dcrat | 45df2dd1cc96f978cb9f0bdceed8a3b4f9dd62622e955175a63cd0fd2cce2b27

Analysis

max time kernel
142s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2024 04:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_45df2dd1cc96f978cb9f0bdceed8a3b4f9dd62622e955175a63cd0fd2cce2b27.exe
Size

1.3MB
MD5

432df970422a8f38c1034b91d7889ab1
SHA1

0ee4ff6f332fcc0dbbc6b3f3299b99f466dd56bc
SHA256

45df2dd1cc96f978cb9f0bdceed8a3b4f9dd62622e955175a63cd0fd2cce2b27
SHA512

b14782be9dc9ef323561929345e77c05b05edfeca5722006f60342d7dec58b2524d80e25a81d27ac2b3d8f416d2ce0e46e6efdcfd030da1d3f6650914f01fa50
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 6 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3308	3092	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2360	3092	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3544	3092	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1244	3092	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2828	3092	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4044	3092	schtasks.exe	90

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x0007000000023cbd-10.dat	dcrat
behavioral2/memory/5084-13-0x0000000000670000-0x0000000000780000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2444	powershell.exe
3088	powershell.exe
3692	powershell.exe

Checks computer location settings 2 TTPs 15 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	SearchApp.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	SearchApp.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	JaffaCakes118_45df2dd1cc96f978cb9f0bdceed8a3b4f9dd62622e955175a63cd0fd2cce2b27.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	SearchApp.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	SearchApp.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	SearchApp.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	SearchApp.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	SearchApp.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	SearchApp.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	SearchApp.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	SearchApp.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	SearchApp.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	SearchApp.exe

Executes dropped EXE 14 IoCs

pid	Process
5084	DllCommonsvc.exe
2372	SearchApp.exe
624	SearchApp.exe
4340	SearchApp.exe
3016	SearchApp.exe
1768	SearchApp.exe
1736	SearchApp.exe
3904	SearchApp.exe
4228	SearchApp.exe
2464	SearchApp.exe
2828	SearchApp.exe
3580	SearchApp.exe
4984	SearchApp.exe
540	SearchApp.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 13 IoCs

Web Service

T1102

flow	ioc
40	raw.githubusercontent.com
41	raw.githubusercontent.com
48	raw.githubusercontent.com
15	raw.githubusercontent.com
16	raw.githubusercontent.com
49	raw.githubusercontent.com
53	raw.githubusercontent.com
54	raw.githubusercontent.com
55	raw.githubusercontent.com
56	raw.githubusercontent.com
57	raw.githubusercontent.com
31	raw.githubusercontent.com
44	raw.githubusercontent.com

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft.NET\RedistList\sysmon.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft.NET\RedistList\121e5b5079f7c0	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_45df2dd1cc96f978cb9f0bdceed8a3b4f9dd62622e955175a63cd0fd2cce2b27.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 14 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	JaffaCakes118_45df2dd1cc96f978cb9f0bdceed8a3b4f9dd62622e955175a63cd0fd2cce2b27.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	SearchApp.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1244	schtasks.exe
2828	schtasks.exe
4044	schtasks.exe
3308	schtasks.exe
2360	schtasks.exe
3544	schtasks.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
5084	DllCommonsvc.exe
3692	powershell.exe
3088	powershell.exe
2444	powershell.exe
3088	powershell.exe
3692	powershell.exe
2444	powershell.exe
2372	SearchApp.exe
624	SearchApp.exe
4340	SearchApp.exe
3016	SearchApp.exe
1768	SearchApp.exe
1736	SearchApp.exe
3904	SearchApp.exe
4228	SearchApp.exe
2464	SearchApp.exe
2828	SearchApp.exe
3580	SearchApp.exe
4984	SearchApp.exe
540	SearchApp.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeDebugPrivilege	5084	DllCommonsvc.exe
Token: SeDebugPrivilege	3692	powershell.exe
Token: SeDebugPrivilege	3088	powershell.exe
Token: SeDebugPrivilege	2444	powershell.exe
Token: SeDebugPrivilege	2372	SearchApp.exe
Token: SeDebugPrivilege	624	SearchApp.exe
Token: SeDebugPrivilege	4340	SearchApp.exe
Token: SeDebugPrivilege	3016	SearchApp.exe
Token: SeDebugPrivilege	1768	SearchApp.exe
Token: SeDebugPrivilege	1736	SearchApp.exe
Token: SeDebugPrivilege	3904	SearchApp.exe
Token: SeDebugPrivilege	4228	SearchApp.exe
Token: SeDebugPrivilege	2464	SearchApp.exe
Token: SeDebugPrivilege	2828	SearchApp.exe
Token: SeDebugPrivilege	3580	SearchApp.exe
Token: SeDebugPrivilege	4984	SearchApp.exe
Token: SeDebugPrivilege	540	SearchApp.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 708 wrote to memory of 1348	708	JaffaCakes118_45df2dd1cc96f978cb9f0bdceed8a3b4f9dd62622e955175a63cd0fd2cce2b27.exe	85
PID 708 wrote to memory of 1348	708	JaffaCakes118_45df2dd1cc96f978cb9f0bdceed8a3b4f9dd62622e955175a63cd0fd2cce2b27.exe	85
PID 708 wrote to memory of 1348	708	JaffaCakes118_45df2dd1cc96f978cb9f0bdceed8a3b4f9dd62622e955175a63cd0fd2cce2b27.exe	85
PID 1348 wrote to memory of 2632	1348	WScript.exe	87
PID 1348 wrote to memory of 2632	1348	WScript.exe	87
PID 1348 wrote to memory of 2632	1348	WScript.exe	87
PID 2632 wrote to memory of 5084	2632	cmd.exe	89
PID 2632 wrote to memory of 5084	2632	cmd.exe	89
PID 5084 wrote to memory of 2444	5084	DllCommonsvc.exe	98
PID 5084 wrote to memory of 2444	5084	DllCommonsvc.exe	98
PID 5084 wrote to memory of 3692	5084	DllCommonsvc.exe	99
PID 5084 wrote to memory of 3692	5084	DllCommonsvc.exe	99
PID 5084 wrote to memory of 3088	5084	DllCommonsvc.exe	100
PID 5084 wrote to memory of 3088	5084	DllCommonsvc.exe	100
PID 5084 wrote to memory of 2272	5084	DllCommonsvc.exe	104
PID 5084 wrote to memory of 2272	5084	DllCommonsvc.exe	104
PID 2272 wrote to memory of 4868	2272	cmd.exe	106
PID 2272 wrote to memory of 4868	2272	cmd.exe	106
PID 2272 wrote to memory of 2372	2272	cmd.exe	107
PID 2272 wrote to memory of 2372	2272	cmd.exe	107
PID 2372 wrote to memory of 3892	2372	SearchApp.exe	109
PID 2372 wrote to memory of 3892	2372	SearchApp.exe	109
PID 3892 wrote to memory of 2232	3892	cmd.exe	111
PID 3892 wrote to memory of 2232	3892	cmd.exe	111
PID 3892 wrote to memory of 624	3892	cmd.exe	120
PID 3892 wrote to memory of 624	3892	cmd.exe	120
PID 624 wrote to memory of 664	624	SearchApp.exe	128
PID 624 wrote to memory of 664	624	SearchApp.exe	128
PID 664 wrote to memory of 3472	664	cmd.exe	130
PID 664 wrote to memory of 3472	664	cmd.exe	130
PID 664 wrote to memory of 4340	664	cmd.exe	133
PID 664 wrote to memory of 4340	664	cmd.exe	133
PID 4340 wrote to memory of 3516	4340	SearchApp.exe	135
PID 4340 wrote to memory of 3516	4340	SearchApp.exe	135
PID 3516 wrote to memory of 1560	3516	cmd.exe	137
PID 3516 wrote to memory of 1560	3516	cmd.exe	137
PID 3516 wrote to memory of 3016	3516	cmd.exe	139
PID 3516 wrote to memory of 3016	3516	cmd.exe	139
PID 3016 wrote to memory of 4900	3016	SearchApp.exe	141
PID 3016 wrote to memory of 4900	3016	SearchApp.exe	141
PID 4900 wrote to memory of 2824	4900	cmd.exe	143
PID 4900 wrote to memory of 2824	4900	cmd.exe	143
PID 4900 wrote to memory of 1768	4900	cmd.exe	146
PID 4900 wrote to memory of 1768	4900	cmd.exe	146
PID 1768 wrote to memory of 3024	1768	SearchApp.exe	148
PID 1768 wrote to memory of 3024	1768	SearchApp.exe	148
PID 3024 wrote to memory of 2916	3024	cmd.exe	150
PID 3024 wrote to memory of 2916	3024	cmd.exe	150
PID 3024 wrote to memory of 1736	3024	cmd.exe	152
PID 3024 wrote to memory of 1736	3024	cmd.exe	152
PID 1736 wrote to memory of 3728	1736	SearchApp.exe	154
PID 1736 wrote to memory of 3728	1736	SearchApp.exe	154
PID 3728 wrote to memory of 3236	3728	cmd.exe	156
PID 3728 wrote to memory of 3236	3728	cmd.exe	156
PID 3728 wrote to memory of 3904	3728	cmd.exe	158
PID 3728 wrote to memory of 3904	3728	cmd.exe	158
PID 3904 wrote to memory of 2848	3904	SearchApp.exe	160
PID 3904 wrote to memory of 2848	3904	SearchApp.exe	160
PID 2848 wrote to memory of 2368	2848	cmd.exe	162
PID 2848 wrote to memory of 2368	2848	cmd.exe	162
PID 2848 wrote to memory of 4228	2848	cmd.exe	164
PID 2848 wrote to memory of 4228	2848	cmd.exe	164
PID 4228 wrote to memory of 3668	4228	SearchApp.exe	166
PID 4228 wrote to memory of 3668	4228	SearchApp.exe	166

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_45df2dd1cc96f978cb9f0bdceed8a3b4f9dd62622e955175a63cd0fd2cce2b27.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_45df2dd1cc96f978cb9f0bdceed8a3b4f9dd62622e955175a63cd0fd2cce2b27.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:708
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1348
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2632
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Program Files directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5084
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2444
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\AppData\Roaming\SearchApp.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3692
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft.NET\RedistList\sysmon.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3088
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\9K9HDNuhOt.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2272
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:4868
      - C:\Users\Default\AppData\Roaming\SearchApp.exe
        
        "C:\Users\Default\AppData\Roaming\SearchApp.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2372
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\qX4ufk0Q6M.bat"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:3892
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:2232
        
        C:\Users\Default\AppData\Roaming\SearchApp.exe
        
        "C:\Users\Default\AppData\Roaming\SearchApp.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:624
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ELjGFNzRMY.bat"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:664
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:3472
        
        C:\Users\Default\AppData\Roaming\SearchApp.exe
        
        "C:\Users\Default\AppData\Roaming\SearchApp.exe"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4340
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\HGlJwS3LgK.bat"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:3516
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:1560
        
        C:\Users\Default\AppData\Roaming\SearchApp.exe
        
        "C:\Users\Default\AppData\Roaming\SearchApp.exe"
        12⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3016
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\F5GJdikwFG.bat"
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:4900
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        14⤵
        
        PID:2824
        
        C:\Users\Default\AppData\Roaming\SearchApp.exe
        
        "C:\Users\Default\AppData\Roaming\SearchApp.exe"
        14⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1768
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\WtKWrLEt72.bat"
        15⤵
        Suspicious use of WriteProcessMemory
        
        PID:3024
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        16⤵
        
        PID:2916
        
        C:\Users\Default\AppData\Roaming\SearchApp.exe
        
        "C:\Users\Default\AppData\Roaming\SearchApp.exe"
        16⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1736
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\uP802u8Cku.bat"
        17⤵
        Suspicious use of WriteProcessMemory
        
        PID:3728
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        18⤵
        
        PID:3236
        
        C:\Users\Default\AppData\Roaming\SearchApp.exe
        
        "C:\Users\Default\AppData\Roaming\SearchApp.exe"
        18⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3904
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\MsMShxucCb.bat"
        19⤵
        Suspicious use of WriteProcessMemory
        
        PID:2848
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        20⤵
        
        PID:2368
        
        C:\Users\Default\AppData\Roaming\SearchApp.exe
        
        "C:\Users\Default\AppData\Roaming\SearchApp.exe"
        20⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4228
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\AMKHlt6LWj.bat"
        21⤵
        
        PID:3668
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        22⤵
        
        PID:1940
        
        C:\Users\Default\AppData\Roaming\SearchApp.exe
        
        "C:\Users\Default\AppData\Roaming\SearchApp.exe"
        22⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2464
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\onYrHPGvDe.bat"
        23⤵
        
        PID:3912
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        24⤵
        
        PID:3496
        
        C:\Users\Default\AppData\Roaming\SearchApp.exe
        
        "C:\Users\Default\AppData\Roaming\SearchApp.exe"
        24⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2828
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\UyITBGB0nG.bat"
        25⤵
        
        PID:4996
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        26⤵
        
        PID:1380
        
        C:\Users\Default\AppData\Roaming\SearchApp.exe
        
        "C:\Users\Default\AppData\Roaming\SearchApp.exe"
        26⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3580
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ELjGFNzRMY.bat"
        27⤵
        
        PID:1796
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        28⤵
        
        PID:1504
        
        C:\Users\Default\AppData\Roaming\SearchApp.exe
        
        "C:\Users\Default\AppData\Roaming\SearchApp.exe"
        28⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4984
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\CIMKRyAEqW.bat"
        29⤵
        
        PID:4396
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        30⤵
        
        PID:4848
        
        C:\Users\Default\AppData\Roaming\SearchApp.exe
        
        "C:\Users\Default\AppData\Roaming\SearchApp.exe"
        30⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 11 /tr "'C:\Users\Default\AppData\Roaming\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Users\Default\AppData\Roaming\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 9 /tr "'C:\Users\Default\AppData\Roaming\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\sysmon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\SearchApp.exe.log

Filesize
1KB

MD5
baf55b95da4a601229647f25dad12878

SHA1
abc16954ebfd213733c4493fc1910164d825cac8

SHA256
ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

SHA512
24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6d3e9c29fe44e90aae6ed30ccf799ca8

SHA1
c7974ef72264bbdf13a2793ccf1aed11bc565dce

SHA256
2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

SHA512
60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Temp\9K9HDNuhOt.bat

Filesize
211B

MD5
cdd4f3afc02118d62886b299fa075708

SHA1
e7993124a947e5ee7d90c1237efa4c996b702404

SHA256
a8ac5982571642d0cb29ac795cb497454fbb835e121e0317307401e345e4b3a3

SHA512
fd52d63b9354a04be2ae2549a0e8658d8463aeeb7d1b0b59f7b3ed49a280981eedb1d7e4b298c1ba8eb1b8eeb6c8193627aba3e60ea1b7c4347fb1e485be3752

Download Submit
C:\Users\Admin\AppData\Local\Temp\AMKHlt6LWj.bat

Filesize
211B

MD5
56765fe06c1b986ed6193502078c741c

SHA1
8ba1586dc4133ea7af911154e657f1e9901ed7f1

SHA256
bc6f269fe6784af6045341b5cc2fbe43e00c02f3fafbfbeda75dc10c1c29ee59

SHA512
8708e76c05c63b7b3d9d67d5134be3a228dd67bec88bd4711edc58549fd21ad523deb9e4ebd3ec7b23258f8a15a5aea9b1213013bf644eb87139e0a9844583ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\CIMKRyAEqW.bat

Filesize
211B

MD5
9219ca2cdee51f7803d3c26941cb8e33

SHA1
42d1ff3d38ec5e0a3dfe5e944ef69564e7ced5bc

SHA256
91583f5eab02baa5c4500a621a0b746dada1885ae91433786e0b3b55f1fdfad9

SHA512
6a5e5f01679682a03328d20eb8e5f2d6a1e89b2824ab64e600415ab367bb21e59a11111ba8ad65e8a8f0b830f2eae89e3f306ed9c558abe21a60f15356e00b1a

Download Submit
C:\Users\Admin\AppData\Local\Temp\ELjGFNzRMY.bat

Filesize
211B

MD5
c1d05bc439518d819f20f116b04df83b

SHA1
d272339d0f7595a03b3d4c26b596b9657e83cffe

SHA256
af844942fda60269c7a67bd60bf3e65da65c2ccf8ab8540c1efed708ec5a259c

SHA512
e902a816384a6e0809e5912bdf6d6140027d4b4573ea4e04ab6e779acefe37758831bb3999f696eed012cc1d91870195aeefcfdf08150d3d145da20b78abfe6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\F5GJdikwFG.bat

Filesize
211B

MD5
3cdcfb0d7f553c80070afa49efd48093

SHA1
a175a5b711bbf3ad616c632bfa03441feaf917a2

SHA256
de25a424cdb36d577c7458f33d0ca4d96b8c7b0822f636ecc23d801f24e1a8c3

SHA512
b829e1c9cf181d5c3d9de2a245ff541037c9a724566da53a558f58a6fe20770ef13c8a460c8e0e9796aecb5e168733fea11bf2d042675082ddd5b545c0c9f0ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\HGlJwS3LgK.bat

Filesize
211B

MD5
6d15c17b3dd62d08eeda8b4d05985a15

SHA1
7be37484bd31d9cf63505286b321ea3e9381cea8

SHA256
b44d6435a15d82761e552000f1f1e09456072309d5575bb981438277c3b8eba6

SHA512
cd64f10608ce6c159ab5dd8dcf344d51bb55ac52b69becbfca7207c083800c453c224d89443bd86d0bfafbf14dc6004b15d6d2bb84284d8c005d6e82676d5b56

Download Submit
C:\Users\Admin\AppData\Local\Temp\MsMShxucCb.bat

Filesize
211B

MD5
1cfaa9d142aa93de826102f87a658ede

SHA1
ca452e5ff8464473222ea32c18424ea9e701dbd6

SHA256
6e0781a1a9e9566a8c5ed7a54c7f02ab39d0d98044672544f16dd28b73909b0d

SHA512
84ff7b1f9a64a354dd66165be5dbfaf9088801b9f8431cfe223dbdbaddf85e85d054bdb8153eb8f189addf5d374a95939ad0139b7aa90664b9394dbde88b4f06

Download Submit
C:\Users\Admin\AppData\Local\Temp\UyITBGB0nG.bat

Filesize
211B

MD5
78bcf6a3122a183455a86537c7c18917

SHA1
b69b811ecf2819b01490a243975d892f881f5723

SHA256
0e1c2678731a9d2dba62cbff60eca47b021cbb5fbb8a306fbf04f0e5dbd52b6b

SHA512
5a68528f139bd4493876a3e09ce9ffaa3f376b1152389f6b6700714dd0a27c89781b4e7e5e63c0b4ead73369145edbb97800a82b5191538bc7831dde25288aaa

Download Submit
C:\Users\Admin\AppData\Local\Temp\WtKWrLEt72.bat

Filesize
211B

MD5
989967cbb8f1b88749d17e24b03173c4

SHA1
7fa76ba304f51d07bf9f807ea07ae4400900c6d1

SHA256
a71d9aa2c853ba4692b42645f8e14798731c4c98fa6014aac885a9a963ffed91

SHA512
88feca8b4deea605c981a2bacfc0e327963fe345327e3cfd0c45e9d27fe309f5e71bc334aa7ca3a04aaea0ea157ed3eed09a493b147cfe3aaaeda062ad7677f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wlafm5s4.4wb.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\onYrHPGvDe.bat

Filesize
211B

MD5
75209531c103701d8a11594c44c1ecf6

SHA1
ddf2ad50a8807e94e55731db0f55378f11b3ecc8

SHA256
dc62329d43289119f4a8bb5484c79722c37f8a414c2d26c0989a8d167226321b

SHA512
838f890a77625dae06ed712fa2b7a12254273325170cdffc01fb0f57900405fbba6709a99d9c2720824c364204749f7383b234bb5c09fad55ad8eba562ffa82d

Download Submit
C:\Users\Admin\AppData\Local\Temp\qX4ufk0Q6M.bat

Filesize
211B

MD5
c9f10d39e192d82ba69450cf71c069ca

SHA1
d75940ee79384022ace78290cf6fce92bf9e7779

SHA256
3c155c06a33754a2981d882758441bf7cee36d15237a1137c5df2e0f91cf0555

SHA512
0445d3c34e9b00baf564f2902f1975a15210f964700d392063ae2e015728aa02505702f868551414913982e6a468b7b06104f841f5b545730a142033eac4525b

Download Submit
C:\Users\Admin\AppData\Local\Temp\uP802u8Cku.bat

Filesize
211B

MD5
f064805f2236b6e261b9170ecbe7d4af

SHA1
7ae0493bb5a80fed273f23598535479f6408e9eb

SHA256
e691f72ede0595c49789afb2424a2987f8735b8d0dd8b5e2e6a5b21abf37377a

SHA512
9226c5422e221b6f48348c8ceeb8fb7d28779db9cba91e855b2693e3d9155766506b16f32eef626d0fd5df8dc9b277451c884c8fe78b51b43358e5aed8f4db43

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/624-75-0x0000000002E20000-0x0000000002E32000-memory.dmp

Filesize
72KB

Download
memory/624-80-0x000000001C660000-0x000000001C7CA000-memory.dmp

Filesize
1.4MB

Download
memory/1736-102-0x0000000002C80000-0x0000000002C92000-memory.dmp

Filesize
72KB

Download
memory/1768-95-0x000000001B870000-0x000000001B882000-memory.dmp

Filesize
72KB

Download
memory/2372-71-0x000000001C630000-0x000000001C6D1000-memory.dmp

Filesize
644KB

Download
memory/2828-128-0x0000000002730000-0x0000000002742000-memory.dmp

Filesize
72KB

Download
memory/3692-26-0x000002363D940000-0x000002363D962000-memory.dmp

Filesize
136KB

Download
memory/3904-109-0x0000000003120000-0x0000000003132000-memory.dmp

Filesize
72KB

Download
memory/5084-15-0x000000001B280000-0x000000001B28C000-memory.dmp

Filesize
48KB

Download
memory/5084-13-0x0000000000670000-0x0000000000780000-memory.dmp

Filesize
1.1MB

Download
memory/5084-12-0x00007FF840743000-0x00007FF840745000-memory.dmp

Filesize
8KB

Download
memory/5084-14-0x000000001B270000-0x000000001B282000-memory.dmp

Filesize
72KB

Download
memory/5084-16-0x000000001B290000-0x000000001B29C000-memory.dmp

Filesize
48KB

Download
memory/5084-17-0x000000001B2A0000-0x000000001B2AC000-memory.dmp

Filesize
48KB

Download