dcrat | c04ed10afaf04ec1570c87bce65842bac6ac0634c281f04eacec1797b2bbf4de

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
22-12-2024 01:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_c04ed10afaf04ec1570c87bce65842bac6ac0634c281f04eacec1797b2bbf4de.exe
Size

1.3MB
MD5

ea608816f5df1ebe40e99899b2efefa4
SHA1

4c3ec8c5dd7849d3228889846b124fffa48181af
SHA256

c04ed10afaf04ec1570c87bce65842bac6ac0634c281f04eacec1797b2bbf4de
SHA512

07b26138347d5ab1b5f7c37dd689d0426e5125541632c9690c507827fe0f5aac5d71195ad82a0fdf6e6330dc2383cd3feea333e8bf0d001080ca39acbb9de1b3
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 9 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2876	2836	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2820	2836	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2880	2836	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2536	2836	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2540	2836	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2784	2836	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	940	2836	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1132	2836	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1248	2836	schtasks.exe	34

DCRat payload 11 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0008000000016cf0-9.dat	dcrat
behavioral1/memory/2324-13-0x00000000000C0000-0x00000000001D0000-memory.dmp	dcrat
behavioral1/memory/2456-49-0x0000000000120000-0x0000000000230000-memory.dmp	dcrat
behavioral1/memory/276-108-0x0000000000BA0000-0x0000000000CB0000-memory.dmp	dcrat
behavioral1/memory/1264-168-0x0000000001100000-0x0000000001210000-memory.dmp	dcrat
behavioral1/memory/520-228-0x00000000003D0000-0x00000000004E0000-memory.dmp	dcrat
behavioral1/memory/856-289-0x0000000000D30000-0x0000000000E40000-memory.dmp	dcrat
behavioral1/memory/276-349-0x0000000000DD0000-0x0000000000EE0000-memory.dmp	dcrat
behavioral1/memory/2032-409-0x0000000001320000-0x0000000001430000-memory.dmp	dcrat
behavioral1/memory/1764-469-0x0000000000250000-0x0000000000360000-memory.dmp	dcrat
behavioral1/memory/3032-529-0x0000000000CA0000-0x0000000000DB0000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1784	powershell.exe
1516	powershell.exe
2992	powershell.exe
2868	powershell.exe

Executes dropped EXE 11 IoCs

pid	Process
2324	DllCommonsvc.exe
2456	wininit.exe
276	wininit.exe
1264	wininit.exe
520	wininit.exe
856	wininit.exe
276	wininit.exe
2032	wininit.exe
1764	wininit.exe
3032	wininit.exe
2060	wininit.exe

Loads dropped DLL 2 IoCs

pid	Process
2024	cmd.exe
2024	cmd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 11 IoCs

Web Service

T1102

flow	ioc
34	raw.githubusercontent.com
4	raw.githubusercontent.com
9	raw.githubusercontent.com
13	raw.githubusercontent.com
20	raw.githubusercontent.com
23	raw.githubusercontent.com
27	raw.githubusercontent.com
30	raw.githubusercontent.com
37	raw.githubusercontent.com
5	raw.githubusercontent.com
16	raw.githubusercontent.com

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\1033\wininit.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\1033\56085415360792	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Defender\es-ES\System.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Defender\es-ES\27d1bcfc3c54e0	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_c04ed10afaf04ec1570c87bce65842bac6ac0634c281f04eacec1797b2bbf4de.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 9 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2820	schtasks.exe
2784	schtasks.exe
940	schtasks.exe
1248	schtasks.exe
1132	schtasks.exe
2876	schtasks.exe
2880	schtasks.exe
2536	schtasks.exe
2540	schtasks.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
2324	DllCommonsvc.exe
2868	powershell.exe
1516	powershell.exe
1784	powershell.exe
2992	powershell.exe
2456	wininit.exe
276	wininit.exe
1264	wininit.exe
520	wininit.exe
856	wininit.exe
276	wininit.exe
2032	wininit.exe
1764	wininit.exe
3032	wininit.exe
2060	wininit.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeDebugPrivilege	2324	DllCommonsvc.exe
Token: SeDebugPrivilege	2868	powershell.exe
Token: SeDebugPrivilege	1516	powershell.exe
Token: SeDebugPrivilege	1784	powershell.exe
Token: SeDebugPrivilege	2992	powershell.exe
Token: SeDebugPrivilege	2456	wininit.exe
Token: SeDebugPrivilege	276	wininit.exe
Token: SeDebugPrivilege	1264	wininit.exe
Token: SeDebugPrivilege	520	wininit.exe
Token: SeDebugPrivilege	856	wininit.exe
Token: SeDebugPrivilege	276	wininit.exe
Token: SeDebugPrivilege	2032	wininit.exe
Token: SeDebugPrivilege	1764	wininit.exe
Token: SeDebugPrivilege	3032	wininit.exe
Token: SeDebugPrivilege	2060	wininit.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 2156	1688	JaffaCakes118_c04ed10afaf04ec1570c87bce65842bac6ac0634c281f04eacec1797b2bbf4de.exe	30
PID 1688 wrote to memory of 2156	1688	JaffaCakes118_c04ed10afaf04ec1570c87bce65842bac6ac0634c281f04eacec1797b2bbf4de.exe	30
PID 1688 wrote to memory of 2156	1688	JaffaCakes118_c04ed10afaf04ec1570c87bce65842bac6ac0634c281f04eacec1797b2bbf4de.exe	30
PID 1688 wrote to memory of 2156	1688	JaffaCakes118_c04ed10afaf04ec1570c87bce65842bac6ac0634c281f04eacec1797b2bbf4de.exe	30
PID 2156 wrote to memory of 2024	2156	WScript.exe	31
PID 2156 wrote to memory of 2024	2156	WScript.exe	31
PID 2156 wrote to memory of 2024	2156	WScript.exe	31
PID 2156 wrote to memory of 2024	2156	WScript.exe	31
PID 2024 wrote to memory of 2324	2024	cmd.exe	33
PID 2024 wrote to memory of 2324	2024	cmd.exe	33
PID 2024 wrote to memory of 2324	2024	cmd.exe	33
PID 2024 wrote to memory of 2324	2024	cmd.exe	33
PID 2324 wrote to memory of 1784	2324	DllCommonsvc.exe	44
PID 2324 wrote to memory of 1784	2324	DllCommonsvc.exe	44
PID 2324 wrote to memory of 1784	2324	DllCommonsvc.exe	44
PID 2324 wrote to memory of 1516	2324	DllCommonsvc.exe	45
PID 2324 wrote to memory of 1516	2324	DllCommonsvc.exe	45
PID 2324 wrote to memory of 1516	2324	DllCommonsvc.exe	45
PID 2324 wrote to memory of 2868	2324	DllCommonsvc.exe	46
PID 2324 wrote to memory of 2868	2324	DllCommonsvc.exe	46
PID 2324 wrote to memory of 2868	2324	DllCommonsvc.exe	46
PID 2324 wrote to memory of 2992	2324	DllCommonsvc.exe	47
PID 2324 wrote to memory of 2992	2324	DllCommonsvc.exe	47
PID 2324 wrote to memory of 2992	2324	DllCommonsvc.exe	47
PID 2324 wrote to memory of 1056	2324	DllCommonsvc.exe	52
PID 2324 wrote to memory of 1056	2324	DllCommonsvc.exe	52
PID 2324 wrote to memory of 1056	2324	DllCommonsvc.exe	52
PID 1056 wrote to memory of 556	1056	cmd.exe	54
PID 1056 wrote to memory of 556	1056	cmd.exe	54
PID 1056 wrote to memory of 556	1056	cmd.exe	54
PID 1056 wrote to memory of 2456	1056	cmd.exe	55
PID 1056 wrote to memory of 2456	1056	cmd.exe	55
PID 1056 wrote to memory of 2456	1056	cmd.exe	55
PID 2456 wrote to memory of 1592	2456	wininit.exe	56
PID 2456 wrote to memory of 1592	2456	wininit.exe	56
PID 2456 wrote to memory of 1592	2456	wininit.exe	56
PID 1592 wrote to memory of 2608	1592	cmd.exe	58
PID 1592 wrote to memory of 2608	1592	cmd.exe	58
PID 1592 wrote to memory of 2608	1592	cmd.exe	58
PID 1592 wrote to memory of 276	1592	cmd.exe	59
PID 1592 wrote to memory of 276	1592	cmd.exe	59
PID 1592 wrote to memory of 276	1592	cmd.exe	59
PID 276 wrote to memory of 2272	276	wininit.exe	60
PID 276 wrote to memory of 2272	276	wininit.exe	60
PID 276 wrote to memory of 2272	276	wininit.exe	60
PID 2272 wrote to memory of 2876	2272	cmd.exe	62
PID 2272 wrote to memory of 2876	2272	cmd.exe	62
PID 2272 wrote to memory of 2876	2272	cmd.exe	62
PID 2272 wrote to memory of 1264	2272	cmd.exe	63
PID 2272 wrote to memory of 1264	2272	cmd.exe	63
PID 2272 wrote to memory of 1264	2272	cmd.exe	63
PID 1264 wrote to memory of 2908	1264	wininit.exe	64
PID 1264 wrote to memory of 2908	1264	wininit.exe	64
PID 1264 wrote to memory of 2908	1264	wininit.exe	64
PID 2908 wrote to memory of 2476	2908	cmd.exe	66
PID 2908 wrote to memory of 2476	2908	cmd.exe	66
PID 2908 wrote to memory of 2476	2908	cmd.exe	66
PID 2908 wrote to memory of 520	2908	cmd.exe	67
PID 2908 wrote to memory of 520	2908	cmd.exe	67
PID 2908 wrote to memory of 520	2908	cmd.exe	67
PID 520 wrote to memory of 2440	520	wininit.exe	68
PID 520 wrote to memory of 2440	520	wininit.exe	68
PID 520 wrote to memory of 2440	520	wininit.exe	68
PID 2440 wrote to memory of 1232	2440	cmd.exe	70

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c04ed10afaf04ec1570c87bce65842bac6ac0634c281f04eacec1797b2bbf4de.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c04ed10afaf04ec1570c87bce65842bac6ac0634c281f04eacec1797b2bbf4de.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2156
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2024
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2324
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1784
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1516
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Defender\es-ES\System.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2868
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\1033\wininit.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2992
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\E1U41Va1sj.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1056
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:556
      - C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\1033\wininit.exe
        
        "C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\1033\wininit.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2456
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\i32OxRBhll.bat"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:1592
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:2608
        
        C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\1033\wininit.exe
        
        "C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\1033\wininit.exe"
        8⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:276
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\TZCyxGcg3L.bat"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:2272
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:2876
        
        C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\1033\wininit.exe
        
        "C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\1033\wininit.exe"
        10⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1264
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\f70LHM7oRz.bat"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:2908
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:2476
        
        C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\1033\wininit.exe
        
        "C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\1033\wininit.exe"
        12⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:520
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\MsMShxucCb.bat"
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:2440
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        14⤵
        
        PID:1232
        
        C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\1033\wininit.exe
        
        "C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\1033\wininit.exe"
        14⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:856
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\xjNnGM38uG.bat"
        15⤵
        
        PID:2864
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        16⤵
        
        PID:1668
        
        C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\1033\wininit.exe
        
        "C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\1033\wininit.exe"
        16⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:276
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\lHuJ4aKJis.bat"
        17⤵
        
        PID:1960
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        18⤵
        
        PID:2556
        
        C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\1033\wininit.exe
        
        "C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\1033\wininit.exe"
        18⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2032
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\s1KW4B7p45.bat"
        19⤵
        
        PID:1972
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        20⤵
        
        PID:2264
        
        C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\1033\wininit.exe
        
        "C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\1033\wininit.exe"
        20⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1764
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\8OW3hmLaVA.bat"
        21⤵
        
        PID:2128
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        22⤵
        
        PID:3044
        
        C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\1033\wininit.exe
        
        "C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\1033\wininit.exe"
        22⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3032
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\wzkVYe0vvu.bat"
        23⤵
        
        PID:1692
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        24⤵
        
        PID:452
        
        C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\1033\wininit.exe
        
        "C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\1033\wininit.exe"
        24⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\DllCommonsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Defender\es-ES\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\es-ES\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Defender\es-ES\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\1033\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\1033\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1132

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\1033\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f4ce9ca1a34a25dc310bb9d8a42e5021

SHA1
aadb608c70e6c8968f0d76715c2591e0f17b4a6d

SHA256
29fc805b409418b0f90cd34f2816bb7b4fb01f585e40625615f88f3e63b3a766

SHA512
584fa41fdaa8ff2d6d0cbe3019d6148154ea4c707369f3a292fa377618d53d3da393ad0fb10e12eb66496d19c2ba69647ea19a429aae37fa9d5c43246b7118f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2416c0f24d8e16f3b5057c5ce3608b93

SHA1
5b82d55d9a34a5f552a1de882697170a1624f52c

SHA256
38ed93ccf8cd995b935c10c67c62a762cd8c3806f2efcf8a5422d507cda9916e

SHA512
3ddaab5cfa0636d4d5f08b5c5693a289b1fb6db320b8a39dde21750b6df2a3bece48042f242b0ea860813afa3bce1eec8c953f78aaccc25dccbec20cff1a1439

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eb97f9c492ead340e485abeffa9ce2ca

SHA1
fccfb33f7cb70fdbd8d6cdb3ddb936a7525e2cda

SHA256
77ab6545e92260b22e1c00c1f46afa94d79fdff401c5dc31e330e56bb43347d8

SHA512
71bfc735f5e0b042b0e1f6b4e4a45619f21c0bef17003f1ff92b7955e4d07e0ddb6bd8592ce334f289fc184b15467d124acc3fe65c48a0d4b370377d2734426a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e33a1e5b136632fad529c44f8c407f9b

SHA1
c7869fe034b2979efa41200c7c20f8c914a4fe10

SHA256
0d361cd5eecf4f741dda94e5c3ee2e737269148591c8ef26e8511a04edb22d97

SHA512
827c7c27934014a3bc35e5c91d1207431b3397aa537202d21ecc59b5584146c8964787dd1754b5f24343d91c09052669196b394dd18984c9584db1e7c2c4a429

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
454b11205df1115559fa39e0d4984c0b

SHA1
8705c83d2bbd2008d9787beb48db67a9c054b5dd

SHA256
20694ad652fb6ef5620e50ee1696f1cd08c7ab67768ed6e35467661aacf293df

SHA512
790e18ebbf3fe09de865766305df7f3bff644d235b2f6da46e9bf8499e8f66d7a1068ee6c4d31cbea8c5a6e4ea4c58bc400442605cd6db62eb5ea21509377f32

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1f5f2263d7df41b60e257f78e8f81575

SHA1
e3907f2b07cc0430b767be154ed12b5341a304fc

SHA256
b9fa006c72981117bde24c65928f32e2f39aa12dce6b6068f0851123cd765512

SHA512
af39b37e0ae47afa23d168b7d0599327942412ac959aeb1d45c5565438017e0ca75c0e36b23d432468e0ef51c74b75a45290588a586901744527ad7094df1aa6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
feed325a302c9a085c35c0db5f66f065

SHA1
1ae387764bf8f08d4006282f40a8cae348f15f4b

SHA256
7a21585b4513669241be5ea2b12eba3215329d648dd6bb27c3aadfcead1c7d46

SHA512
4285a881893e6e946eaa40ab0a296cd743ad1bbfd5b769840c7246ce721b007283eb7fcc998dd85625762d74ac8344b8881d172f37ef7253570e6857648b0360

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c53b350a32f91f2b87b6621225162890

SHA1
3b6fc3a0bca0552cadfd4233f14d14bee4287ee7

SHA256
d56fc6448c57691fb66fcda85685fd5f20f58c4674f26d197bc0eedef4f184f3

SHA512
2164205e8d57bd3857621823dceaf7ee12b7a9bc076f75576a444a2382db580e49f3ee8cf95172ce91d234c73ad09ef3a98b671ba533a9b7e90e747e20e0d44d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
89d5c837c605048d5ab9fab637a83597

SHA1
19a27a82537440911f7e47522cda0eaaeed132cb

SHA256
0dad9cf930274223f8892b923f054177571628562f328f69648792fd02d5a2cc

SHA512
368c3a086c2a777d69d96641d320c1f5be3e07c8565340e78a9a6fc430b1f9a75cb13bd6353d8004c7807c69be2f0079985bbf71c0d8fbe55cc9c42089f7b6d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\8OW3hmLaVA.bat

Filesize
239B

MD5
5f8dc64cacf1ab23a783a5133b2590b5

SHA1
7556bb99ae1ad8e3191bd60aed272b6062505a2e

SHA256
e955ead496799801524efa37a02253b31533ab188df36d63a4758a118d46400b

SHA512
31b6af9ca8df13980a17f6ed67d3ed35484ad9f7af9a61da92425a2196961e46ce7f0e473c3d69f51ab77816363153f8d37c82bdc81de11bd9d830b4e6a08297

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF865.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\E1U41Va1sj.bat

Filesize
239B

MD5
529ac3dbf16873dfcd629dd593f987d9

SHA1
66b4556565fc18a2bf323dccc12c0bf6b0fbb449

SHA256
a4d6d3ccbac52d28008ee6ba5f51a95fb6eed108ad5441f4119908390c6a91db

SHA512
cdfdc0c345dfa3ed15776239161afd2d6d8cc6f260b1da34999c1e0184c8f44d9b25593a954851b86c273731bc9599cf8dba51cf9c072b95bc4a02da9b6d32a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\MsMShxucCb.bat

Filesize
239B

MD5
d8afa72824c99c8a22e52fa9c7bb11a1

SHA1
98e0f5f26fdb996d8b0c8951134a5898a96c0898

SHA256
f92f897c3e773105d642e507e38045a41bd1079e366f1f308b58787c1a86c5ff

SHA512
876d4cfdaf626e7d318622e2137da7a1b3f872703860ab9a25d07368f2ace306534da5ea14ee9f5d64fb3920cd1a227228f9b3eee5606a842c12bc00c2def801

Download Submit
C:\Users\Admin\AppData\Local\Temp\TZCyxGcg3L.bat

Filesize
239B

MD5
6673da166a36f7bb7632d8d9d36a74ac

SHA1
9811d56a34dcc3e8bc716acf88d03193995b1057

SHA256
7f73cfb8c5f792c1091fee133941f0b41bb780bb99df382c9edeff4c4493c8af

SHA512
2d40ca40b45564dabc86abe446aefec64d2436f50c375e4c70e462987a89e4dbb46edebc91fe4f684584e1ad1379ba20878079a9664cd6f32e281dd23d9e1527

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF8E5.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\f70LHM7oRz.bat

Filesize
239B

MD5
24b38b155afe889649bb6303091e2711

SHA1
81ab57a252a11f9c4369d0470989947d93525535

SHA256
10dfc3e5eecf3bd2b48ae8618eea6856302881e854dbed564027afa64730a0e5

SHA512
6be5addf4e5bd74217b9143581be3ef5a5b10a8f3db06427048b938fe0ccde4db390c3d4aa7f6b73e730a7d55712582f62544c15215b25dca320a5a78f9fbe82

Download Submit
C:\Users\Admin\AppData\Local\Temp\i32OxRBhll.bat

Filesize
239B

MD5
4f2aeb45436d45da6ae5238b1aa9a89e

SHA1
39b8777f50f6a011cf47777c5c63d0453895631f

SHA256
0d42eda87e184997a388ebaeeaab52b0492a5632177f68c5433677198184a097

SHA512
e639c3b1e23035006d03fd9fa699f9d4d2fdd67cb6ec75f3d1e25e1a3011606105f6014196e5992946f0289ccb19e16fe7c97b8df87dce558f6fc1893e741b6a

Download Submit
C:\Users\Admin\AppData\Local\Temp\lHuJ4aKJis.bat

Filesize
239B

MD5
159a7d16aaee27988c5b79546a3d04e9

SHA1
08943978d47ba154d51dad6f034207eb581354fe

SHA256
d46644cfbc6aba54c811e9efa136594cef10c34d52013e7c59ddb8aabe0c8e1f

SHA512
d7c1a6ffcde81430930118504b1c4f6c68a7397230d83c799f207deddb57b68cca02685744559533b8afdd52f99d47b2f8d8f9398e7d3a1a5f2a0f2968562fec

Download Submit
C:\Users\Admin\AppData\Local\Temp\s1KW4B7p45.bat

Filesize
239B

MD5
da270107f2e415e4ca26ffa350c7f61d

SHA1
47239199ee612b88b793051137ec6f3bd9280ec4

SHA256
653804eb6271263b96ecd46c1857336c8dbbf83986c80d734d8fe0b058e4a73f

SHA512
06886e870e3f96afc5f9509ac7a1992702c9d638829a33ee0f59284f9cd443f94d025c4e489c2690f5a0dc885ff877e0dc97b8b8393ac9d3bd2caaf0535967bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\wzkVYe0vvu.bat

Filesize
239B

MD5
22accd6cb4e7cf825618fdf813417307

SHA1
cac80346898bdda75537a1aba0a817b6d57ca38b

SHA256
b8a5d5a7628fd79f4228fc50481880c5222f595de773a2aab86b0da4794b382e

SHA512
f2a25721c5ac04b7a03a12502ef20703c584b321bafd1d46a321a9b4a36a7683f7809d3f9a6fe14f3eb2e93dac2e8744a48a28da810696938f05bc69f3ccd540

Download Submit
C:\Users\Admin\AppData\Local\Temp\xjNnGM38uG.bat

Filesize
239B

MD5
1d5352171e4d9828d8f260be976dae4b

SHA1
7ca8b4d57ef92dfc9472efee3b9d7b362bc2b832

SHA256
d7180257cf8f4412750c757c44011935d039495dae43ee64bff9e5efbe6cb5e7

SHA512
2182ff24b27a5b02d13f92661813dcf43b3f0ce19b03129c12c6d6ee3661c6abd6bfb04db876a102c9a3a43d3041c0a70f21eaf3023c205099e9908cb23faa6d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
99b6d393f17db2f56c09758a0507f986

SHA1
7c95a92276aed36b419d00124e02981a581a563e

SHA256
62a74a3117ecd100824821daf8a461422b522f2b6a3b235010fe62c7488c64aa

SHA512
9636e547f09ca3229a1b3d6ceedc0151b7d534598db6f442f8e168545fcf9f128264976f67aff17a7a75c0b79cb4ec457ef9ed3b678a97a8a9eed4db2053a264

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
memory/276-108-0x0000000000BA0000-0x0000000000CB0000-memory.dmp

Filesize
1.1MB

Download
memory/276-349-0x0000000000DD0000-0x0000000000EE0000-memory.dmp

Filesize
1.1MB

Download
memory/520-229-0x00000000003C0000-0x00000000003D2000-memory.dmp

Filesize
72KB

Download
memory/520-228-0x00000000003D0000-0x00000000004E0000-memory.dmp

Filesize
1.1MB

Download
memory/856-289-0x0000000000D30000-0x0000000000E40000-memory.dmp

Filesize
1.1MB

Download
memory/1264-168-0x0000000001100000-0x0000000001210000-memory.dmp

Filesize
1.1MB

Download
memory/1764-469-0x0000000000250000-0x0000000000360000-memory.dmp

Filesize
1.1MB

Download
memory/2032-409-0x0000000001320000-0x0000000001430000-memory.dmp

Filesize
1.1MB

Download
memory/2324-14-0x00000000004D0000-0x00000000004E2000-memory.dmp

Filesize
72KB

Download
memory/2324-13-0x00000000000C0000-0x00000000001D0000-memory.dmp

Filesize
1.1MB

Download
memory/2324-15-0x00000000004E0000-0x00000000004EC000-memory.dmp

Filesize
48KB

Download
memory/2324-17-0x0000000000580000-0x000000000058C000-memory.dmp

Filesize
48KB

Download
memory/2324-16-0x0000000000570000-0x000000000057C000-memory.dmp

Filesize
48KB

Download
memory/2456-49-0x0000000000120000-0x0000000000230000-memory.dmp

Filesize
1.1MB

Download
memory/2868-45-0x0000000002410000-0x0000000002418000-memory.dmp

Filesize
32KB

Download
memory/2868-40-0x000000001B1C0000-0x000000001B4A2000-memory.dmp

Filesize
2.9MB

Download
memory/3032-529-0x0000000000CA0000-0x0000000000DB0000-memory.dmp

Filesize
1.1MB

Download