dcrat | b191cef3bd06983c6f824a959cabcc1be823e7d2d4cd8e6ebe3278c1fb8cc8a1

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
22/12/2024, 02:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_b191cef3bd06983c6f824a959cabcc1be823e7d2d4cd8e6ebe3278c1fb8cc8a1.exe
Size

1.3MB
MD5

b419a3fc2045123a2f5a136cc8196c2b
SHA1

d4f9acc4a3fd6415a35262b2bf27ac1ac178777d
SHA256

b191cef3bd06983c6f824a959cabcc1be823e7d2d4cd8e6ebe3278c1fb8cc8a1
SHA512

e0caaf56193543d1ddd4acd886d153b210cc64d844e9ab69676f83b461dca2ef3f6853a461fb0bb2341cdbbd52ea3b7b1341c2f776bc09e0d47fc78acf98a97d
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 9 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2848	2868	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2864	2868	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2692	2868	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2804	2868	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2872	2868	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1168	2868	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	564	2868	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1780	2868	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2444	2868	schtasks.exe	33

DCRat payload 8 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0007000000019470-10.dat	dcrat
behavioral1/memory/2888-13-0x00000000009B0000-0x0000000000AC0000-memory.dmp	dcrat
behavioral1/memory/2364-52-0x0000000000070000-0x0000000000180000-memory.dmp	dcrat
behavioral1/memory/264-112-0x00000000010A0000-0x00000000011B0000-memory.dmp	dcrat
behavioral1/memory/1944-290-0x0000000000310000-0x0000000000420000-memory.dmp	dcrat
behavioral1/memory/2432-350-0x0000000000800000-0x0000000000910000-memory.dmp	dcrat
behavioral1/memory/2688-410-0x0000000000A40000-0x0000000000B50000-memory.dmp	dcrat
behavioral1/memory/2948-530-0x0000000000220000-0x0000000000330000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2044	powershell.exe
1560	powershell.exe
2036	powershell.exe
2436	powershell.exe

Executes dropped EXE 10 IoCs

pid	Process
2888	DllCommonsvc.exe
2364	System.exe
264	System.exe
1140	System.exe
2448	System.exe
1944	System.exe
2432	System.exe
2688	System.exe
1984	System.exe
2948	System.exe

Loads dropped DLL 2 IoCs

pid	Process
2812	cmd.exe
2812	cmd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 10 IoCs

Web Service

T1102

flow	ioc
5	raw.githubusercontent.com
9	raw.githubusercontent.com
12	raw.githubusercontent.com
18	raw.githubusercontent.com
25	raw.githubusercontent.com
31	raw.githubusercontent.com
4	raw.githubusercontent.com
22	raw.githubusercontent.com
28	raw.githubusercontent.com
15	raw.githubusercontent.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_b191cef3bd06983c6f824a959cabcc1be823e7d2d4cd8e6ebe3278c1fb8cc8a1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 9 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2848	schtasks.exe
2864	schtasks.exe
2872	schtasks.exe
1168	schtasks.exe
2444	schtasks.exe
2692	schtasks.exe
2804	schtasks.exe
564	schtasks.exe
1780	schtasks.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2888	DllCommonsvc.exe
1560	powershell.exe
2044	powershell.exe
2036	powershell.exe
2436	powershell.exe
2364	System.exe
264	System.exe
1140	System.exe
2448	System.exe
1944	System.exe
2432	System.exe
2688	System.exe
1984	System.exe
2948	System.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeDebugPrivilege	2888	DllCommonsvc.exe
Token: SeDebugPrivilege	1560	powershell.exe
Token: SeDebugPrivilege	2044	powershell.exe
Token: SeDebugPrivilege	2036	powershell.exe
Token: SeDebugPrivilege	2436	powershell.exe
Token: SeDebugPrivilege	2364	System.exe
Token: SeDebugPrivilege	264	System.exe
Token: SeDebugPrivilege	1140	System.exe
Token: SeDebugPrivilege	2448	System.exe
Token: SeDebugPrivilege	1944	System.exe
Token: SeDebugPrivilege	2432	System.exe
Token: SeDebugPrivilege	2688	System.exe
Token: SeDebugPrivilege	1984	System.exe
Token: SeDebugPrivilege	2948	System.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2580 wrote to memory of 2156	2580	JaffaCakes118_b191cef3bd06983c6f824a959cabcc1be823e7d2d4cd8e6ebe3278c1fb8cc8a1.exe	29
PID 2580 wrote to memory of 2156	2580	JaffaCakes118_b191cef3bd06983c6f824a959cabcc1be823e7d2d4cd8e6ebe3278c1fb8cc8a1.exe	29
PID 2580 wrote to memory of 2156	2580	JaffaCakes118_b191cef3bd06983c6f824a959cabcc1be823e7d2d4cd8e6ebe3278c1fb8cc8a1.exe	29
PID 2580 wrote to memory of 2156	2580	JaffaCakes118_b191cef3bd06983c6f824a959cabcc1be823e7d2d4cd8e6ebe3278c1fb8cc8a1.exe	29
PID 2156 wrote to memory of 2812	2156	WScript.exe	30
PID 2156 wrote to memory of 2812	2156	WScript.exe	30
PID 2156 wrote to memory of 2812	2156	WScript.exe	30
PID 2156 wrote to memory of 2812	2156	WScript.exe	30
PID 2812 wrote to memory of 2888	2812	cmd.exe	32
PID 2812 wrote to memory of 2888	2812	cmd.exe	32
PID 2812 wrote to memory of 2888	2812	cmd.exe	32
PID 2812 wrote to memory of 2888	2812	cmd.exe	32
PID 2888 wrote to memory of 2044	2888	DllCommonsvc.exe	43
PID 2888 wrote to memory of 2044	2888	DllCommonsvc.exe	43
PID 2888 wrote to memory of 2044	2888	DllCommonsvc.exe	43
PID 2888 wrote to memory of 1560	2888	DllCommonsvc.exe	44
PID 2888 wrote to memory of 1560	2888	DllCommonsvc.exe	44
PID 2888 wrote to memory of 1560	2888	DllCommonsvc.exe	44
PID 2888 wrote to memory of 2436	2888	DllCommonsvc.exe	46
PID 2888 wrote to memory of 2436	2888	DllCommonsvc.exe	46
PID 2888 wrote to memory of 2436	2888	DllCommonsvc.exe	46
PID 2888 wrote to memory of 2036	2888	DllCommonsvc.exe	47
PID 2888 wrote to memory of 2036	2888	DllCommonsvc.exe	47
PID 2888 wrote to memory of 2036	2888	DllCommonsvc.exe	47
PID 2888 wrote to memory of 2032	2888	DllCommonsvc.exe	51
PID 2888 wrote to memory of 2032	2888	DllCommonsvc.exe	51
PID 2888 wrote to memory of 2032	2888	DllCommonsvc.exe	51
PID 2032 wrote to memory of 3044	2032	cmd.exe	53
PID 2032 wrote to memory of 3044	2032	cmd.exe	53
PID 2032 wrote to memory of 3044	2032	cmd.exe	53
PID 2032 wrote to memory of 2364	2032	cmd.exe	54
PID 2032 wrote to memory of 2364	2032	cmd.exe	54
PID 2032 wrote to memory of 2364	2032	cmd.exe	54
PID 2364 wrote to memory of 2628	2364	System.exe	55
PID 2364 wrote to memory of 2628	2364	System.exe	55
PID 2364 wrote to memory of 2628	2364	System.exe	55
PID 2628 wrote to memory of 2960	2628	cmd.exe	57
PID 2628 wrote to memory of 2960	2628	cmd.exe	57
PID 2628 wrote to memory of 2960	2628	cmd.exe	57
PID 2628 wrote to memory of 264	2628	cmd.exe	58
PID 2628 wrote to memory of 264	2628	cmd.exe	58
PID 2628 wrote to memory of 264	2628	cmd.exe	58
PID 264 wrote to memory of 2664	264	System.exe	59
PID 264 wrote to memory of 2664	264	System.exe	59
PID 264 wrote to memory of 2664	264	System.exe	59
PID 2664 wrote to memory of 2100	2664	cmd.exe	61
PID 2664 wrote to memory of 2100	2664	cmd.exe	61
PID 2664 wrote to memory of 2100	2664	cmd.exe	61
PID 2664 wrote to memory of 1140	2664	cmd.exe	62
PID 2664 wrote to memory of 1140	2664	cmd.exe	62
PID 2664 wrote to memory of 1140	2664	cmd.exe	62
PID 1140 wrote to memory of 956	1140	System.exe	63
PID 1140 wrote to memory of 956	1140	System.exe	63
PID 1140 wrote to memory of 956	1140	System.exe	63
PID 956 wrote to memory of 2968	956	cmd.exe	65
PID 956 wrote to memory of 2968	956	cmd.exe	65
PID 956 wrote to memory of 2968	956	cmd.exe	65
PID 956 wrote to memory of 2448	956	cmd.exe	66
PID 956 wrote to memory of 2448	956	cmd.exe	66
PID 956 wrote to memory of 2448	956	cmd.exe	66
PID 2448 wrote to memory of 964	2448	System.exe	67
PID 2448 wrote to memory of 964	2448	System.exe	67
PID 2448 wrote to memory of 964	2448	System.exe	67
PID 964 wrote to memory of 1980	964	cmd.exe	69

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b191cef3bd06983c6f824a959cabcc1be823e7d2d4cd8e6ebe3278c1fb8cc8a1.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b191cef3bd06983c6f824a959cabcc1be823e7d2d4cd8e6ebe3278c1fb8cc8a1.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2580
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2156
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2812
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2888
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2044
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\System.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1560
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\WmiPrvSE.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2436
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\taskhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2036
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Xt53IWezav.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2032
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:3044
      - C:\providercommon\System.exe
        
        "C:\providercommon\System.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2364
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\yNYzWO1Iaj.bat"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:2628
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:2960
        
        C:\providercommon\System.exe
        
        "C:\providercommon\System.exe"
        8⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:264
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\IrGY9odMle.bat"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:2664
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:2100
        
        C:\providercommon\System.exe
        
        "C:\providercommon\System.exe"
        10⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1140
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\1e6qhBZ49x.bat"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:956
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:2968
        
        C:\providercommon\System.exe
        
        "C:\providercommon\System.exe"
        12⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2448
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\fg7ffKrc0I.bat"
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:964
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        14⤵
        
        PID:1980
        
        C:\providercommon\System.exe
        
        "C:\providercommon\System.exe"
        14⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1944
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\FEON83D8AI.bat"
        15⤵
        
        PID:2756
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        16⤵
        
        PID:2616
        
        C:\providercommon\System.exe
        
        "C:\providercommon\System.exe"
        16⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2432
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\wHaMzi6eYE.bat"
        17⤵
        
        PID:2204
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        18⤵
        
        PID:2116
        
        C:\providercommon\System.exe
        
        "C:\providercommon\System.exe"
        18⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2688
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\veDg5wW3gS.bat"
        19⤵
        
        PID:1760
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        20⤵
        
        PID:1956
        
        C:\providercommon\System.exe
        
        "C:\providercommon\System.exe"
        20⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1984
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\BmKXfVMxAz.bat"
        21⤵
        
        PID:2480
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        22⤵
        
        PID:2528
        
        C:\providercommon\System.exe
        
        "C:\providercommon\System.exe"
        22⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2948
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\WVE2eLfZN7.bat"
        23⤵
        
        PID:1324
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        24⤵
        
        PID:2064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 7 /tr "'C:\providercommon\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\providercommon\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 11 /tr "'C:\providercommon\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 6 /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 10 /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1168

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 13 /tr "'C:\providercommon\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\providercommon\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 6 /tr "'C:\providercommon\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ac087358d67b5186f059c1ca3412411a

SHA1
454ff708ed5721673033faf46c912ead9dda7ac7

SHA256
3de3b410ea4bc95f40faf4e53dc79a1d8c82a99df558b0d4babdb189c8522cf3

SHA512
5d20cb053535962b17396434d8f490209d5ec7847d8d9bbb325c6f13752883d2f764082dc4a3256940298701dc99292f25f49fc8d7ff173512813706a7b671b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4fcacb8200862fe58b44ed9b54d5250b

SHA1
c9a3844dbfd31e3823a6b81a011cbb89de9c9d4c

SHA256
708e1198507c21212050bb7f9d505c763e7ff8f081b2eadc9ef45440123eac4a

SHA512
c11b292a69741cdf46dff7e891a257fe962da4d241e9243210cf0bc59d12152bc4bb8510aac46a8a9e84f4809fc311925a53696e4e1b604585580e1e7f9c0631

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7340f1723635a5e5f260b43fd4ec6b43

SHA1
ed26363ff16cbbc6640f177ad20c0324fad27d00

SHA256
81bb1859b6103566c863f3c9a0faed90a3daf75731590793d6ca5dbdc9b5651e

SHA512
a1df9049d83b875edca5ab9e3cad6be30f69c3fb69b3263bd1b6f75c3145e560c9b6ae90860770e2a5bc7b65ff8739f45a42896d1e4c5ce7ef1605700d675374

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4af7d51dacfb97ecb518c0524a0d6410

SHA1
80aef2fd1e9cddde0550c86c7644d2a8c64e7c8a

SHA256
e8404af3b36cbfdd36503549746f803bd6c9514b5ab7079ed42ace9d1cfc1148

SHA512
591a63a1d43a569ba903b25ef1eeaa799fc519859487bee423b282d074f74912f11fc0dc6a6f47ab7cb9045dd33f71971d835614574d15d9d4bab6e98aa13bbd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2c42f9caec900c28afae4f11cd9f44eb

SHA1
685718c1826d01a293a9ff14c1efd986fda75fc1

SHA256
ec621ac7b28afd8f328486e0cb10ed48a7d2074eb3f2290f1c9adacb74daff36

SHA512
89bcc718edc603a75c9d3420ad0d8ca369f1f5ad7fc92e151b19c7205cdae4ead103fd3220f3bbdd39aa10e02a35001f3efc37f3d6497bf2c6d0498520d0ca4a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
052043e70e2e0c83ac410e6b91884294

SHA1
40b3db2bd176eb5692aa4eed51ad9dc93dddfb56

SHA256
dadecf10a4e9c039a25ddab60529343367801c5366c4a50cb229e0bcfbadf066

SHA512
95f481d39273bfac9e31977cf7ab5e58f0ede3e7d2a00cd428a931e5cd9b5fec6685cf015073b3e63f4b3ed373fe717f3376d4e5c0a4c2040a91395bcdddb579

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eca615f6ba586160f466090ac931aa70

SHA1
d31fccb176bef42e4444b9004e4a339beea661a3

SHA256
cd74df428d82bffb30f598e0cb4e757203ddeab7195fc7193039eeeb9037c49e

SHA512
39358bac9583ef0562a8d58e315b64f39c3003b6f70f31a7514bb950617d8cb7c9379ce8dd34f60d928696f89926ca949ddacd97a43dc2e07fd81116e66903d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c728762b8fecf54e2591b37f4b03fd2f

SHA1
abd6f67d04d320cf98b22d727c444df252a47662

SHA256
cbf0e89a1efa2d6599a86924a1d751974362ed9a1fe51314ed302942b2eb3531

SHA512
06f66f1a48aeec83597b2bbeaa681ab33f5e6c9ba3bca3dc2ec2dbec720ddd7d5bd1614b110b17ba1eb3621f22c57950553233ba60b844461fe4c912065acf3d

Download Submit
C:\Users\Admin\AppData\Local\Temp\1e6qhBZ49x.bat

Filesize
193B

MD5
2ee7deac733473579908635434e728ad

SHA1
ac0d74265d00dee48b9b8b2020206775c70d56c2

SHA256
2babe7aa65484da56029214a6262c2dfde58fd50d655c983fdbd0e486728a1d2

SHA512
641d5a6838ba6f87bf67ae975dd6b7b111c0547ca6dcbf71cce180e10a2ef6ac2a9dabf004bdfdd696f068fefa27ab84c57ed4b3711acdfc8c97c2d11e84ab9e

Download Submit
C:\Users\Admin\AppData\Local\Temp\BmKXfVMxAz.bat

Filesize
193B

MD5
3e6f85be3635776f586e4426acc56d33

SHA1
e0561489ec47f9a3af59b1dd57150a3923fd51eb

SHA256
f86659f5cc27b3e15a976246569035ac9eff1cc8d36aa1085318c681d901aeff

SHA512
086665fc7a18fcb8b1e467247e452243a421c5088f339690bfd4ee36529bd94c9f3868399fbbecc583f2a1056156cbf22f9a31922f706894fe747245405f8d69

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE2E2.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\FEON83D8AI.bat

Filesize
193B

MD5
6cf3536aa7c31f04bd30152b083f776a

SHA1
2faa8f6a61c25c8f83894f230d52845687382ed7

SHA256
d1a7ac438192844c406498e7c64fd6219876f7ca0e9789f3a923c9d74a9355d8

SHA512
361d7cd62ee6dd9a5174b2cbb251ab0ec9c873a8bd368c63f59cbf9680173a1d52818ea42ca695df7a1988a8c0e77fb5e71ee0ae954db8133437369a878c7cf8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IrGY9odMle.bat

Filesize
193B

MD5
3e29eae0c95c472d36c417d82ce2441d

SHA1
51a89628c5370cacb509288c3bd04820eac82449

SHA256
e24af0951020bef22ff5eeb06c540f953acfcf634801ff427a90dfdd86bd279d

SHA512
27c57bcdf7bf816410b7fddf3acdeb96348c33d70b50eb536b656992c63962238760b9e9a3458f73073871326fb31c6b1abc3b294ff9dd3dc7894806c1b132f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE371.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\WVE2eLfZN7.bat

Filesize
193B

MD5
e5790fdbb1c1901de184c74a3893c45f

SHA1
14ca572eaffbe9a78def7f8b9f6b9e3dcf324125

SHA256
e06e157a8c5f32bbcd0471d0597ebd80afa89b03da941cb1805132923012ad88

SHA512
7fef2a28bafb78b3ff8622265f9431e32214b95c8547cb6753e42087c61c0eccb946df0c5efc8f0932aa00e8166e5a3b170b7aa25f27c3c497d09b084072cb1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Xt53IWezav.bat

Filesize
193B

MD5
b067d57fcaf21b7787a8b4d92c088464

SHA1
be27ce48b1482d9bc9496302d792657f03d57bf9

SHA256
44613a17711e5c240aad79af78fa2464742a4065f214df874e94d4081215f005

SHA512
3dca8bdfe284c8c7e94c63063928a39f53a7d1448ea85bd2cac3a1d008e5341a515cc3a80b011e9b5651b7fdb734220ad0b92264436d3c8eb101ce307315aa94

Download Submit
C:\Users\Admin\AppData\Local\Temp\fg7ffKrc0I.bat

Filesize
193B

MD5
9a0fc9e3ba3755aaf4ea7f72e37c03c7

SHA1
51eb77da405bdc701fd66763d02754674fa6f9ae

SHA256
a86e5458247cbff0b354dcf41d838f7370e30025a31a301b9d660d29f9b1f1c6

SHA512
ac575614e0399354a0830411245db84be8ccfd4a896a96e6ad819c3eba37428f8962683e80974cc56e74dc3fd053c25394e77f280c2a681a6fe2ef5388e6b1e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\veDg5wW3gS.bat

Filesize
193B

MD5
cd8f432c443299dd4c51b9075eaf28c4

SHA1
b00a3f2e610e9ffc7b88404d7d9f50d53c0bd406

SHA256
193f6a25a9cae3e1e80441bb1b68d37eb145b18294768136ae95e0ffd7c59575

SHA512
24b4254a5df9cd20c80a8148882b1dd82d4c4fbcde6a2f33946c97cfaa7f34d8dea4ace20bf39cd8162fd58340b38fe202fe95d35b504e88a78e55f8cf2beb24

Download Submit
C:\Users\Admin\AppData\Local\Temp\wHaMzi6eYE.bat

Filesize
193B

MD5
193d558692bba0bdcb0ccb668527cc56

SHA1
1c7d6ec30a279e8d89b02b6dd35de9308d884c9a

SHA256
6285d2c16e97023f967839b7285e3a2347a0a1cf77661315b2f1f90b991e60d0

SHA512
6f33c2fcdf7b1779902d3c3b5035ddf955e4f11e17bf68743da681420e4a9cd2415a2b5edd2203778884639bfb9c1cb377a1912d16db044f03262a83a1b83042

Download Submit
C:\Users\Admin\AppData\Local\Temp\yNYzWO1Iaj.bat

Filesize
193B

MD5
4581c657e8b1b84c588387a0fb9922b5

SHA1
efbcc57b0c874c32857d5238274190e1a0b86497

SHA256
520db66174ca356641b013b1230c5547d6bc71c5ef7a8f8642b5f6702480f6f7

SHA512
3ee11f39313ad71727ea32e55bace10fea8392d978ad64adb4724a824c4ea5338dcc70a2bc2ae567f12c464f774ee3172a69c8bca58784a11d96dbf83f321dca

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
f42644b4e6a26d0b446c2d76a7b789bd

SHA1
45b58d1bef92092a35a6e29f0907d4cc35b21fc3

SHA256
2de96c24cc6b40a4c3383f5ce79dcd34c38228ca526fb3f3233ce444f652a2d3

SHA512
31b895e22329446aa67dbe2303994c29744426961c0869361dd3d420edb0dd332e2516d9e6e876134970dc0c48e1fb224f95bc698b27b0cb756b63cc4940111d

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/264-112-0x00000000010A0000-0x00000000011B0000-memory.dmp

Filesize
1.1MB

Download
memory/1560-48-0x0000000002310000-0x0000000002318000-memory.dmp

Filesize
32KB

Download
memory/1944-290-0x0000000000310000-0x0000000000420000-memory.dmp

Filesize
1.1MB

Download
memory/2364-53-0x00000000003E0000-0x00000000003F2000-memory.dmp

Filesize
72KB

Download
memory/2364-52-0x0000000000070000-0x0000000000180000-memory.dmp

Filesize
1.1MB

Download
memory/2432-350-0x0000000000800000-0x0000000000910000-memory.dmp

Filesize
1.1MB

Download
memory/2436-47-0x000000001B2F0000-0x000000001B5D2000-memory.dmp

Filesize
2.9MB

Download
memory/2688-411-0x0000000000A30000-0x0000000000A42000-memory.dmp

Filesize
72KB

Download
memory/2688-410-0x0000000000A40000-0x0000000000B50000-memory.dmp

Filesize
1.1MB

Download
memory/2888-17-0x00000000004E0000-0x00000000004EC000-memory.dmp

Filesize
48KB

Download
memory/2888-16-0x00000000004D0000-0x00000000004DC000-memory.dmp

Filesize
48KB

Download
memory/2888-15-0x00000000004C0000-0x00000000004CC000-memory.dmp

Filesize
48KB

Download
memory/2888-14-0x00000000004B0000-0x00000000004C2000-memory.dmp

Filesize
72KB

Download
memory/2888-13-0x00000000009B0000-0x0000000000AC0000-memory.dmp

Filesize
1.1MB

Download
memory/2948-530-0x0000000000220000-0x0000000000330000-memory.dmp

Filesize
1.1MB

Download