dcrat | 6b1c70440f64653fbdc4da2f5759dc772ba75d7b5265c7d5841983bfa7363b20

Analysis

max time kernel
148s
max time network
148s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
22-12-2024 04:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_6b1c70440f64653fbdc4da2f5759dc772ba75d7b5265c7d5841983bfa7363b20.exe
Size

1.3MB
MD5

5d406c38950ee5f208f2452b8a777495
SHA1

8bbfeeb845cd130355372ef251f0e7dfef65625d
SHA256

6b1c70440f64653fbdc4da2f5759dc772ba75d7b5265c7d5841983bfa7363b20
SHA512

7d718390e65eee0e10dd6759d233fc56e76926a611c8ecdfea51ecf2ffffa40db6e2c243f914b23288a636db99b775a1ed38e0a553b20084741f9ced7cf31f9a
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 9 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2384	2128	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2848	2128	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2728	2128	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1096	2128	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2604	2128	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2648	2128	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2312	2128	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1564	2128	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	788	2128	schtasks.exe	34

DCRat payload 9 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0008000000016c66-9.dat	dcrat
behavioral1/memory/2444-13-0x0000000001350000-0x0000000001460000-memory.dmp	dcrat
behavioral1/memory/1720-52-0x0000000001340000-0x0000000001450000-memory.dmp	dcrat
behavioral1/memory/2852-229-0x0000000000190000-0x00000000002A0000-memory.dmp	dcrat
behavioral1/memory/3056-290-0x0000000000A70000-0x0000000000B80000-memory.dmp	dcrat
behavioral1/memory/2652-409-0x0000000001170000-0x0000000001280000-memory.dmp	dcrat
behavioral1/memory/2348-470-0x00000000002C0000-0x00000000003D0000-memory.dmp	dcrat
behavioral1/memory/1484-531-0x00000000008F0000-0x0000000000A00000-memory.dmp	dcrat
behavioral1/memory/1948-591-0x0000000000EB0000-0x0000000000FC0000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1008	powershell.exe
1768	powershell.exe
1028	powershell.exe
1196	powershell.exe

Executes dropped EXE 12 IoCs

pid	Process
2444	DllCommonsvc.exe
1720	WmiPrvSE.exe
2156	WmiPrvSE.exe
2520	WmiPrvSE.exe
2852	WmiPrvSE.exe
3056	WmiPrvSE.exe
556	WmiPrvSE.exe
2652	WmiPrvSE.exe
2348	WmiPrvSE.exe
1484	WmiPrvSE.exe
1948	WmiPrvSE.exe
900	WmiPrvSE.exe

Loads dropped DLL 2 IoCs

pid	Process
2772	cmd.exe
2772	cmd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 12 IoCs

Web Service

T1102

flow	ioc
13	raw.githubusercontent.com
20	raw.githubusercontent.com
16	raw.githubusercontent.com
24	raw.githubusercontent.com
27	raw.githubusercontent.com
31	raw.githubusercontent.com
34	raw.githubusercontent.com
4	raw.githubusercontent.com
5	raw.githubusercontent.com
9	raw.githubusercontent.com
37	raw.githubusercontent.com
41	raw.githubusercontent.com

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\WmiPrvSE.exe	DllCommonsvc.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\logs\WmiPrvSE.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\24dbde2999530e	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_6b1c70440f64653fbdc4da2f5759dc772ba75d7b5265c7d5841983bfa7363b20.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 9 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2312	schtasks.exe
2384	schtasks.exe
2848	schtasks.exe
2728	schtasks.exe
2604	schtasks.exe
1096	schtasks.exe
2648	schtasks.exe
1564	schtasks.exe
788	schtasks.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
2444	DllCommonsvc.exe
1196	powershell.exe
1028	powershell.exe
1768	powershell.exe
1008	powershell.exe
1720	WmiPrvSE.exe
2156	WmiPrvSE.exe
2520	WmiPrvSE.exe
2852	WmiPrvSE.exe
3056	WmiPrvSE.exe
556	WmiPrvSE.exe
2652	WmiPrvSE.exe
2348	WmiPrvSE.exe
1484	WmiPrvSE.exe
1948	WmiPrvSE.exe
900	WmiPrvSE.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeDebugPrivilege	2444	DllCommonsvc.exe
Token: SeDebugPrivilege	1196	powershell.exe
Token: SeDebugPrivilege	1028	powershell.exe
Token: SeDebugPrivilege	1768	powershell.exe
Token: SeDebugPrivilege	1008	powershell.exe
Token: SeDebugPrivilege	1720	WmiPrvSE.exe
Token: SeDebugPrivilege	2156	WmiPrvSE.exe
Token: SeDebugPrivilege	2520	WmiPrvSE.exe
Token: SeDebugPrivilege	2852	WmiPrvSE.exe
Token: SeDebugPrivilege	3056	WmiPrvSE.exe
Token: SeDebugPrivilege	556	WmiPrvSE.exe
Token: SeDebugPrivilege	2652	WmiPrvSE.exe
Token: SeDebugPrivilege	2348	WmiPrvSE.exe
Token: SeDebugPrivilege	1484	WmiPrvSE.exe
Token: SeDebugPrivilege	1948	WmiPrvSE.exe
Token: SeDebugPrivilege	900	WmiPrvSE.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2272 wrote to memory of 1900	2272	JaffaCakes118_6b1c70440f64653fbdc4da2f5759dc772ba75d7b5265c7d5841983bfa7363b20.exe	30
PID 2272 wrote to memory of 1900	2272	JaffaCakes118_6b1c70440f64653fbdc4da2f5759dc772ba75d7b5265c7d5841983bfa7363b20.exe	30
PID 2272 wrote to memory of 1900	2272	JaffaCakes118_6b1c70440f64653fbdc4da2f5759dc772ba75d7b5265c7d5841983bfa7363b20.exe	30
PID 2272 wrote to memory of 1900	2272	JaffaCakes118_6b1c70440f64653fbdc4da2f5759dc772ba75d7b5265c7d5841983bfa7363b20.exe	30
PID 1900 wrote to memory of 2772	1900	WScript.exe	31
PID 1900 wrote to memory of 2772	1900	WScript.exe	31
PID 1900 wrote to memory of 2772	1900	WScript.exe	31
PID 1900 wrote to memory of 2772	1900	WScript.exe	31
PID 2772 wrote to memory of 2444	2772	cmd.exe	33
PID 2772 wrote to memory of 2444	2772	cmd.exe	33
PID 2772 wrote to memory of 2444	2772	cmd.exe	33
PID 2772 wrote to memory of 2444	2772	cmd.exe	33
PID 2444 wrote to memory of 1196	2444	DllCommonsvc.exe	44
PID 2444 wrote to memory of 1196	2444	DllCommonsvc.exe	44
PID 2444 wrote to memory of 1196	2444	DllCommonsvc.exe	44
PID 2444 wrote to memory of 1028	2444	DllCommonsvc.exe	45
PID 2444 wrote to memory of 1028	2444	DllCommonsvc.exe	45
PID 2444 wrote to memory of 1028	2444	DllCommonsvc.exe	45
PID 2444 wrote to memory of 1768	2444	DllCommonsvc.exe	46
PID 2444 wrote to memory of 1768	2444	DllCommonsvc.exe	46
PID 2444 wrote to memory of 1768	2444	DllCommonsvc.exe	46
PID 2444 wrote to memory of 1008	2444	DllCommonsvc.exe	47
PID 2444 wrote to memory of 1008	2444	DllCommonsvc.exe	47
PID 2444 wrote to memory of 1008	2444	DllCommonsvc.exe	47
PID 2444 wrote to memory of 2580	2444	DllCommonsvc.exe	52
PID 2444 wrote to memory of 2580	2444	DllCommonsvc.exe	52
PID 2444 wrote to memory of 2580	2444	DllCommonsvc.exe	52
PID 2580 wrote to memory of 2976	2580	cmd.exe	54
PID 2580 wrote to memory of 2976	2580	cmd.exe	54
PID 2580 wrote to memory of 2976	2580	cmd.exe	54
PID 2580 wrote to memory of 1720	2580	cmd.exe	56
PID 2580 wrote to memory of 1720	2580	cmd.exe	56
PID 2580 wrote to memory of 1720	2580	cmd.exe	56
PID 1720 wrote to memory of 2528	1720	WmiPrvSE.exe	57
PID 1720 wrote to memory of 2528	1720	WmiPrvSE.exe	57
PID 1720 wrote to memory of 2528	1720	WmiPrvSE.exe	57
PID 2528 wrote to memory of 2856	2528	cmd.exe	59
PID 2528 wrote to memory of 2856	2528	cmd.exe	59
PID 2528 wrote to memory of 2856	2528	cmd.exe	59
PID 2528 wrote to memory of 2156	2528	cmd.exe	60
PID 2528 wrote to memory of 2156	2528	cmd.exe	60
PID 2528 wrote to memory of 2156	2528	cmd.exe	60
PID 2156 wrote to memory of 2624	2156	WmiPrvSE.exe	61
PID 2156 wrote to memory of 2624	2156	WmiPrvSE.exe	61
PID 2156 wrote to memory of 2624	2156	WmiPrvSE.exe	61
PID 2624 wrote to memory of 2384	2624	cmd.exe	63
PID 2624 wrote to memory of 2384	2624	cmd.exe	63
PID 2624 wrote to memory of 2384	2624	cmd.exe	63
PID 2624 wrote to memory of 2520	2624	cmd.exe	64
PID 2624 wrote to memory of 2520	2624	cmd.exe	64
PID 2624 wrote to memory of 2520	2624	cmd.exe	64
PID 2520 wrote to memory of 2472	2520	WmiPrvSE.exe	65
PID 2520 wrote to memory of 2472	2520	WmiPrvSE.exe	65
PID 2520 wrote to memory of 2472	2520	WmiPrvSE.exe	65
PID 2472 wrote to memory of 2344	2472	cmd.exe	67
PID 2472 wrote to memory of 2344	2472	cmd.exe	67
PID 2472 wrote to memory of 2344	2472	cmd.exe	67
PID 2472 wrote to memory of 2852	2472	cmd.exe	68
PID 2472 wrote to memory of 2852	2472	cmd.exe	68
PID 2472 wrote to memory of 2852	2472	cmd.exe	68
PID 2852 wrote to memory of 308	2852	WmiPrvSE.exe	69
PID 2852 wrote to memory of 308	2852	WmiPrvSE.exe	69
PID 2852 wrote to memory of 308	2852	WmiPrvSE.exe	69
PID 308 wrote to memory of 324	308	cmd.exe	71

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6b1c70440f64653fbdc4da2f5759dc772ba75d7b5265c7d5841983bfa7363b20.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6b1c70440f64653fbdc4da2f5759dc772ba75d7b5265c7d5841983bfa7363b20.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2272
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1900
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2772
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2444
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1196
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Mozilla Maintenance Service\logs\WmiPrvSE.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1028
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\wininit.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1768
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\explorer.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1008
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\W7FqciKhTi.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2580
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:2976
      - C:\Program Files (x86)\Mozilla Maintenance Service\logs\WmiPrvSE.exe
        
        "C:\Program Files (x86)\Mozilla Maintenance Service\logs\WmiPrvSE.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1720
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\qKN9Q7Smhq.bat"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:2528
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:2856
        
        C:\Program Files (x86)\Mozilla Maintenance Service\logs\WmiPrvSE.exe
        
        "C:\Program Files (x86)\Mozilla Maintenance Service\logs\WmiPrvSE.exe"
        8⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2156
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\sPXGbYzrvf.bat"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:2624
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:2384
        
        C:\Program Files (x86)\Mozilla Maintenance Service\logs\WmiPrvSE.exe
        
        "C:\Program Files (x86)\Mozilla Maintenance Service\logs\WmiPrvSE.exe"
        10⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2520
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\hfpeQ4JfvC.bat"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:2472
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:2344
        
        C:\Program Files (x86)\Mozilla Maintenance Service\logs\WmiPrvSE.exe
        
        "C:\Program Files (x86)\Mozilla Maintenance Service\logs\WmiPrvSE.exe"
        12⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2852
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\t3iRsZx2b7.bat"
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:308
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        14⤵
        
        PID:324
        
        C:\Program Files (x86)\Mozilla Maintenance Service\logs\WmiPrvSE.exe
        
        "C:\Program Files (x86)\Mozilla Maintenance Service\logs\WmiPrvSE.exe"
        14⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3056
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\fdSjcfTSOA.bat"
        15⤵
        
        PID:2720
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        16⤵
        
        PID:2892
        
        C:\Program Files (x86)\Mozilla Maintenance Service\logs\WmiPrvSE.exe
        
        "C:\Program Files (x86)\Mozilla Maintenance Service\logs\WmiPrvSE.exe"
        16⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:556
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Nl6pt1R060.bat"
        17⤵
        
        PID:2116
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        18⤵
        
        PID:2620
        
        C:\Program Files (x86)\Mozilla Maintenance Service\logs\WmiPrvSE.exe
        
        "C:\Program Files (x86)\Mozilla Maintenance Service\logs\WmiPrvSE.exe"
        18⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2652
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\XaHtVPtwVH.bat"
        19⤵
        
        PID:1952
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        20⤵
        
        PID:1672
        
        C:\Program Files (x86)\Mozilla Maintenance Service\logs\WmiPrvSE.exe
        
        "C:\Program Files (x86)\Mozilla Maintenance Service\logs\WmiPrvSE.exe"
        20⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2348
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\LdHmevWlG3.bat"
        21⤵
        
        PID:2556
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        22⤵
        
        PID:840
        
        C:\Program Files (x86)\Mozilla Maintenance Service\logs\WmiPrvSE.exe
        
        "C:\Program Files (x86)\Mozilla Maintenance Service\logs\WmiPrvSE.exe"
        22⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1484
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\jhJpXqSaXt.bat"
        23⤵
        
        PID:784
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        24⤵
        
        PID:856
        
        C:\Program Files (x86)\Mozilla Maintenance Service\logs\WmiPrvSE.exe
        
        "C:\Program Files (x86)\Mozilla Maintenance Service\logs\WmiPrvSE.exe"
        24⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1948
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\42uKfvaRom.bat"
        25⤵
        
        PID:2988
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        26⤵
        
        PID:1176
        
        C:\Program Files (x86)\Mozilla Maintenance Service\logs\WmiPrvSE.exe
        
        "C:\Program Files (x86)\Mozilla Maintenance Service\logs\WmiPrvSE.exe"
        26⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:900
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\VJj2LbMAw3.bat"
        27⤵
        
        PID:1760
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        28⤵
        
        PID:2100

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2384

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 8 /tr "'C:\providercommon\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1096

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\providercommon\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 6 /tr "'C:\providercommon\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\providercommon\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2312

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\providercommon\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\providercommon\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
007699d3e0202cd1217ac8f36b0a120e

SHA1
3872f500a7752ce8fb7df803f77934d08ac1666e

SHA256
cf9e772f823cb4a2bd09ff9c3a3c5e607219709c0d2f5342f6b3f3c18ac9334a

SHA512
7036f68a6ca2b873ce903262c296df76a435f2f28434f4d93b421f09f06e0c01c847c1c3fa6bb36f5eb5a15bd8d67fcc30c5a0302be4f4aa9935f2d410ee1dc0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
63d04cbb913eb5b731d9be24ab58aa23

SHA1
c24963f9cb3a647dbb891ff29211a7ae61a43de1

SHA256
d17ea31bc63b2aa6e8b1078a93e14500e67c694ba8418d4d8fe3ffaf56b6e332

SHA512
fedd1c15ed448437edee9b454228ff1a4c7e82deeb7abca6a306c25082fb14d7db89c089d812e03b40cc5c184e9ad5c48dcb5d1f6ff698347dddd359eeb765e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
39597da373944b8d554461f3ef6f38c6

SHA1
0fed3d289eba4bc1ccfbd473485a048e42a9cd69

SHA256
cfdac0e443b1bbf1f6fe18e56dfc4cb4074a2b1963e26753fca1471c5ff01b95

SHA512
5ecfed0c590e13db6df299a26bce4d148fa93ac130e1e584fad1c83688cf57bf4692c747707b7383f1d44445e70a983149176641539773cfe3a85959fac9faf6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7b25ed8222f4960678716e1b0c5ca95c

SHA1
bfa6e8d360d44c0541087677482e2ab7826cc39f

SHA256
b112a6a9816ebf5ea44f50b8e27cb5ae29d08a21dc32fc11e110f608a412bdf8

SHA512
7cab6c37b47eab364670ca42757b0e1bfc469606af65e73c93687acfd846f29081271272ae6429c4758a099afa54243bb5731cc51a04587547d1f0e76563e974

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5c4bff9c9fd28422431c7551193cb3df

SHA1
974f264fef6fe1b7560f0893214628e498192d57

SHA256
25a19fe6400368c738b3222b5ffe2e92254eb161fbf4ee493543426feb020e60

SHA512
7d0e9a8ad8d0a2d3c648674fea91a8e266b04d74bcbd29edbe713041b35bd6f7eef2407df1a749b1528a4472b5aa5897eb3b009be6186ebe54f9b78866626e28

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
220e253e10adbd07f09dc469a525095b

SHA1
e0e68e5c54ecb9c35911dc445f14dccd77c79ca3

SHA256
d105ccba69178ee366a4759a8eaf257dafb37b7811256e2b377c6164bba7d301

SHA512
a5e4e0a9f990e338f2fadbb2ebcf5ba27ed73ab8edbf288f52b8a8494ef58ce470812620ebe3584c2b4288be6cd47e2f3862ef4fb171669a34ca0ac792fd4351

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bab25ae31af150328f75b8c271e926f9

SHA1
c7f1946d3311d5172b8b8a12e77bfabee81a4d4b

SHA256
14611ebec60e59ff84920b0f29023a443bac4ee75f7f42276f210f37d854c985

SHA512
b26d632a5fa38d914dada7c26d86443bde4901fb966de796b67b72f2a063ebe97f98cf415bb8e85a1bbf7992700750dcb9927777c488068244f8baa64325e6d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
02b929b1c3a7b04a1cee4505e20c25c7

SHA1
809bf227926863a2823107bcaec2d4ace17347bd

SHA256
9b91793b877d632eef3d3556cad29c6844a9b6fc128f26f6258708ec828c0251

SHA512
3690af0615833c58b79f5573a190e316a07a162b2f10a9e43aca98960ef9f786afd4ddb02ac0c222d7f4e5d385831c010c0ed13a499aa20c345a1f1f731316be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a0e0fa42e0480cae26d88b28563d600a

SHA1
552135dc4a257d61a94d9138e0742966426e0c75

SHA256
3253f75e84fe41c209e683b9b62c2c49670b687a6225a22aab9f317401e283f3

SHA512
36d182b104c146219a7b7f5dc1fa1e58cd7adaabf2f602ec79d514b053f112d291ecdb7a1f4ebb22827771bb9c768db597a45483fde4536089d8f3f2e99dbcdf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8e0369682bb970958842954e6a0bf1c3

SHA1
182347dfb4c4dca99954ad7b4b42f4bd026633b7

SHA256
329ae1b68282024d3bc5cac20dd168a53535d1f6861976a2458ffcf4af32af0a

SHA512
1abec528883f47f854a1386a5a5cd780e2c0c27eb1b741a3f8026443e46b52a38be7bbc45bec231c44d434d207e49c1b2ad5445ef7d8d4b76fa5db1e0c4a408c

Download Submit
C:\Users\Admin\AppData\Local\Temp\42uKfvaRom.bat

Filesize
233B

MD5
f566dba91b2bb07abab772ff45c22367

SHA1
b471894ff9fb5c1e4fc034829d2b76d6462a4a20

SHA256
612e96ec42dfaccb1c24314a3df984223f5e072a77941a0dbe240163397fd507

SHA512
430450f55b0d6b6f123b0076482adea3c48a19b839507992f35064cbe5da8d4a321a19f0fa36448f06f477bebd58fe2eb55bb7596b42801c940a098d72311ecb

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF069.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\LdHmevWlG3.bat

Filesize
233B

MD5
3909781f003e476251b68417df1e8f8d

SHA1
49232c0d5d5e4cf5249f227e985dceaac9df0b30

SHA256
0fe8a17b974a0625bb4cda43983d987eaa844b674d80a8970b6fbc52b49c9d89

SHA512
5807bf8d29f4920fdc8d88947ab58e1014ad03d58b39b4830299517c51b750d771044b642b3a7db845085dfe7561816e9fe243db36e985d27fdc288adbb1ed1e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Nl6pt1R060.bat

Filesize
233B

MD5
9df976c0269c46e7280c210ec15faba4

SHA1
f5158022d1ad89d6b68b0fb66472725b06f1a8ac

SHA256
a45ae8fb64747bd29437414ce49ef5dd3b73325d1cc10cc9b95b156cdc1ac676

SHA512
881bbe2312d20cbc1d758666ec34573b63c105e81d9254a7262b558369d97e10f3ce49cb6f72b72dc38ee97268b8feb1ef7203968a799e03d3c9e63900dc5e9c

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF08B.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\VJj2LbMAw3.bat

Filesize
233B

MD5
94332f7f3554f214ba4ec5d6633f8a77

SHA1
d5eecfd7364730f05f508bbe60f8a955b3039953

SHA256
4ab0179bd8481fa7a8d46bc822bc1d8b23913e8efebe9eb7791065bc3fadeb7a

SHA512
4d3b4ac920b74da60496c2ec5239819e8b16013e2bb014a50cef7bba59742055f58009742c618422a168f17916860f3ec2fa416deaac21886e487f70be4e583f

Download Submit
C:\Users\Admin\AppData\Local\Temp\W7FqciKhTi.bat

Filesize
233B

MD5
fbd2f517d50f5cab472b5744d54022cb

SHA1
ad50e9974de8ca19751d25e57aa820a6b623c800

SHA256
7ed44caf5853c5d2a551bee9b0ca5f001e5f4a7bfda8b340a8ce6de2ebeb4bc2

SHA512
ced8225a43cd5d269f346491d20250f82bf280a1e7497df5583ba3abd7b8d0800fd2a048cc705d05c46ccbebf98e70c3cc867c480f86e0c7ff6c46c2dd8f8f46

Download Submit
C:\Users\Admin\AppData\Local\Temp\XaHtVPtwVH.bat

Filesize
233B

MD5
1a804622d259d51053fae0f5cdb6e555

SHA1
0c808f5552f8b1c6dfd6541f10a50da6b78a30d8

SHA256
f3b55ab63834882ea872f5009527ca9314faba0887ecb925d85ca5e4694f9388

SHA512
a5294d81bb366aac170868c1225dc5709b83be3e3bb6b37149220e35bacff243eba9c5243391c0c4ace4dfce4004399768735a42ca6986447315587277d80871

Download Submit
C:\Users\Admin\AppData\Local\Temp\fdSjcfTSOA.bat

Filesize
233B

MD5
f8412e833034e0fb3ec21c8f57bf7d9a

SHA1
189e0d0daeb301c23e88b5677ba7da021f9191fc

SHA256
d4b03401dc33bfedba93fedbf38c3f63179573a6fda9e856966dc3318c99f892

SHA512
0382186a4c85e2f08a773f67eabec701237c8364468edcd9bb12b5d4469613e7d6880738b37db6c795c7494cbb74d09921b460b8c22c7c770c30319d53cfb6a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\hfpeQ4JfvC.bat

Filesize
233B

MD5
e82cf823f88d55dafe51f7e5c9817b0b

SHA1
3b5e18dcf72b3254c26de52d25857708e82ae5d9

SHA256
2216c8c681be0d3055cd0b3838e437d56ca3fe0f5397075ee2e0c9f0bb640475

SHA512
18db22d3375d9f02a11956953c93e512e2baae6b371b1f979a1bef18699aacfb5e0c38f71b7ebd5fb0eda6cd07457ce0e9a876f31ce47a79f78f366d38611983

Download Submit
C:\Users\Admin\AppData\Local\Temp\jhJpXqSaXt.bat

Filesize
233B

MD5
13a34d86223d7cf24a744d360c6f7960

SHA1
c7ebd620bf4a218d5a666c8c1e4419775074adf9

SHA256
29e68a253a95cfcc5eabbf2023b8d5f80c41ac1650e8ee45514617415fd0bc2f

SHA512
8f8651cdcd62aeda8597787d8588686697cf3cd8627fee5332392b26c634573bf8bb0704b3bad6bbebe72e9bb7a5fd1c806501dd0ec7dd8e58255c0e14ee9d5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\qKN9Q7Smhq.bat

Filesize
233B

MD5
bf2d3da98fc69fb923b79cc6af075eed

SHA1
7bceb256ab474efeb4eb90876aca25784032c980

SHA256
645faf399ff83cf3f94c3edf4d717e356c84665b849f86ac14c956d90b573e91

SHA512
b5ddb6ac698b4f5fc7c7a4255d7e1b9eee115a56cfdbde834abac9d5750c3101601395366649b5efd1d2584c2c24ef76fb145e5c75c7ee2b1d9c94aad9225cf1

Download Submit
C:\Users\Admin\AppData\Local\Temp\sPXGbYzrvf.bat

Filesize
233B

MD5
842f206b2f9be837ac7b89d6885c1f97

SHA1
17c73acd6f8338ca5174334859a4a1cc6a23235a

SHA256
a044f42e85895b2c307fab64e322a00223ad04511ae49048349c18ae125edf85

SHA512
c63b3c7f35f3b1596a344c83d8c7e9721eb8798c84b2d3ba8bbd321ce9c24269295bc7f5f2801f717cd2652018d52307cd72c347ceace53d95de507f67cc02e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\t3iRsZx2b7.bat

Filesize
233B

MD5
ec98a8db118aee0fc00bc35104cedb24

SHA1
17090af956da92728f36a8cceac2ee93b8cd38fe

SHA256
2755782a73cbe5b57994e86d50ef4beee303fa75770ef9549e0ebd6d6631fb17

SHA512
af79b6f20117af57f0c5f0f4b9e4c74891d657e79e04f500a0f5df7ce94f0a280ec1b5427dcb86eb96acf211fc11af637a11842c1922d62bd95437399011c828

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\TRLSVQQSMJWNUY9RT0WS.temp

Filesize
7KB

MD5
18a2d5ca98ccc281c19121e19924a8f5

SHA1
f2ae1c69a7ca618906d432ed1c1f9b46ec429889

SHA256
8abfa93b66eee1d691ce6180b2c796e3ad86fbb8915b3b61d577fc9dd9991dfd

SHA512
4f8c5400ff74814f9c7489875d8a14f306d1753903b82373518fd3b80ba02221bef787ad1a7e870ef096d08a96102554f991180fa9e2c150f5144400bc5944e8

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
memory/1028-43-0x0000000001D90000-0x0000000001D98000-memory.dmp

Filesize
32KB

Download
memory/1196-38-0x000000001B730000-0x000000001BA12000-memory.dmp

Filesize
2.9MB

Download
memory/1484-531-0x00000000008F0000-0x0000000000A00000-memory.dmp

Filesize
1.1MB

Download
memory/1720-52-0x0000000001340000-0x0000000001450000-memory.dmp

Filesize
1.1MB

Download
memory/1948-591-0x0000000000EB0000-0x0000000000FC0000-memory.dmp

Filesize
1.1MB

Download
memory/2348-470-0x00000000002C0000-0x00000000003D0000-memory.dmp

Filesize
1.1MB

Download
memory/2348-471-0x0000000000230000-0x0000000000242000-memory.dmp

Filesize
72KB

Download
memory/2444-17-0x0000000000300000-0x000000000030C000-memory.dmp

Filesize
48KB

Download
memory/2444-16-0x00000000002E0000-0x00000000002EC000-memory.dmp

Filesize
48KB

Download
memory/2444-15-0x00000000002D0000-0x00000000002DC000-memory.dmp

Filesize
48KB

Download
memory/2444-14-0x00000000002C0000-0x00000000002D2000-memory.dmp

Filesize
72KB

Download
memory/2444-13-0x0000000001350000-0x0000000001460000-memory.dmp

Filesize
1.1MB

Download
memory/2652-409-0x0000000001170000-0x0000000001280000-memory.dmp

Filesize
1.1MB

Download
memory/2652-410-0x0000000000150000-0x0000000000162000-memory.dmp

Filesize
72KB

Download
memory/2852-229-0x0000000000190000-0x00000000002A0000-memory.dmp

Filesize
1.1MB

Download
memory/2852-230-0x0000000000150000-0x0000000000162000-memory.dmp

Filesize
72KB

Download
memory/3056-290-0x0000000000A70000-0x0000000000B80000-memory.dmp

Filesize
1.1MB

Download