dcrat | 8f3858dd23d96aa9f530f615bdf230fa5fee84c56f6659fc2f7f01f71608a2c6

Analysis

max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2024 04:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_8f3858dd23d96aa9f530f615bdf230fa5fee84c56f6659fc2f7f01f71608a2c6.exe
Size

1.3MB
MD5

0d46ca4f4ff0928de5a5eb6b802c60d6
SHA1

b3908c0f08727eb7ad9052912d10c54f8da8575f
SHA256

8f3858dd23d96aa9f530f615bdf230fa5fee84c56f6659fc2f7f01f71608a2c6
SHA512

d7d6be0feaa9752dbce1c14422c73ac9e7b7ec51f6794e877e3c375aefcd29251b772be7ca4c4e9edb2e15c1baf67483175ae9cc18175ddc10bfcabfa2448912
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 9 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	220	1436	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	980	1436	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3320	1436	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4492	1436	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4244	1436	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1948	1436	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5084	1436	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	368	1436	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2224	1436	schtasks.exe	88

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x0007000000023c81-10.dat	dcrat
behavioral2/memory/540-13-0x0000000000460000-0x0000000000570000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1992	powershell.exe
3480	powershell.exe
3840	powershell.exe
3104	powershell.exe

Checks computer location settings 2 TTPs 15 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	JaffaCakes118_8f3858dd23d96aa9f530f615bdf230fa5fee84c56f6659fc2f7f01f71608a2c6.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	dllhost.exe

Executes dropped EXE 14 IoCs

pid	Process
540	DllCommonsvc.exe
3852	dllhost.exe
1084	dllhost.exe
4480	dllhost.exe
1244	dllhost.exe
4912	dllhost.exe
5008	dllhost.exe
2876	dllhost.exe
4344	dllhost.exe
4964	dllhost.exe
1840	dllhost.exe
4720	dllhost.exe
928	dllhost.exe
1428	dllhost.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 13 IoCs

Web Service

T1102

flow	ioc
21	raw.githubusercontent.com
22	raw.githubusercontent.com
38	raw.githubusercontent.com
39	raw.githubusercontent.com
40	raw.githubusercontent.com
45	raw.githubusercontent.com
53	raw.githubusercontent.com
54	raw.githubusercontent.com
55	raw.githubusercontent.com
24	raw.githubusercontent.com
44	raw.githubusercontent.com
48	raw.githubusercontent.com
56	raw.githubusercontent.com

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_2019.19071.19011.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\RuntimeBroker.exe	DllCommonsvc.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\addins\csrss.exe	DllCommonsvc.exe
File created	C:\Windows\addins\886983d96e3d3e	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_8f3858dd23d96aa9f530f615bdf230fa5fee84c56f6659fc2f7f01f71608a2c6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 14 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	JaffaCakes118_8f3858dd23d96aa9f530f615bdf230fa5fee84c56f6659fc2f7f01f71608a2c6.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	dllhost.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 9 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
980	schtasks.exe
4244	schtasks.exe
5084	schtasks.exe
220	schtasks.exe
4492	schtasks.exe
1948	schtasks.exe
368	schtasks.exe
2224	schtasks.exe
3320	schtasks.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
540	DllCommonsvc.exe
3480	powershell.exe
3104	powershell.exe
3840	powershell.exe
1992	powershell.exe
3480	powershell.exe
3840	powershell.exe
1992	powershell.exe
3104	powershell.exe
3852	dllhost.exe
1084	dllhost.exe
4480	dllhost.exe
1244	dllhost.exe
4912	dllhost.exe
5008	dllhost.exe
2876	dllhost.exe
4344	dllhost.exe
4964	dllhost.exe
1840	dllhost.exe
4720	dllhost.exe
928	dllhost.exe
1428	dllhost.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeDebugPrivilege	540	DllCommonsvc.exe
Token: SeDebugPrivilege	3480	powershell.exe
Token: SeDebugPrivilege	3104	powershell.exe
Token: SeDebugPrivilege	3840	powershell.exe
Token: SeDebugPrivilege	1992	powershell.exe
Token: SeDebugPrivilege	3852	dllhost.exe
Token: SeDebugPrivilege	1084	dllhost.exe
Token: SeDebugPrivilege	4480	dllhost.exe
Token: SeDebugPrivilege	1244	dllhost.exe
Token: SeDebugPrivilege	4912	dllhost.exe
Token: SeDebugPrivilege	5008	dllhost.exe
Token: SeDebugPrivilege	2876	dllhost.exe
Token: SeDebugPrivilege	4344	dllhost.exe
Token: SeDebugPrivilege	4964	dllhost.exe
Token: SeDebugPrivilege	1840	dllhost.exe
Token: SeDebugPrivilege	4720	dllhost.exe
Token: SeDebugPrivilege	928	dllhost.exe
Token: SeDebugPrivilege	1428	dllhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1532 wrote to memory of 2272	1532	JaffaCakes118_8f3858dd23d96aa9f530f615bdf230fa5fee84c56f6659fc2f7f01f71608a2c6.exe	83
PID 1532 wrote to memory of 2272	1532	JaffaCakes118_8f3858dd23d96aa9f530f615bdf230fa5fee84c56f6659fc2f7f01f71608a2c6.exe	83
PID 1532 wrote to memory of 2272	1532	JaffaCakes118_8f3858dd23d96aa9f530f615bdf230fa5fee84c56f6659fc2f7f01f71608a2c6.exe	83
PID 2272 wrote to memory of 2184	2272	WScript.exe	85
PID 2272 wrote to memory of 2184	2272	WScript.exe	85
PID 2272 wrote to memory of 2184	2272	WScript.exe	85
PID 2184 wrote to memory of 540	2184	cmd.exe	87
PID 2184 wrote to memory of 540	2184	cmd.exe	87
PID 540 wrote to memory of 1992	540	DllCommonsvc.exe	99
PID 540 wrote to memory of 1992	540	DllCommonsvc.exe	99
PID 540 wrote to memory of 3480	540	DllCommonsvc.exe	100
PID 540 wrote to memory of 3480	540	DllCommonsvc.exe	100
PID 540 wrote to memory of 3840	540	DllCommonsvc.exe	101
PID 540 wrote to memory of 3840	540	DllCommonsvc.exe	101
PID 540 wrote to memory of 3104	540	DllCommonsvc.exe	102
PID 540 wrote to memory of 3104	540	DllCommonsvc.exe	102
PID 540 wrote to memory of 2772	540	DllCommonsvc.exe	107
PID 540 wrote to memory of 2772	540	DllCommonsvc.exe	107
PID 2772 wrote to memory of 1612	2772	cmd.exe	109
PID 2772 wrote to memory of 1612	2772	cmd.exe	109
PID 2772 wrote to memory of 3852	2772	cmd.exe	118
PID 2772 wrote to memory of 3852	2772	cmd.exe	118
PID 3852 wrote to memory of 2368	3852	dllhost.exe	124
PID 3852 wrote to memory of 2368	3852	dllhost.exe	124
PID 2368 wrote to memory of 4164	2368	cmd.exe	126
PID 2368 wrote to memory of 4164	2368	cmd.exe	126
PID 2368 wrote to memory of 1084	2368	cmd.exe	128
PID 2368 wrote to memory of 1084	2368	cmd.exe	128
PID 1084 wrote to memory of 740	1084	dllhost.exe	132
PID 1084 wrote to memory of 740	1084	dllhost.exe	132
PID 740 wrote to memory of 2720	740	cmd.exe	134
PID 740 wrote to memory of 2720	740	cmd.exe	134
PID 740 wrote to memory of 4480	740	cmd.exe	137
PID 740 wrote to memory of 4480	740	cmd.exe	137
PID 4480 wrote to memory of 3668	4480	dllhost.exe	139
PID 4480 wrote to memory of 3668	4480	dllhost.exe	139
PID 3668 wrote to memory of 1444	3668	cmd.exe	141
PID 3668 wrote to memory of 1444	3668	cmd.exe	141
PID 3668 wrote to memory of 1244	3668	cmd.exe	143
PID 3668 wrote to memory of 1244	3668	cmd.exe	143
PID 1244 wrote to memory of 5020	1244	dllhost.exe	145
PID 1244 wrote to memory of 5020	1244	dllhost.exe	145
PID 5020 wrote to memory of 3492	5020	cmd.exe	147
PID 5020 wrote to memory of 3492	5020	cmd.exe	147
PID 5020 wrote to memory of 4912	5020	cmd.exe	149
PID 5020 wrote to memory of 4912	5020	cmd.exe	149
PID 4912 wrote to memory of 676	4912	dllhost.exe	151
PID 4912 wrote to memory of 676	4912	dllhost.exe	151
PID 676 wrote to memory of 4628	676	cmd.exe	153
PID 676 wrote to memory of 4628	676	cmd.exe	153
PID 676 wrote to memory of 5008	676	cmd.exe	155
PID 676 wrote to memory of 5008	676	cmd.exe	155
PID 5008 wrote to memory of 2216	5008	dllhost.exe	158
PID 5008 wrote to memory of 2216	5008	dllhost.exe	158
PID 2216 wrote to memory of 5016	2216	cmd.exe	160
PID 2216 wrote to memory of 5016	2216	cmd.exe	160
PID 2216 wrote to memory of 2876	2216	cmd.exe	162
PID 2216 wrote to memory of 2876	2216	cmd.exe	162
PID 2876 wrote to memory of 4036	2876	dllhost.exe	164
PID 2876 wrote to memory of 4036	2876	dllhost.exe	164
PID 4036 wrote to memory of 5056	4036	cmd.exe	166
PID 4036 wrote to memory of 5056	4036	cmd.exe	166
PID 4036 wrote to memory of 4344	4036	cmd.exe	168
PID 4036 wrote to memory of 4344	4036	cmd.exe	168

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8f3858dd23d96aa9f530f615bdf230fa5fee84c56f6659fc2f7f01f71608a2c6.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8f3858dd23d96aa9f530f615bdf230fa5fee84c56f6659fc2f7f01f71608a2c6.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1532
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2272
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2184
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:540
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1992
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3480
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\addins\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3840
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\dllhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3104
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\PN219sj1of.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2772
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:1612
      - C:\providercommon\dllhost.exe
        
        "C:\providercommon\dllhost.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3852
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\nlAvT1Qihc.bat"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:2368
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:4164
        
        C:\providercommon\dllhost.exe
        
        "C:\providercommon\dllhost.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1084
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\esvfELjyVS.bat"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:740
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:2720
        
        C:\providercommon\dllhost.exe
        
        "C:\providercommon\dllhost.exe"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4480
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\yWf31kVUUl.bat"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:3668
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:1444
        
        C:\providercommon\dllhost.exe
        
        "C:\providercommon\dllhost.exe"
        12⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1244
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\auWhjrprfd.bat"
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:5020
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        14⤵
        
        PID:3492
        
        C:\providercommon\dllhost.exe
        
        "C:\providercommon\dllhost.exe"
        14⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4912
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\CIMKRyAEqW.bat"
        15⤵
        Suspicious use of WriteProcessMemory
        
        PID:676
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        16⤵
        
        PID:4628
        
        C:\providercommon\dllhost.exe
        
        "C:\providercommon\dllhost.exe"
        16⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5008
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\I1IMKnnpZ2.bat"
        17⤵
        Suspicious use of WriteProcessMemory
        
        PID:2216
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        18⤵
        
        PID:5016
        
        C:\providercommon\dllhost.exe
        
        "C:\providercommon\dllhost.exe"
        18⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2876
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\6VGBOjzZtA.bat"
        19⤵
        Suspicious use of WriteProcessMemory
        
        PID:4036
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        20⤵
        
        PID:5056
        
        C:\providercommon\dllhost.exe
        
        "C:\providercommon\dllhost.exe"
        20⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4344
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Urxb3wPgb0.bat"
        21⤵
        
        PID:4892
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        22⤵
        
        PID:1444
        
        C:\providercommon\dllhost.exe
        
        "C:\providercommon\dllhost.exe"
        22⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4964
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\jkzlbVqk90.bat"
        23⤵
        
        PID:1492
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        24⤵
        
        PID:2896
        
        C:\providercommon\dllhost.exe
        
        "C:\providercommon\dllhost.exe"
        24⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1840
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\KxKP0srito.bat"
        25⤵
        
        PID:4848
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        26⤵
        
        PID:1668
        
        C:\providercommon\dllhost.exe
        
        "C:\providercommon\dllhost.exe"
        26⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4720
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\fdSjcfTSOA.bat"
        27⤵
        
        PID:4284
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        28⤵
        
        PID:4140
        
        C:\providercommon\dllhost.exe
        
        "C:\providercommon\dllhost.exe"
        28⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:928
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\tebxeZNirC.bat"
        29⤵
        
        PID:2244
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        30⤵
        
        PID:452
        
        C:\providercommon\dllhost.exe
        
        "C:\providercommon\dllhost.exe"
        30⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Users\Default\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Default\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Users\Default\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Windows\addins\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\addins\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Windows\addins\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\providercommon\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\providercommon\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:368

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\providercommon\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\dllhost.exe.log

Filesize
1KB

MD5
baf55b95da4a601229647f25dad12878

SHA1
abc16954ebfd213733c4493fc1910164d825cac8

SHA256
ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

SHA512
24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6d42b6da621e8df5674e26b799c8e2aa

SHA1
ab3ce1327ea1eeedb987ec823d5e0cb146bafa48

SHA256
5ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c

SHA512
53faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
77d622bb1a5b250869a3238b9bc1402b

SHA1
d47f4003c2554b9dfc4c16f22460b331886b191b

SHA256
f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

SHA512
d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

Download Submit
C:\Users\Admin\AppData\Local\Temp\6VGBOjzZtA.bat

Filesize
194B

MD5
73dce51bf2bcfa97ad47d6fd110202d4

SHA1
095b9d43ed1db0bc8bc8555f3c32bbcf74715058

SHA256
03ce5557572b3c4d365899e3ff091fab6a0754cac962609ced87145037d659e6

SHA512
27e16bb629ef2747b00b213dc233d995634c8c71af7b21e72f3a7c92cac6e5d466a97f1d3cc862de29860f24c556640f9ffb5ac2f56be41397a4fad8701e5c12

Download Submit
C:\Users\Admin\AppData\Local\Temp\CIMKRyAEqW.bat

Filesize
194B

MD5
93b5b7599ee4aff3617d68dfc4cd9efd

SHA1
1192d13e098cf21d3136302803f7e17a8cddf725

SHA256
c7d32a7cb9bee1375eb192ae2d3d976fc60fc501a357a93594ea2ac13e73681a

SHA512
82f1ed816181d1d87541fe042c3eaf0bf16fb2cfdd31552a46c6f7d669f415f48fe8c8174132a0dca218a494245369b6d3ba4c5abcb6e8696e64759b8af30e53

Download Submit
C:\Users\Admin\AppData\Local\Temp\I1IMKnnpZ2.bat

Filesize
194B

MD5
b8b71293687d26547673e9b91d57a77d

SHA1
cae92862d303555ca9e17a818fd0d5d10c236831

SHA256
d2984e3b1e07f7875089ea6097a6249ddb6545ea87db3b2e8ca429d38d9bf753

SHA512
8dddf2b693fb1eb501d73d239d24c167a1336a0523cb57b3ab244b116870400c688995e176a74504df439aa8a984de1c65013a8793661f5621c5355d05572cde

Download Submit
C:\Users\Admin\AppData\Local\Temp\KxKP0srito.bat

Filesize
194B

MD5
113ecf46e75dcee4d04cf2d684a790a5

SHA1
edc8686d62a3fbc91f58eb08a09d1fc3e19e57ee

SHA256
17c0682e20633a79eab497f98c4b30ec85750bea6d938fb9f4e7e47ff525d72d

SHA512
0169f2c6a7842b856aff8692f8c2aeaf08d61327cbd62e9316edd1d37906cbdd07373f5a204d4e6338fefc8af39d11de72b220da3dc2924a5196b9da8ae1b1c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\PN219sj1of.bat

Filesize
194B

MD5
735ff344aaee106bed0f57901e74fc20

SHA1
4d8a4956fdd8b57570648b9a6588f1d71b341616

SHA256
e9b56f32cb67d9292fe92de99b055bfbfdd01a8ae1c3223db8b4711771d14d7d

SHA512
5afc1e1f7c92793f988d8a3d34365bf04780f1f278a646657592dee6ecc0d463740bfa6b25574be5a05af50a6a92ab3a16d5b751396fb3466db1a8b126d085c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Urxb3wPgb0.bat

Filesize
194B

MD5
93f1149dd5a1f3e2d4fdbc7b97674d88

SHA1
be02730e585ac8cc68cd814741777818daa45201

SHA256
54c0521a93deceebfd55352a2f6dd55de8e23d2723ecbff499e0e1a965623c77

SHA512
2f15e7e9e735d6b105db05a2c333561a1858f27cb54d26af806616cd46bff5b69520f0532683bcb01c6b5baa608b23afecd9a5f3de2ceb5f49de271d6dae5b9a

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3ol0jsa0.ftz.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\auWhjrprfd.bat

Filesize
194B

MD5
92957aa3f89112d2a7ba481174af5f6c

SHA1
c8842bb4d871d68f396b781beecf11e8e4372c9a

SHA256
74c681231311dd5e02f767b917b2fc425099e2846d13a9d0dd728dd542b71881

SHA512
63cd3a6c6c0a00a79b67734a0118127d669b17fde985b27001a7ab6c859f386b482fa5623ea3fd05f1d7c01a8ebe25a72b9d0eb7a830a946c68058ebf9692f26

Download Submit
C:\Users\Admin\AppData\Local\Temp\esvfELjyVS.bat

Filesize
194B

MD5
669b9d3272f2616e37238d751d4c92c5

SHA1
77a84df993b19dbb294a1a4c904eba26a667b485

SHA256
1864b4bc9dfab4f0d965b290affb883951129fe4e879141663cb97e98c640e0a

SHA512
2c8dffca80d991b5769cd4396ad8b6630e90c56bd5965a6e62c71b94f93e18634f5ef5ae81c91b3ed4e42f129d2327c1bee4c6a21b8b49dcfd7c5b7aae9e3244

Download Submit
C:\Users\Admin\AppData\Local\Temp\fdSjcfTSOA.bat

Filesize
194B

MD5
503c606dc085f5a53db0502fb1126a18

SHA1
771d42db49a1e46020b9cebdc6755d08f970ef3f

SHA256
0f4b7b09b977430c48b1928c28342a41c30d8facc2372b86a4b8b6bec7b36df2

SHA512
6649da3143276b07444dcb7c12fcd9a101c077af7de3e2f0fd986fd7f5a6b1be07af7e182199f3455294bdb017eb9ec990804de3acf1b6aaf1ecd5fd0fa6d4fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\jkzlbVqk90.bat

Filesize
194B

MD5
4dc87c30a86e76d5703ec380e011439a

SHA1
bd0bacdb0d1c74eb69ec0b88fccf3582a6610342

SHA256
12893bb1e12eb3ac859fef3b3c39b1203cf45b3ee1b1bf6171ebac2e2cee2340

SHA512
d77f1f8620a283e4c879dc1cfe307b7aabc95f74be781bf1f0f00fe26e728a8bc58226f65fc8f1b8930b766dba84041676e50e052a7d538cf390d5321c93b613

Download Submit
C:\Users\Admin\AppData\Local\Temp\nlAvT1Qihc.bat

Filesize
194B

MD5
4cca500bad393c6382dd0738b7e30c79

SHA1
81e16623358994ae8dc3c88bf39e3723c4b79811

SHA256
7127546b80a55f11b1f374cac0f597a451cc748c5de9430825c9cc08493a78ff

SHA512
32e06951d2393fc21fcb515092e2effb4e7b0cf223d7d2e43871d1784a0334a004fc8f4976dde70202b00ff6dba6ed3bbd1a8b293910b2dacd0c618f4d713364

Download Submit
C:\Users\Admin\AppData\Local\Temp\tebxeZNirC.bat

Filesize
194B

MD5
d40af8d3f32e421daf9225a7ac2d86f7

SHA1
c5bbcc5af5f500da17743b107cf01268a98575e4

SHA256
5f9c36405e72f36bc7f0747b2738ede87769d03209915811994e394cc51831dd

SHA512
c85904eb0fe3c156bfaaee8cdbe349f59684b849943ba989b2dee4b0b17fa415639c4f6dcd9d186ba502dbee079bc14c55996c03c819a261fad74b7af1540955

Download Submit
C:\Users\Admin\AppData\Local\Temp\yWf31kVUUl.bat

Filesize
194B

MD5
cbc7f1f4dce2ad7939c866f3703a7281

SHA1
cbaa84d2f7731013848a474761bc007598c166d5

SHA256
281f89ed908f252ec375077353ab93d9a8c3c2e5a905a6f0292e4eed070f5548

SHA512
1dece47382a3128eb718031cd93a7e15b157b53bfd3176d0da467464cbf3989c2b7d93c22636c1fd9bea0ab1da172e80b00ccf007e97b7d812c9d791cfeaf132

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/540-17-0x0000000000F10000-0x0000000000F1C000-memory.dmp

Filesize
48KB

Download
memory/540-16-0x0000000000F00000-0x0000000000F0C000-memory.dmp

Filesize
48KB

Download
memory/540-15-0x0000000000EF0000-0x0000000000EFC000-memory.dmp

Filesize
48KB

Download
memory/540-14-0x0000000000EE0000-0x0000000000EF2000-memory.dmp

Filesize
72KB

Download
memory/540-13-0x0000000000460000-0x0000000000570000-memory.dmp

Filesize
1.1MB

Download
memory/540-12-0x00007FFB75A53000-0x00007FFB75A55000-memory.dmp

Filesize
8KB

Download
memory/2876-118-0x0000000002BF0000-0x0000000002C02000-memory.dmp

Filesize
72KB

Download
memory/3480-37-0x0000023393580000-0x00000233935A2000-memory.dmp

Filesize
136KB

Download
memory/4344-125-0x00000000021A0000-0x00000000021B2000-memory.dmp

Filesize
72KB

Download
memory/4912-105-0x0000000001590000-0x00000000015A2000-memory.dmp

Filesize
72KB

Download