001C33A000-memory.dmp

Filesize
1.4MB

Download
memory/4284-93-0x000000001C7D0000-0x000000001C93A000-memory.dmp

Filesize
1.4MB

Download
memory/5008-86-0x000000001BE90000-0x000000001BFFA000-memory.dmp

Filesize
1.4MB

Download
memory/5108-47-0x0000023D0D320000-0x0000023D0D342000-memory.dmp

Filesize
136KB

Download