Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-12-2024 04:31
Behavioral task
behavioral1
Sample
JaffaCakes118_ade858b8762b27a765373c956b238f83be288c5c7ce63f0e01e55e71a5e0fb1e.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
JaffaCakes118_ade858b8762b27a765373c956b238f83be288c5c7ce63f0e01e55e71a5e0fb1e.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_ade858b8762b27a765373c956b238f83be288c5c7ce63f0e01e55e71a5e0fb1e.exe
-
Size
1.3MB
-
MD5
f11424d834a1b9d294edd3956dcc039d
-
SHA1
5e615e6d197a81aba95f64c4bf6752f0299f8106
-
SHA256
ade858b8762b27a765373c956b238f83be288c5c7ce63f0e01e55e71a5e0fb1e
-
SHA512
d0871d44a677d164d387d1695b866b4035c66d6a30202cd4772c2081e2f8135f78397a2febb2b817f72fcf76fd4c8fd446c5b8333d5cc983dddd4788f7a531b7
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Process spawned unexpected child process 15 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 116 1964 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4008 1964 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2280 1964 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2188 1964 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2872 1964 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4760 1964 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3836 1964 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5060 1964 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5028 1964 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1216 1964 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3568 1964 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3092 1964 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1728 1964 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3068 1964 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3640 1964 schtasks.exe 88 -
resource yara_rule behavioral2/files/0x0007000000023cb4-10.dat dcrat behavioral2/memory/5112-13-0x00000000007A0000-0x00000000008B0000-memory.dmp dcrat -
Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 1948 powershell.exe 2420 powershell.exe 3372 powershell.exe 3112 powershell.exe 220 powershell.exe 4300 powershell.exe -
Checks computer location settings 2 TTPs 16 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation services.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation services.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation services.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation services.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation services.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation services.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation services.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation services.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation JaffaCakes118_ade858b8762b27a765373c956b238f83be288c5c7ce63f0e01e55e71a5e0fb1e.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation DllCommonsvc.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation services.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation services.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation services.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation services.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation services.exe -
Executes dropped EXE 14 IoCs
pid Process 5112 DllCommonsvc.exe 1916 services.exe 1920 services.exe 1404 services.exe 2380 services.exe 4408 services.exe 1648 services.exe 2800 services.exe 3948 services.exe 4316 services.exe 2280 services.exe 2812 services.exe 2652 services.exe 4680 services.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 14 IoCs
flow ioc 17 raw.githubusercontent.com 39 raw.githubusercontent.com 56 raw.githubusercontent.com 53 raw.githubusercontent.com 55 raw.githubusercontent.com 18 raw.githubusercontent.com 40 raw.githubusercontent.com 41 raw.githubusercontent.com 44 raw.githubusercontent.com 52 raw.githubusercontent.com 25 raw.githubusercontent.com 45 raw.githubusercontent.com 54 raw.githubusercontent.com 57 raw.githubusercontent.com -
Drops file in Program Files directory 4 IoCs
description ioc Process File created C:\Program Files (x86)\Windows Media Player\ja-JP\smss.exe DllCommonsvc.exe File created C:\Program Files (x86)\Windows Media Player\ja-JP\69ddcba757bf72 DllCommonsvc.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\OfficeClickToRun.exe DllCommonsvc.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\e6c9b481da804f DllCommonsvc.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\L2Schemas\services.exe DllCommonsvc.exe File created C:\Windows\L2Schemas\c5b4cb5e9653cc DllCommonsvc.exe File created C:\Windows\ShellComponents\RuntimeBroker.exe DllCommonsvc.exe File created C:\Windows\ShellComponents\9e8d7a4ca61bd9 DllCommonsvc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_ade858b8762b27a765373c956b238f83be288c5c7ce63f0e01e55e71a5e0fb1e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies registry class 14 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings services.exe Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings services.exe Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings services.exe Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings services.exe Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings services.exe Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings services.exe Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings services.exe Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings JaffaCakes118_ade858b8762b27a765373c956b238f83be288c5c7ce63f0e01e55e71a5e0fb1e.exe Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings services.exe Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings services.exe Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings services.exe Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings services.exe Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings services.exe Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings services.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 15 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3836 schtasks.exe 116 schtasks.exe 4760 schtasks.exe 5028 schtasks.exe 3568 schtasks.exe 3092 schtasks.exe 5060 schtasks.exe 1216 schtasks.exe 1728 schtasks.exe 3068 schtasks.exe 3640 schtasks.exe 4008 schtasks.exe 2280 schtasks.exe 2188 schtasks.exe 2872 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 26 IoCs
pid Process 5112 DllCommonsvc.exe 2420 powershell.exe 3372 powershell.exe 220 powershell.exe 4300 powershell.exe 3112 powershell.exe 1948 powershell.exe 3112 powershell.exe 220 powershell.exe 3372 powershell.exe 1916 services.exe 2420 powershell.exe 4300 powershell.exe 1948 powershell.exe 1920 services.exe 1404 services.exe 2380 services.exe 4408 services.exe 1648 services.exe 2800 services.exe 3948 services.exe 4316 services.exe 2280 services.exe 2812 services.exe 2652 services.exe 4680 services.exe -
Suspicious use of AdjustPrivilegeToken 20 IoCs
description pid Process Token: SeDebugPrivilege 5112 DllCommonsvc.exe Token: SeDebugPrivilege 2420 powershell.exe Token: SeDebugPrivilege 3372 powershell.exe Token: SeDebugPrivilege 220 powershell.exe Token: SeDebugPrivilege 4300 powershell.exe Token: SeDebugPrivilege 3112 powershell.exe Token: SeDebugPrivilege 1948 powershell.exe Token: SeDebugPrivilege 1916 services.exe Token: SeDebugPrivilege 1920 services.exe Token: SeDebugPrivilege 1404 services.exe Token: SeDebugPrivilege 2380 services.exe Token: SeDebugPrivilege 4408 services.exe Token: SeDebugPrivilege 1648 services.exe Token: SeDebugPrivilege 2800 services.exe Token: SeDebugPrivilege 3948 services.exe Token: SeDebugPrivilege 4316 services.exe Token: SeDebugPrivilege 2280 services.exe Token: SeDebugPrivilege 2812 services.exe Token: SeDebugPrivilege 2652 services.exe Token: SeDebugPrivilege 4680 services.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4692 wrote to memory of 3612 4692 JaffaCakes118_ade858b8762b27a765373c956b238f83be288c5c7ce63f0e01e55e71a5e0fb1e.exe 83 PID 4692 wrote to memory of 3612 4692 JaffaCakes118_ade858b8762b27a765373c956b238f83be288c5c7ce63f0e01e55e71a5e0fb1e.exe 83 PID 4692 wrote to memory of 3612 4692 JaffaCakes118_ade858b8762b27a765373c956b238f83be288c5c7ce63f0e01e55e71a5e0fb1e.exe 83 PID 3612 wrote to memory of 2904 3612 WScript.exe 85 PID 3612 wrote to memory of 2904 3612 WScript.exe 85 PID 3612 wrote to memory of 2904 3612 WScript.exe 85 PID 2904 wrote to memory of 5112 2904 cmd.exe 87 PID 2904 wrote to memory of 5112 2904 cmd.exe 87 PID 5112 wrote to memory of 3372 5112 DllCommonsvc.exe 105 PID 5112 wrote to memory of 3372 5112 DllCommonsvc.exe 105 PID 5112 wrote to memory of 3112 5112 DllCommonsvc.exe 106 PID 5112 wrote to memory of 3112 5112 DllCommonsvc.exe 106 PID 5112 wrote to memory of 220 5112 DllCommonsvc.exe 107 PID 5112 wrote to memory of 220 5112 DllCommonsvc.exe 107 PID 5112 wrote to memory of 4300 5112 DllCommonsvc.exe 108 PID 5112 wrote to memory of 4300 5112 DllCommonsvc.exe 108 PID 5112 wrote to memory of 1948 5112 DllCommonsvc.exe 109 PID 5112 wrote to memory of 1948 5112 DllCommonsvc.exe 109 PID 5112 wrote to memory of 2420 5112 DllCommonsvc.exe 110 PID 5112 wrote to memory of 2420 5112 DllCommonsvc.exe 110 PID 5112 wrote to memory of 1916 5112 DllCommonsvc.exe 117 PID 5112 wrote to memory of 1916 5112 DllCommonsvc.exe 117 PID 1916 wrote to memory of 4696 1916 services.exe 126 PID 1916 wrote to memory of 4696 1916 services.exe 126 PID 4696 wrote to memory of 5060 4696 cmd.exe 128 PID 4696 wrote to memory of 5060 4696 cmd.exe 128 PID 4696 wrote to memory of 1920 4696 cmd.exe 134 PID 4696 wrote to memory of 1920 4696 cmd.exe 134 PID 1920 wrote to memory of 804 1920 services.exe 136 PID 1920 wrote to memory of 804 1920 services.exe 136 PID 804 wrote to memory of 2160 804 cmd.exe 138 PID 804 wrote to memory of 2160 804 cmd.exe 138 PID 804 wrote to memory of 1404 804 cmd.exe 143 PID 804 wrote to memory of 1404 804 cmd.exe 143 PID 1404 wrote to memory of 760 1404 services.exe 145 PID 1404 wrote to memory of 760 1404 services.exe 145 PID 760 wrote to memory of 5012 760 cmd.exe 147 PID 760 wrote to memory of 5012 760 cmd.exe 147 PID 760 wrote to memory of 2380 760 cmd.exe 149 PID 760 wrote to memory of 2380 760 cmd.exe 149 PID 2380 wrote to memory of 4976 2380 services.exe 151 PID 2380 wrote to memory of 4976 2380 services.exe 151 PID 4976 wrote to memory of 3516 4976 cmd.exe 153 PID 4976 wrote to memory of 3516 4976 cmd.exe 153 PID 4976 wrote to memory of 4408 4976 cmd.exe 155 PID 4976 wrote to memory of 4408 4976 cmd.exe 155 PID 4408 wrote to memory of 2812 4408 services.exe 157 PID 4408 wrote to memory of 2812 4408 services.exe 157 PID 2812 wrote to memory of 4032 2812 cmd.exe 159 PID 2812 wrote to memory of 4032 2812 cmd.exe 159 PID 2812 wrote to memory of 1648 2812 cmd.exe 161 PID 2812 wrote to memory of 1648 2812 cmd.exe 161 PID 1648 wrote to memory of 4824 1648 services.exe 163 PID 1648 wrote to memory of 4824 1648 services.exe 163 PID 4824 wrote to memory of 2108 4824 cmd.exe 165 PID 4824 wrote to memory of 2108 4824 cmd.exe 165 PID 4824 wrote to memory of 2800 4824 cmd.exe 167 PID 4824 wrote to memory of 2800 4824 cmd.exe 167 PID 2800 wrote to memory of 5092 2800 services.exe 169 PID 2800 wrote to memory of 5092 2800 services.exe 169 PID 5092 wrote to memory of 4856 5092 cmd.exe 171 PID 5092 wrote to memory of 4856 5092 cmd.exe 171 PID 5092 wrote to memory of 3948 5092 cmd.exe 173 PID 5092 wrote to memory of 3948 5092 cmd.exe 173 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ade858b8762b27a765373c956b238f83be288c5c7ce63f0e01e55e71a5e0fb1e.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ade858b8762b27a765373c956b238f83be288c5c7ce63f0e01e55e71a5e0fb1e.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\providercommon\DllCommonsvc.exe"C:\providercommon\DllCommonsvc.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3372
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\spoolsv.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3112
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\L2Schemas\services.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:220
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\ShellComponents\RuntimeBroker.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4300
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\OfficeClickToRun.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1948
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Media Player\ja-JP\smss.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2420
-
-
C:\Windows\L2Schemas\services.exe"C:\Windows\L2Schemas\services.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\peQnm3nkJb.bat"6⤵
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:27⤵PID:5060
-
-
C:\Windows\L2Schemas\services.exe"C:\Windows\L2Schemas\services.exe"7⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\6M87tNVNy8.bat"8⤵
- Suspicious use of WriteProcessMemory
PID:804 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:29⤵PID:2160
-
-
C:\Windows\L2Schemas\services.exe"C:\Windows\L2Schemas\services.exe"9⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1404 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\5bc4V3lt5Q.bat"10⤵
- Suspicious use of WriteProcessMemory
PID:760 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:211⤵PID:5012
-
-
C:\Windows\L2Schemas\services.exe"C:\Windows\L2Schemas\services.exe"11⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\vad0LeRbBz.bat"12⤵
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:213⤵PID:3516
-
-
C:\Windows\L2Schemas\services.exe"C:\Windows\L2Schemas\services.exe"13⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\kbrh69MYEy.bat"14⤵
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:215⤵PID:4032
-
-
C:\Windows\L2Schemas\services.exe"C:\Windows\L2Schemas\services.exe"15⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\rjauxUKpXQ.bat"16⤵
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:217⤵PID:2108
-
-
C:\Windows\L2Schemas\services.exe"C:\Windows\L2Schemas\services.exe"17⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\H7eFR6a9mI.bat"18⤵
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:219⤵PID:4856
-
-
C:\Windows\L2Schemas\services.exe"C:\Windows\L2Schemas\services.exe"19⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3948 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\raSqT8qddO.bat"20⤵PID:2560
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:221⤵PID:1904
-
-
C:\Windows\L2Schemas\services.exe"C:\Windows\L2Schemas\services.exe"21⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4316 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\CPhDZIwY3l.bat"22⤵PID:1056
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:223⤵PID:3028
-
-
C:\Windows\L2Schemas\services.exe"C:\Windows\L2Schemas\services.exe"23⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2280 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\V9nTU0UPEK.bat"24⤵PID:5028
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:225⤵PID:3068
-
-
C:\Windows\L2Schemas\services.exe"C:\Windows\L2Schemas\services.exe"25⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2812 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\tebxeZNirC.bat"26⤵PID:540
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:227⤵PID:5084
-
-
C:\Windows\L2Schemas\services.exe"C:\Windows\L2Schemas\services.exe"27⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2652 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\goxiuQmrpE.bat"28⤵PID:5008
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:229⤵PID:2800
-
-
C:\Windows\L2Schemas\services.exe"C:\Windows\L2Schemas\services.exe"29⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4680 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\tebxeZNirC.bat"30⤵PID:2352
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:231⤵PID:1964
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 11 /tr "'C:\providercommon\spoolsv.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:116
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\providercommon\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4008
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 7 /tr "'C:\providercommon\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2280
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 5 /tr "'C:\Windows\L2Schemas\services.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2188
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Windows\L2Schemas\services.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2872
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 10 /tr "'C:\Windows\L2Schemas\services.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4760
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Windows\ShellComponents\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3836
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\ShellComponents\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5060
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Windows\ShellComponents\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5028
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\OfficeClickToRun.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1216
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\OfficeClickToRun.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3568
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\OfficeClickToRun.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3092
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Media Player\ja-JP\smss.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1728
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\ja-JP\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3068
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Media Player\ja-JP\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3640
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
1KB
MD5baf55b95da4a601229647f25dad12878
SHA1abc16954ebfd213733c4493fc1910164d825cac8
SHA256ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
SHA51224f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545
-
Filesize
944B
MD5d28a889fd956d5cb3accfbaf1143eb6f
SHA1157ba54b365341f8ff06707d996b3635da8446f7
SHA25621e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45
SHA5120b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c
-
Filesize
944B
MD56d42b6da621e8df5674e26b799c8e2aa
SHA1ab3ce1327ea1eeedb987ec823d5e0cb146bafa48
SHA2565ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c
SHA51253faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29
-
Filesize
944B
MD577d622bb1a5b250869a3238b9bc1402b
SHA1d47f4003c2554b9dfc4c16f22460b331886b191b
SHA256f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb
SHA512d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9
-
Filesize
944B
MD5cadef9abd087803c630df65264a6c81c
SHA1babbf3636c347c8727c35f3eef2ee643dbcc4bd2
SHA256cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438
SHA5127278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085
-
Filesize
198B
MD53be58b6d671f59db5dd1b97923bade26
SHA12c29548f0788f5c4b0da040d75d9cabff9c0dcdb
SHA256a947f12210a522e6ed325b12b41afdba8c66f9c009b056abe3fb7c31073b996c
SHA512641c360a73e0d1a219f189023dd687d87d7853c54540274a4ea6d6d35d5db347c14813d49f21c2d2cb347927eccb0fde0b15c0003602972c59304f15d406a7cc
-
Filesize
198B
MD56b7d9dc88bf096795e959abeb917b111
SHA145f5fe7c42cf9bdb52bf2488ddf2f3906bf04fa6
SHA256856b8687b5246ffd764f74e4fcc5a1d0d8bc997ec818d9d349c3ba697cf51505
SHA512f8bb2129bc8020c9ef3a93b8674396e82130609d73492cf627c825b4534e9b648aabd026db12e78d7c013da659e5cc05cea9c3dc4de4a706ca65c139908fb6e3
-
Filesize
198B
MD5ba8ee4482d31853e0456ba683f6b5a8e
SHA123f5b4dab96085c1114542e0c9cd1009b9c5bba7
SHA256525a837c01a9acd9c207eff1045b71b4a91ccb50a5aaf3dd69d1eebd17e86e71
SHA512e14fae3863bd9b48ce71a721745989adbbb46be7aa0872f70d565d06c2bee348e08eb4217969f67410796ff22b35d3c50372ab1ded7641abe2fa98f1ffc50498
-
Filesize
198B
MD567fa44d688ecfe0a0baa644d522c15fb
SHA1eadb10296a55aeb243a40c829ca0054f1f53e897
SHA25626238fdd6de0462defbfa47861a821cbff2c1d8231597159962bfc8ef3762912
SHA5123a83122c4b8b439bfb4864f89f3993078f0afc8a6708e5a405b894fb7f39c5ca2e5cf212be6676ac76060f94e07433aab3b72ff806f082b5fbdb74d792cf1240
-
Filesize
198B
MD5168f8fbd74071cb24a44abedf8165c10
SHA13139736b4da3f6af752c7b5f89c020c8914919fa
SHA256c63867f6bdc8d81a7be23ff8f5b666d5c58742aa75fc8829ae24b228ec690e42
SHA512f7a6b5c55a51d6dd11786e51c999224d44b509a1bf0b9c937e4d652d056deb704a6c1eaddc6358a67dca9b07d67941504c706576aa47a3075db541a17f0159d1
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
198B
MD56667f920abf108e17b4ac90d60f3ae9b
SHA13679343af18df042abe5a6e9c1079d6d3e353955
SHA256f343bff900a9fa8372ca1a9c00308d855f446b657ddf963bec3cd1fe0b7ab0cf
SHA5125ef6de742d5f26199e1a9d7d87f9c770a024a9296f3147514343fb4eec720f44da99106d3c393915a7ed98828d244cb8f0a8799484e97db1f006bd3088bab332
-
Filesize
198B
MD5c41a20a24351e2b7cab0a30dcf08d2de
SHA13d74d1e302a37945b26b89c78075b8a2dc9a5fe3
SHA256044ca9f452833a714265d095796599e1724477e38598b147a0985bed7b50732f
SHA512e28de349391715af902fcc60a7a421c6593c9f7d82b1fbbe0a387d14f2d31595c661ef9155eb429306b23971351b7db0e5021c69f2c0bcd6558e5cdd174282f0
-
Filesize
198B
MD529d1bb2603a1285c512ff9c4a19d985a
SHA1890b208b3c6a959231eefd33551ebe532e6bb8eb
SHA256cfcb09a80d498a6f30d3e8f9cb89f38ca2e2615070bea1a6cd3cdae1faddec4d
SHA51258290d0aadcffc039bad8d26f4f1d37de61922a2b4afddbfc939b2820b240389d0c919d63eff279ea41dd439c810d130d0326b61f6c54e245ca864354e86f3da
-
Filesize
198B
MD5e58abfd3626aff6b96410ce9e109d37a
SHA1edd79d342f0df852595f9724f309cb0db0de7359
SHA2566e486d3cb6062a4328916d0fa16c8eedde76adc86c84489059d1043fd2817eae
SHA51241461e03aaa5575ebef92240495397b32a8264be91df8c3774501a257abb4b222f040917cb8847b42996a81bfe1dd67ee2ad079262b705384ceb0f48d32abf2d
-
Filesize
198B
MD5e27bfe4288b94184efe27d69521a443e
SHA1419ffaff8d44e7119e7d8678346275c290bbf290
SHA256aed52d34e6e46e2f0401d0af44dac5ff43b400125f24abdf40b4fe1b63e972fb
SHA51275075eca757d0aa0f1ac63961c3848cd52d5053c9804ccf5b681c2c3acd2078d385f17fe45d18eb6cb6595d4542a37bcb463bc2544cd3292c94e5fd8ce312958
-
Filesize
198B
MD59bad6f580cd68d579b9156727d86070e
SHA1ff8747130c8cdf0ffe2973680cbe0978fb786814
SHA256d637897f6c30f97d433904a9474b81597b933cdc77fd4d27a0a546bcfa838b66
SHA51210d941374535fd12cd73382428d46137bd2ea6aea087fed23e6b4f14f8c2a52eb55cfa175f148203d36f9b06696833e15f525aeb64e50bcf9afe54a23ece292c
-
Filesize
198B
MD58a2adee9f96e1cded3cdcbafd63c52b5
SHA1a553959513cbdf32dc05e87aef4b13163fd18d8e
SHA2564e7b8583f2248b10875d636b60036d98082246d49f9c69e7c543e6a5d30f5328
SHA51220794a06923218d9e0f505ece72957206d5ad4b4fff3d688a8372db03357cdc361679c699e1f4fb387c47d72f6cee006c63f95427e63b93498646da45f50cf08
-
Filesize
36B
MD56783c3ee07c7d151ceac57f1f9c8bed7
SHA117468f98f95bf504cc1f83c49e49a78526b3ea03
SHA2568ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322
SHA512c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8
-
Filesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
Filesize
197B
MD58088241160261560a02c84025d107592
SHA1083121f7027557570994c9fc211df61730455bb5
SHA2562072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1
SHA51220d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478