Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-12-2024 01:05
Behavioral task
behavioral1
Sample
JaffaCakes118_0de0281926925a1d5c87d3d7137fd5e16c49e98f47da8109423f63239917074f.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
JaffaCakes118_0de0281926925a1d5c87d3d7137fd5e16c49e98f47da8109423f63239917074f.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_0de0281926925a1d5c87d3d7137fd5e16c49e98f47da8109423f63239917074f.exe
-
Size
1.3MB
-
MD5
530d751ed8f3ab68b5f77b99ddbee899
-
SHA1
8db37112c9ae61f9f36da12e4b9958c7a84aac28
-
SHA256
0de0281926925a1d5c87d3d7137fd5e16c49e98f47da8109423f63239917074f
-
SHA512
363cf82a78c45d6d80d475f8b558af7d6f4f0e0e29537ac1458acc96f9bbfd9eb7d8073daad4d7bff5ef6a973af0e2529387678dc29307d515953a64bc2ddf3f
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Process spawned unexpected child process 12 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2040 3476 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4460 3476 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4612 3476 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4208 3476 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 372 3476 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4440 3476 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4164 3476 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 912 3476 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3128 3476 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1548 3476 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4252 3476 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2280 3476 schtasks.exe 88 -
resource yara_rule behavioral2/files/0x0008000000023bc3-10.dat dcrat behavioral2/memory/1064-13-0x0000000000940000-0x0000000000A50000-memory.dmp dcrat -
Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 1824 powershell.exe 4204 powershell.exe 2936 powershell.exe 4852 powershell.exe 3392 powershell.exe -
Checks computer location settings 2 TTPs 17 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation RuntimeBroker.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation RuntimeBroker.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation RuntimeBroker.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation RuntimeBroker.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation RuntimeBroker.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation RuntimeBroker.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation RuntimeBroker.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation JaffaCakes118_0de0281926925a1d5c87d3d7137fd5e16c49e98f47da8109423f63239917074f.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation RuntimeBroker.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation DllCommonsvc.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation RuntimeBroker.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation RuntimeBroker.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation RuntimeBroker.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation RuntimeBroker.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation RuntimeBroker.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation RuntimeBroker.exe -
Executes dropped EXE 15 IoCs
pid Process 1064 DllCommonsvc.exe 3664 RuntimeBroker.exe 1576 RuntimeBroker.exe 1436 RuntimeBroker.exe 2208 RuntimeBroker.exe 1824 RuntimeBroker.exe 1312 RuntimeBroker.exe 2104 RuntimeBroker.exe 2052 RuntimeBroker.exe 3128 RuntimeBroker.exe 1900 RuntimeBroker.exe 2884 RuntimeBroker.exe 3928 RuntimeBroker.exe 4232 RuntimeBroker.exe 5044 RuntimeBroker.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 15 IoCs
flow ioc 17 raw.githubusercontent.com 24 raw.githubusercontent.com 27 raw.githubusercontent.com 39 raw.githubusercontent.com 40 raw.githubusercontent.com 46 raw.githubusercontent.com 47 raw.githubusercontent.com 58 raw.githubusercontent.com 18 raw.githubusercontent.com 50 raw.githubusercontent.com 51 raw.githubusercontent.com 59 raw.githubusercontent.com 43 raw.githubusercontent.com 52 raw.githubusercontent.com 53 raw.githubusercontent.com -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\IME\IMETC\RuntimeBroker.exe DllCommonsvc.exe File created C:\Windows\IME\IMETC\9e8d7a4ca61bd9 DllCommonsvc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_0de0281926925a1d5c87d3d7137fd5e16c49e98f47da8109423f63239917074f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies registry class 15 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings JaffaCakes118_0de0281926925a1d5c87d3d7137fd5e16c49e98f47da8109423f63239917074f.exe Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings RuntimeBroker.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 12 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4460 schtasks.exe 372 schtasks.exe 4440 schtasks.exe 2280 schtasks.exe 2040 schtasks.exe 4208 schtasks.exe 4164 schtasks.exe 912 schtasks.exe 3128 schtasks.exe 1548 schtasks.exe 4252 schtasks.exe 4612 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 29 IoCs
pid Process 1064 DllCommonsvc.exe 1064 DllCommonsvc.exe 1064 DllCommonsvc.exe 1064 DllCommonsvc.exe 1064 DllCommonsvc.exe 3392 powershell.exe 1824 powershell.exe 4204 powershell.exe 2936 powershell.exe 4852 powershell.exe 4852 powershell.exe 3392 powershell.exe 1824 powershell.exe 3664 RuntimeBroker.exe 2936 powershell.exe 4204 powershell.exe 1576 RuntimeBroker.exe 1436 RuntimeBroker.exe 2208 RuntimeBroker.exe 1824 RuntimeBroker.exe 1312 RuntimeBroker.exe 2104 RuntimeBroker.exe 2052 RuntimeBroker.exe 3128 RuntimeBroker.exe 1900 RuntimeBroker.exe 2884 RuntimeBroker.exe 3928 RuntimeBroker.exe 4232 RuntimeBroker.exe 5044 RuntimeBroker.exe -
Suspicious use of AdjustPrivilegeToken 20 IoCs
description pid Process Token: SeDebugPrivilege 1064 DllCommonsvc.exe Token: SeDebugPrivilege 3392 powershell.exe Token: SeDebugPrivilege 1824 powershell.exe Token: SeDebugPrivilege 2936 powershell.exe Token: SeDebugPrivilege 4204 powershell.exe Token: SeDebugPrivilege 4852 powershell.exe Token: SeDebugPrivilege 3664 RuntimeBroker.exe Token: SeDebugPrivilege 1576 RuntimeBroker.exe Token: SeDebugPrivilege 1436 RuntimeBroker.exe Token: SeDebugPrivilege 2208 RuntimeBroker.exe Token: SeDebugPrivilege 1824 RuntimeBroker.exe Token: SeDebugPrivilege 1312 RuntimeBroker.exe Token: SeDebugPrivilege 2104 RuntimeBroker.exe Token: SeDebugPrivilege 2052 RuntimeBroker.exe Token: SeDebugPrivilege 3128 RuntimeBroker.exe Token: SeDebugPrivilege 1900 RuntimeBroker.exe Token: SeDebugPrivilege 2884 RuntimeBroker.exe Token: SeDebugPrivilege 3928 RuntimeBroker.exe Token: SeDebugPrivilege 4232 RuntimeBroker.exe Token: SeDebugPrivilege 5044 RuntimeBroker.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4456 wrote to memory of 2888 4456 JaffaCakes118_0de0281926925a1d5c87d3d7137fd5e16c49e98f47da8109423f63239917074f.exe 84 PID 4456 wrote to memory of 2888 4456 JaffaCakes118_0de0281926925a1d5c87d3d7137fd5e16c49e98f47da8109423f63239917074f.exe 84 PID 4456 wrote to memory of 2888 4456 JaffaCakes118_0de0281926925a1d5c87d3d7137fd5e16c49e98f47da8109423f63239917074f.exe 84 PID 2888 wrote to memory of 1588 2888 WScript.exe 85 PID 2888 wrote to memory of 1588 2888 WScript.exe 85 PID 2888 wrote to memory of 1588 2888 WScript.exe 85 PID 1588 wrote to memory of 1064 1588 cmd.exe 87 PID 1588 wrote to memory of 1064 1588 cmd.exe 87 PID 1064 wrote to memory of 4852 1064 DllCommonsvc.exe 101 PID 1064 wrote to memory of 4852 1064 DllCommonsvc.exe 101 PID 1064 wrote to memory of 3392 1064 DllCommonsvc.exe 102 PID 1064 wrote to memory of 3392 1064 DllCommonsvc.exe 102 PID 1064 wrote to memory of 2936 1064 DllCommonsvc.exe 103 PID 1064 wrote to memory of 2936 1064 DllCommonsvc.exe 103 PID 1064 wrote to memory of 4204 1064 DllCommonsvc.exe 104 PID 1064 wrote to memory of 4204 1064 DllCommonsvc.exe 104 PID 1064 wrote to memory of 1824 1064 DllCommonsvc.exe 105 PID 1064 wrote to memory of 1824 1064 DllCommonsvc.exe 105 PID 1064 wrote to memory of 3664 1064 DllCommonsvc.exe 110 PID 1064 wrote to memory of 3664 1064 DllCommonsvc.exe 110 PID 3664 wrote to memory of 2052 3664 RuntimeBroker.exe 118 PID 3664 wrote to memory of 2052 3664 RuntimeBroker.exe 118 PID 2052 wrote to memory of 1904 2052 cmd.exe 120 PID 2052 wrote to memory of 1904 2052 cmd.exe 120 PID 2052 wrote to memory of 1576 2052 cmd.exe 121 PID 2052 wrote to memory of 1576 2052 cmd.exe 121 PID 1576 wrote to memory of 4164 1576 RuntimeBroker.exe 122 PID 1576 wrote to memory of 4164 1576 RuntimeBroker.exe 122 PID 4164 wrote to memory of 4728 4164 cmd.exe 124 PID 4164 wrote to memory of 4728 4164 cmd.exe 124 PID 4164 wrote to memory of 1436 4164 cmd.exe 125 PID 4164 wrote to memory of 1436 4164 cmd.exe 125 PID 1436 wrote to memory of 2320 1436 RuntimeBroker.exe 127 PID 1436 wrote to memory of 2320 1436 RuntimeBroker.exe 127 PID 2320 wrote to memory of 3884 2320 cmd.exe 129 PID 2320 wrote to memory of 3884 2320 cmd.exe 129 PID 2320 wrote to memory of 2208 2320 cmd.exe 131 PID 2320 wrote to memory of 2208 2320 cmd.exe 131 PID 2208 wrote to memory of 3040 2208 RuntimeBroker.exe 132 PID 2208 wrote to memory of 3040 2208 RuntimeBroker.exe 132 PID 3040 wrote to memory of 4596 3040 cmd.exe 134 PID 3040 wrote to memory of 4596 3040 cmd.exe 134 PID 3040 wrote to memory of 1824 3040 cmd.exe 135 PID 3040 wrote to memory of 1824 3040 cmd.exe 135 PID 1824 wrote to memory of 4396 1824 RuntimeBroker.exe 136 PID 1824 wrote to memory of 4396 1824 RuntimeBroker.exe 136 PID 4396 wrote to memory of 1384 4396 cmd.exe 138 PID 4396 wrote to memory of 1384 4396 cmd.exe 138 PID 4396 wrote to memory of 1312 4396 cmd.exe 139 PID 4396 wrote to memory of 1312 4396 cmd.exe 139 PID 1312 wrote to memory of 2124 1312 RuntimeBroker.exe 140 PID 1312 wrote to memory of 2124 1312 RuntimeBroker.exe 140 PID 2124 wrote to memory of 4576 2124 cmd.exe 142 PID 2124 wrote to memory of 4576 2124 cmd.exe 142 PID 2124 wrote to memory of 2104 2124 cmd.exe 143 PID 2124 wrote to memory of 2104 2124 cmd.exe 143 PID 2104 wrote to memory of 3848 2104 RuntimeBroker.exe 144 PID 2104 wrote to memory of 3848 2104 RuntimeBroker.exe 144 PID 3848 wrote to memory of 2424 3848 cmd.exe 146 PID 3848 wrote to memory of 2424 3848 cmd.exe 146 PID 3848 wrote to memory of 2052 3848 cmd.exe 147 PID 3848 wrote to memory of 2052 3848 cmd.exe 147 PID 2052 wrote to memory of 4976 2052 RuntimeBroker.exe 148 PID 2052 wrote to memory of 4976 2052 RuntimeBroker.exe 148 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0de0281926925a1d5c87d3d7137fd5e16c49e98f47da8109423f63239917074f.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0de0281926925a1d5c87d3d7137fd5e16c49e98f47da8109423f63239917074f.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1588 -
C:\providercommon\DllCommonsvc.exe"C:\providercommon\DllCommonsvc.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4852
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\OfficeClickToRun.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3392
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Contacts\sppsvc.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2936
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\IME\IMETC\RuntimeBroker.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4204
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\AppData\spoolsv.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1824
-
-
C:\Windows\IME\IMETC\RuntimeBroker.exe"C:\Windows\IME\IMETC\RuntimeBroker.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3664 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\jhJpXqSaXt.bat"6⤵
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:27⤵PID:1904
-
-
C:\Windows\IME\IMETC\RuntimeBroker.exe"C:\Windows\IME\IMETC\RuntimeBroker.exe"7⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\rZY5mW9Lj2.bat"8⤵
- Suspicious use of WriteProcessMemory
PID:4164 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:29⤵PID:4728
-
-
C:\Windows\IME\IMETC\RuntimeBroker.exe"C:\Windows\IME\IMETC\RuntimeBroker.exe"9⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\H7kUlUtrsw.bat"10⤵
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:211⤵PID:3884
-
-
C:\Windows\IME\IMETC\RuntimeBroker.exe"C:\Windows\IME\IMETC\RuntimeBroker.exe"11⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\hevtjRcN1r.bat"12⤵
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:213⤵PID:4596
-
-
C:\Windows\IME\IMETC\RuntimeBroker.exe"C:\Windows\IME\IMETC\RuntimeBroker.exe"13⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\T3kbcxG26A.bat"14⤵
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:215⤵PID:1384
-
-
C:\Windows\IME\IMETC\RuntimeBroker.exe"C:\Windows\IME\IMETC\RuntimeBroker.exe"15⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\wOqzmeZFfo.bat"16⤵
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:217⤵PID:4576
-
-
C:\Windows\IME\IMETC\RuntimeBroker.exe"C:\Windows\IME\IMETC\RuntimeBroker.exe"17⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\HD5NsnfB5C.bat"18⤵
- Suspicious use of WriteProcessMemory
PID:3848 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:219⤵PID:2424
-
-
C:\Windows\IME\IMETC\RuntimeBroker.exe"C:\Windows\IME\IMETC\RuntimeBroker.exe"19⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\WzmeI2KvQx.bat"20⤵PID:4976
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:221⤵PID:1200
-
-
C:\Windows\IME\IMETC\RuntimeBroker.exe"C:\Windows\IME\IMETC\RuntimeBroker.exe"21⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3128 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\9EVEWoB6gn.bat"22⤵PID:5112
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:223⤵PID:4212
-
-
C:\Windows\IME\IMETC\RuntimeBroker.exe"C:\Windows\IME\IMETC\RuntimeBroker.exe"23⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1900 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\VoHf0I0Wzs.bat"24⤵PID:3744
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:225⤵PID:1504
-
-
C:\Windows\IME\IMETC\RuntimeBroker.exe"C:\Windows\IME\IMETC\RuntimeBroker.exe"25⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2884 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\wOqzmeZFfo.bat"26⤵PID:4008
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:227⤵PID:4012
-
-
C:\Windows\IME\IMETC\RuntimeBroker.exe"C:\Windows\IME\IMETC\RuntimeBroker.exe"27⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3928 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\VoHf0I0Wzs.bat"28⤵PID:2840
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:229⤵PID:4948
-
-
C:\Windows\IME\IMETC\RuntimeBroker.exe"C:\Windows\IME\IMETC\RuntimeBroker.exe"29⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4232 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\0P1AeAAEDQ.bat"30⤵PID:3672
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:231⤵PID:3716
-
-
C:\Windows\IME\IMETC\RuntimeBroker.exe"C:\Windows\IME\IMETC\RuntimeBroker.exe"31⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5044 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\rZY5mW9Lj2.bat"32⤵PID:1904
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:233⤵PID:4188
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 6 /tr "'C:\Users\Default User\OfficeClickToRun.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2040
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Users\Default User\OfficeClickToRun.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4460
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 6 /tr "'C:\Users\Default User\OfficeClickToRun.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4612
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\Contacts\sppsvc.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4208
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Users\Admin\Contacts\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:372
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\Contacts\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4440
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Windows\IME\IMETC\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4164
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\IME\IMETC\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:912
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Windows\IME\IMETC\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3128
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\Users\Default\AppData\spoolsv.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1548
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Users\Default\AppData\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4252
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 14 /tr "'C:\Users\Default\AppData\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2280
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5baf55b95da4a601229647f25dad12878
SHA1abc16954ebfd213733c4493fc1910164d825cac8
SHA256ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
SHA51224f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD577d622bb1a5b250869a3238b9bc1402b
SHA1d47f4003c2554b9dfc4c16f22460b331886b191b
SHA256f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb
SHA512d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9
-
Filesize
944B
MD562623d22bd9e037191765d5083ce16a3
SHA14a07da6872672f715a4780513d95ed8ddeefd259
SHA25695d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010
SHA5129a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992
-
Filesize
203B
MD5dc35ab2323ea88597a2d949eafc28cfa
SHA1c5b6612202dc6ae59c12f756a82a128d1271f3f8
SHA25623ce1b81404a50be0ee30892dd3b9a34878ebf17cef0fd0b0461faad8f0728ff
SHA5120e9301109d02e094a7cd0434672f806702873e05776baba2245c687b8468ddf86e39d70e66544e726d4e1355cd0249b2b94fbe37111aa94b1f5715bbfc6bc4eb
-
Filesize
203B
MD592ffa2517b5ef8e5458ac295a93de1ac
SHA1d380cb4aec742eabb4840f3fd8e4f8f6f7eb0a91
SHA25655001d4edfdae0753c293e8caf54f278996f5bb03ae3ac73b8ede4899907b7b6
SHA5123647728e34edd0d98a6641697be1b6e85e7809d79331f1c64fee58d13ed4670f0d747be9b0c95770a965e3d86a499dc833ceeabdb97eeaf22c366d37c3e07402
-
Filesize
203B
MD5d20e16d69c64a268965ac94cda43f77d
SHA18f3dff4aa81de3ced53bca68b27e39eb21efc858
SHA256055ebfa7ee9b1db0f0427cb3af4c55f28c005445c5feffa2ce6fbb878b2c95de
SHA5122003571811878b291d1316d6c1ae8a9a89c8cbc2404d8957ea7c23030f4b3682c2d486ee33dc425f54ea73dda681aa08bb08af5204d412ed17fece2e902961c0
-
Filesize
203B
MD5be181bdc4113e17dd7d8301aad4fb886
SHA1f39bd197b11abc38b905127074d45595a7ebec43
SHA256f3d24d753cd0ccaf7440338e48b7d7cdc6d6d39ebd5896629bfc1e80db13e957
SHA512cd3bf2ed951e6cc246b3626566f12d061309754fd4b2db4532c9da165c48e3ed43bd9925d0843c1b05fc5cc1a7dfa1ffb12268e81fdf1de084e56dc90a1ee081
-
Filesize
203B
MD5e5a7b7c276a72d2e91d9f3db03e6e254
SHA1f7353bdb4320d1ed479d32f821e0fe4639e1d201
SHA256255a4f64ad3cfcb6d43b10726a47011ab9ec50712f23b9384474d793b37b2102
SHA512fe1005797fffd534578ccac456bdb8874689f2a4a94923bd7446a042fa03bc084a40d8007a1a884e1eea49935005e2f117043a1130358375bdad8effadcf5874
-
Filesize
203B
MD5e9ad44e20a6103ae0922bc0b1922834e
SHA1ff340f1518bb73658460946cd2a3ffd698693ba0
SHA256e914c712f49a5894b08c49d6f341d2f30f426d5d5bb9e72533dd53ac47bdda6b
SHA512c0d25ad696c2d041d0f916a80db168449573fe1cf2b48825b2eb642c6f5dee617438a9b9df2b613a28abf9b95b7e4c5a6c8f5d565a0d0546c5907a3658670a83
-
Filesize
203B
MD50994b287607650bf83fb6c6311f6a5a9
SHA11491dd33e9a1c5e5024c37b4953745d19721fc46
SHA2569c5bf95d0fd9c8d12ad4570b545e9c0257daa1102ad931f3d06a5e465014a183
SHA5129e482f67b94ac0d93cd8de2834f302c762e56ab5e3c4b0ad5648180e595a1ecec375aae7971e30ffc48d247df8d26929ac97c125d5b516af4ae34097e9db751a
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
203B
MD5a6100447bea1fd1d443d4cc9a5e0df14
SHA1c4bc45f3b286a39624ccb8ccab52ec01c2621ca6
SHA25692d799c7982c7598994edfb40cbe3c23966013f9a211846ec5d75b1d435775f5
SHA512ba8d4f260819160bd5ed727115153dc11ff9a550e9e42fbe1d353492443658cc3b76b05f28614089e8049397e9d9f384c13ed4b1af557863b638f8c5b26548d1
-
Filesize
203B
MD5c105c33329893b4acf6007f8e6570e05
SHA1a2c70a7803717164bb6e7101441282fa94d05e83
SHA2565dde1dff77061865e67157a4a2bd993215470641b28d146e705499d03740afe6
SHA512ae9ab3a7d4411962dcc9625572579fb69f9facd9ee382d41d9384972655051fabc595fb17a8f7c3d9a81c2776dce3b541e5e76d82617385a7da2ee359946d629
-
Filesize
203B
MD599ea4f48dee2e8e3a0bae43feb988956
SHA1ab66d1dd10b38c8f3255e318115320d3466d4568
SHA256c5e0ebf525505906b92329abade116c6514e2953fcc05c2fd79253dba50e7002
SHA512c2207298f5378d87323d9df758de9d49660d1f696c2b75115c5f485c0ccaf814296599ef6cda8a6ace81bb1d42643670dea65dcb9fd5f27123746be46eec9195
-
Filesize
203B
MD59403e2d1e0fb73931d1459c8a7ba0803
SHA147e2917397b97288b8b3498636c3bd68754fd90d
SHA256dab6915c25701063916055abb6b8e0c57dfccf8ab7e348ebca8bcf5f2c344a9c
SHA51272f2bcaf162b28594a50de41c690e5bd446d6968080df4b3ea0c58cd3b13053c170e6744d8574c442f8c7f7ed11cd71ce88630b78f3e9445beb198d6c896abbc
-
Filesize
36B
MD56783c3ee07c7d151ceac57f1f9c8bed7
SHA117468f98f95bf504cc1f83c49e49a78526b3ea03
SHA2568ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322
SHA512c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8
-
Filesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
Filesize
197B
MD58088241160261560a02c84025d107592
SHA1083121f7027557570994c9fc211df61730455bb5
SHA2562072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1
SHA51220d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478