dcrat | e19af9bd7aec0199c603566326446302ff66feff50b3dac708c6a416771eadbb

Analysis

max time kernel
150s
max time network
149s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
22-12-2024 05:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_e19af9bd7aec0199c603566326446302ff66feff50b3dac708c6a416771eadbb.exe
Size

1.3MB
MD5

e55a30062a818e14ff5daa9ec5cada37
SHA1

b4dc2c9ba9ab3377ab0513bb5b643ed220591790
SHA256

e19af9bd7aec0199c603566326446302ff66feff50b3dac708c6a416771eadbb
SHA512

48654ee090440a7f8199f210c84143bb4b5d37414cc5c566177e0b38f74ec32f61591740db04fe7928340e657ffeb3e466daa3d82d7cec03d591dc316313773e
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 42 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2828	2944	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2892	2944	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2500	2944	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	644	2944	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1388	2944	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1836	2944	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1700	2944	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1720	2944	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2280	2944	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1948	2944	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1564	2944	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1832	2944	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1944	2944	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2960	2944	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2952	2944	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1412	2944	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2300	2944	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2024	2944	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	384	2944	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	548	2944	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2372	2944	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2180	2944	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2408	2944	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2176	2944	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2248	2944	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2232	2944	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	976	2944	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1820	2944	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	904	2944	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2692	2944	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2016	2944	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1964	2944	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2204	2944	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1496	2944	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	592	2944	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1932	2944	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1284	2944	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1536	2944	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2028	2944	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1552	2944	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2636	2944	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1736	2944	schtasks.exe	34

DCRat payload 10 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0009000000018b28-9.dat	dcrat
behavioral1/memory/2032-13-0x0000000000260000-0x0000000000370000-memory.dmp	dcrat
behavioral1/memory/2380-129-0x0000000001350000-0x0000000001460000-memory.dmp	dcrat
behavioral1/memory/1612-249-0x00000000010D0000-0x00000000011E0000-memory.dmp	dcrat
behavioral1/memory/2076-368-0x00000000002B0000-0x00000000003C0000-memory.dmp	dcrat
behavioral1/memory/2996-428-0x0000000000B80000-0x0000000000C90000-memory.dmp	dcrat
behavioral1/memory/436-488-0x0000000000010000-0x0000000000120000-memory.dmp	dcrat
behavioral1/memory/1296-548-0x00000000011F0000-0x0000000001300000-memory.dmp	dcrat
behavioral1/memory/2108-609-0x0000000000360000-0x0000000000470000-memory.dmp	dcrat
behavioral1/memory/2192-669-0x0000000001200000-0x0000000001310000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 15 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1032	powershell.exe
1752	powershell.exe
1616	powershell.exe
2620	powershell.exe
2560	powershell.exe
1808	powershell.exe
2012	powershell.exe
704	powershell.exe
2604	powershell.exe
1332	powershell.exe
2612	powershell.exe
1580	powershell.exe
1680	powershell.exe
2340	powershell.exe
2764	powershell.exe

Executes dropped EXE 11 IoCs

pid	Process
2032	DllCommonsvc.exe
2380	smss.exe
1204	smss.exe
1612	smss.exe
968	smss.exe
2076	smss.exe
2996	smss.exe
436	smss.exe
1296	smss.exe
2108	smss.exe
2192	smss.exe

Loads dropped DLL 2 IoCs

pid	Process
2876	cmd.exe
2876	cmd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 10 IoCs

Web Service

T1102

flow	ioc
12	raw.githubusercontent.com
16	raw.githubusercontent.com
23	raw.githubusercontent.com
26	raw.githubusercontent.com
33	raw.githubusercontent.com
5	raw.githubusercontent.com
9	raw.githubusercontent.com
19	raw.githubusercontent.com
29	raw.githubusercontent.com
4	raw.githubusercontent.com

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\1033\csrss.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\1033\886983d96e3d3e	DllCommonsvc.exe
File created	C:\Program Files\Uninstall Information\dllhost.exe	DllCommonsvc.exe
File created	C:\Program Files\Uninstall Information\5940a34987c991	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\de-DE\WmiPrvSE.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\de-DE\24dbde2999530e	DllCommonsvc.exe
File created	C:\Program Files\DVD Maker\it-IT\csrss.exe	DllCommonsvc.exe
File created	C:\Program Files\DVD Maker\it-IT\886983d96e3d3e	DllCommonsvc.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\assembly\System.exe	DllCommonsvc.exe
File created	C:\Windows\assembly\27d1bcfc3c54e0	DllCommonsvc.exe
File created	C:\Windows\TAPI\smss.exe	DllCommonsvc.exe
File created	C:\Windows\TAPI\69ddcba757bf72	DllCommonsvc.exe
File created	C:\Windows\Tasks\System.exe	DllCommonsvc.exe
File created	C:\Windows\Tasks\27d1bcfc3c54e0	DllCommonsvc.exe
File created	C:\Windows\Media\cmd.exe	DllCommonsvc.exe
File created	C:\Windows\Media\ebf1f9fa8afd6d	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_e19af9bd7aec0199c603566326446302ff66feff50b3dac708c6a416771eadbb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 42 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1944	schtasks.exe
2232	schtasks.exe
904	schtasks.exe
592	schtasks.exe
1836	schtasks.exe
384	schtasks.exe
1820	schtasks.exe
1536	schtasks.exe
1736	schtasks.exe
2892	schtasks.exe
1412	schtasks.exe
1964	schtasks.exe
2204	schtasks.exe
1700	schtasks.exe
2016	schtasks.exe
1496	schtasks.exe
1948	schtasks.exe
1832	schtasks.exe
2952	schtasks.exe
2028	schtasks.exe
2372	schtasks.exe
2180	schtasks.exe
976	schtasks.exe
2692	schtasks.exe
644	schtasks.exe
1720	schtasks.exe
2280	schtasks.exe
2300	schtasks.exe
2176	schtasks.exe
1284	schtasks.exe
1552	schtasks.exe
2636	schtasks.exe
1388	schtasks.exe
2960	schtasks.exe
2024	schtasks.exe
2408	schtasks.exe
2248	schtasks.exe
1932	schtasks.exe
2828	schtasks.exe
2500	schtasks.exe
1564	schtasks.exe
548	schtasks.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
2032	DllCommonsvc.exe
2012	powershell.exe
1332	powershell.exe
1680	powershell.exe
1580	powershell.exe
1032	powershell.exe
2764	powershell.exe
704	powershell.exe
2612	powershell.exe
2560	powershell.exe
2340	powershell.exe
1616	powershell.exe
2620	powershell.exe
1808	powershell.exe
2604	powershell.exe
1752	powershell.exe
2380	smss.exe
1204	smss.exe
1612	smss.exe
968	smss.exe
2076	smss.exe
2996	smss.exe
436	smss.exe
1296	smss.exe
2108	smss.exe
2192	smss.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: SeDebugPrivilege	2032	DllCommonsvc.exe
Token: SeDebugPrivilege	2012	powershell.exe
Token: SeDebugPrivilege	1332	powershell.exe
Token: SeDebugPrivilege	1680	powershell.exe
Token: SeDebugPrivilege	1580	powershell.exe
Token: SeDebugPrivilege	1032	powershell.exe
Token: SeDebugPrivilege	2764	powershell.exe
Token: SeDebugPrivilege	704	powershell.exe
Token: SeDebugPrivilege	2612	powershell.exe
Token: SeDebugPrivilege	2560	powershell.exe
Token: SeDebugPrivilege	2340	powershell.exe
Token: SeDebugPrivilege	1616	powershell.exe
Token: SeDebugPrivilege	2620	powershell.exe
Token: SeDebugPrivilege	1808	powershell.exe
Token: SeDebugPrivilege	2604	powershell.exe
Token: SeDebugPrivilege	1752	powershell.exe
Token: SeDebugPrivilege	2380	smss.exe
Token: SeDebugPrivilege	1204	smss.exe
Token: SeDebugPrivilege	1612	smss.exe
Token: SeDebugPrivilege	968	smss.exe
Token: SeDebugPrivilege	2076	smss.exe
Token: SeDebugPrivilege	2996	smss.exe
Token: SeDebugPrivilege	436	smss.exe
Token: SeDebugPrivilege	1296	smss.exe
Token: SeDebugPrivilege	2108	smss.exe
Token: SeDebugPrivilege	2192	smss.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 1476	2548	JaffaCakes118_e19af9bd7aec0199c603566326446302ff66feff50b3dac708c6a416771eadbb.exe	30
PID 2548 wrote to memory of 1476	2548	JaffaCakes118_e19af9bd7aec0199c603566326446302ff66feff50b3dac708c6a416771eadbb.exe	30
PID 2548 wrote to memory of 1476	2548	JaffaCakes118_e19af9bd7aec0199c603566326446302ff66feff50b3dac708c6a416771eadbb.exe	30
PID 2548 wrote to memory of 1476	2548	JaffaCakes118_e19af9bd7aec0199c603566326446302ff66feff50b3dac708c6a416771eadbb.exe	30
PID 1476 wrote to memory of 2876	1476	WScript.exe	31
PID 1476 wrote to memory of 2876	1476	WScript.exe	31
PID 1476 wrote to memory of 2876	1476	WScript.exe	31
PID 1476 wrote to memory of 2876	1476	WScript.exe	31
PID 2876 wrote to memory of 2032	2876	cmd.exe	33
PID 2876 wrote to memory of 2032	2876	cmd.exe	33
PID 2876 wrote to memory of 2032	2876	cmd.exe	33
PID 2876 wrote to memory of 2032	2876	cmd.exe	33
PID 2032 wrote to memory of 2604	2032	DllCommonsvc.exe	77
PID 2032 wrote to memory of 2604	2032	DllCommonsvc.exe	77
PID 2032 wrote to memory of 2604	2032	DllCommonsvc.exe	77
PID 2032 wrote to memory of 1332	2032	DllCommonsvc.exe	78
PID 2032 wrote to memory of 1332	2032	DllCommonsvc.exe	78
PID 2032 wrote to memory of 1332	2032	DllCommonsvc.exe	78
PID 2032 wrote to memory of 704	2032	DllCommonsvc.exe	79
PID 2032 wrote to memory of 704	2032	DllCommonsvc.exe	79
PID 2032 wrote to memory of 704	2032	DllCommonsvc.exe	79
PID 2032 wrote to memory of 1752	2032	DllCommonsvc.exe	80
PID 2032 wrote to memory of 1752	2032	DllCommonsvc.exe	80
PID 2032 wrote to memory of 1752	2032	DllCommonsvc.exe	80
PID 2032 wrote to memory of 2340	2032	DllCommonsvc.exe	81
PID 2032 wrote to memory of 2340	2032	DllCommonsvc.exe	81
PID 2032 wrote to memory of 2340	2032	DllCommonsvc.exe	81
PID 2032 wrote to memory of 2764	2032	DllCommonsvc.exe	83
PID 2032 wrote to memory of 2764	2032	DllCommonsvc.exe	83
PID 2032 wrote to memory of 2764	2032	DllCommonsvc.exe	83
PID 2032 wrote to memory of 2012	2032	DllCommonsvc.exe	84
PID 2032 wrote to memory of 2012	2032	DllCommonsvc.exe	84
PID 2032 wrote to memory of 2012	2032	DllCommonsvc.exe	84
PID 2032 wrote to memory of 1032	2032	DllCommonsvc.exe	86
PID 2032 wrote to memory of 1032	2032	DllCommonsvc.exe	86
PID 2032 wrote to memory of 1032	2032	DllCommonsvc.exe	86
PID 2032 wrote to memory of 1580	2032	DllCommonsvc.exe	87
PID 2032 wrote to memory of 1580	2032	DllCommonsvc.exe	87
PID 2032 wrote to memory of 1580	2032	DllCommonsvc.exe	87
PID 2032 wrote to memory of 1680	2032	DllCommonsvc.exe	88
PID 2032 wrote to memory of 1680	2032	DllCommonsvc.exe	88
PID 2032 wrote to memory of 1680	2032	DllCommonsvc.exe	88
PID 2032 wrote to memory of 1808	2032	DllCommonsvc.exe	89
PID 2032 wrote to memory of 1808	2032	DllCommonsvc.exe	89
PID 2032 wrote to memory of 1808	2032	DllCommonsvc.exe	89
PID 2032 wrote to memory of 2612	2032	DllCommonsvc.exe	90
PID 2032 wrote to memory of 2612	2032	DllCommonsvc.exe	90
PID 2032 wrote to memory of 2612	2032	DllCommonsvc.exe	90
PID 2032 wrote to memory of 2560	2032	DllCommonsvc.exe	91
PID 2032 wrote to memory of 2560	2032	DllCommonsvc.exe	91
PID 2032 wrote to memory of 2560	2032	DllCommonsvc.exe	91
PID 2032 wrote to memory of 2620	2032	DllCommonsvc.exe	92
PID 2032 wrote to memory of 2620	2032	DllCommonsvc.exe	92
PID 2032 wrote to memory of 2620	2032	DllCommonsvc.exe	92
PID 2032 wrote to memory of 1616	2032	DllCommonsvc.exe	96
PID 2032 wrote to memory of 1616	2032	DllCommonsvc.exe	96
PID 2032 wrote to memory of 1616	2032	DllCommonsvc.exe	96
PID 2032 wrote to memory of 3028	2032	DllCommonsvc.exe	107
PID 2032 wrote to memory of 3028	2032	DllCommonsvc.exe	107
PID 2032 wrote to memory of 3028	2032	DllCommonsvc.exe	107
PID 3028 wrote to memory of 1540	3028	cmd.exe	109
PID 3028 wrote to memory of 1540	3028	cmd.exe	109
PID 3028 wrote to memory of 1540	3028	cmd.exe	109
PID 3028 wrote to memory of 2380	3028	cmd.exe	110

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e19af9bd7aec0199c603566326446302ff66feff50b3dac708c6a416771eadbb.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e19af9bd7aec0199c603566326446302ff66feff50b3dac708c6a416771eadbb.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1476
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2876
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2032
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2604
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Documents\spoolsv.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1332
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Tasks\System.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:704
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Media\cmd.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1752
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\DVD Maker\it-IT\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2340
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\NetHood\cmd.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2764
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\dllhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2012
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\OSPPSVC.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1032
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\1033\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1580
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\assembly\System.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1680
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Uninstall Information\dllhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1808
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Photo Viewer\de-DE\WmiPrvSE.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2612
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\smss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2560
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\TAPI\smss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2620
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\dllhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1616
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Tjn55VIiTw.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3028
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:1540
      - C:\Windows\TAPI\smss.exe
        
        "C:\Windows\TAPI\smss.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2380
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\lHuJ4aKJis.bat"
        7⤵
        
        PID:944
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:2456
        
        C:\Windows\TAPI\smss.exe
        
        "C:\Windows\TAPI\smss.exe"
        8⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1204
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\aMI81VmL1g.bat"
        9⤵
        
        PID:1564
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:2436
        
        C:\Windows\TAPI\smss.exe
        
        "C:\Windows\TAPI\smss.exe"
        10⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1612
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\vF7CrwxjwX.bat"
        11⤵
        
        PID:2808
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:436
        
        C:\Windows\TAPI\smss.exe
        
        "C:\Windows\TAPI\smss.exe"
        12⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:968
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\raSqT8qddO.bat"
        13⤵
        
        PID:2664
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        14⤵
        
        PID:2540
        
        C:\Windows\TAPI\smss.exe
        
        "C:\Windows\TAPI\smss.exe"
        14⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2076
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\W0gPze1DKI.bat"
        15⤵
        
        PID:2840
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        16⤵
        
        PID:572
        
        C:\Windows\TAPI\smss.exe
        
        "C:\Windows\TAPI\smss.exe"
        16⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2996
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\TZCyxGcg3L.bat"
        17⤵
        
        PID:2568
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        18⤵
        
        PID:1972
        
        C:\Windows\TAPI\smss.exe
        
        "C:\Windows\TAPI\smss.exe"
        18⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:436
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\rmFq19iy8Y.bat"
        19⤵
        
        PID:2404
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        20⤵
        
        PID:864
        
        C:\Windows\TAPI\smss.exe
        
        "C:\Windows\TAPI\smss.exe"
        20⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1296
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\tDjG3X7WPV.bat"
        21⤵
        
        PID:1532
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        22⤵
        
        PID:2968
        
        C:\Windows\TAPI\smss.exe
        
        "C:\Windows\TAPI\smss.exe"
        22⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2108
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\QHkN6qNcbm.bat"
        23⤵
        
        PID:2956
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        24⤵
        
        PID:2064
        
        C:\Windows\TAPI\smss.exe
        
        "C:\Windows\TAPI\smss.exe"
        24⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2192

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 13 /tr "'C:\Users\Default\Documents\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Users\Default\Documents\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 14 /tr "'C:\Users\Default\Documents\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2500

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 8 /tr "'C:\Windows\Tasks\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Windows\Tasks\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 8 /tr "'C:\Windows\Tasks\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 9 /tr "'C:\Windows\Media\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Windows\Media\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 10 /tr "'C:\Windows\Media\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2280

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Program Files\DVD Maker\it-IT\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\DVD Maker\it-IT\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Program Files\DVD Maker\it-IT\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\NetHood\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Users\Admin\NetHood\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\NetHood\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\providercommon\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\providercommon\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\providercommon\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 10 /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\OSPPSVC.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:384

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 8 /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\1033\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2180

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\1033\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\1033\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2176

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 5 /tr "'C:\Windows\assembly\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Windows\assembly\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2232

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 11 /tr "'C:\Windows\assembly\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\Program Files\Uninstall Information\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Program Files\Uninstall Information\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Photo Viewer\de-DE\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\de-DE\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Photo Viewer\de-DE\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2204

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 5 /tr "'C:\Users\Default User\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Users\Default User\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 6 /tr "'C:\Users\Default User\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\Windows\TAPI\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\TAPI\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 9 /tr "'C:\Windows\TAPI\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\providercommon\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\providercommon\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\providercommon\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
46a17f7d04401fde4db65d5b24a78455

SHA1
357dd583f3253a269623c178f6445c79bf50c884

SHA256
f6a3179df8f0f18e74dc95ed7d36f33fb772f31f8da911125d2e84fc6a21a7ad

SHA512
a0eaf5a37a649e7afe44cbf1c8f1a719fe43e01027ba8618edc362f3cbd037d5a9e1b4b10b966f0e0a64f971aff1bc403dc0a5d350873d9d4a0c1e47a2b932bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
07dc4cb1ec64dd90d93684bfd5368faf

SHA1
0b199bac1b23015f6c84f4d69309e2d2d5969ad9

SHA256
d2b9b3d478d0bfc22adfef1d742c4cad939b28e8ddc841f6e787711897879c58

SHA512
62578beb9634ce46719bc08345b538f8f5b7db75ae777864fc4cd847e371396e7900d97c2efe4cf1c7af3f4b348e7334b824f082f953b46c11e5a83744ab4d03

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2b13e12779a86794e61f7c414c705809

SHA1
056f15ef797c6b594ee0bacd64a0cfaa6b7407c5

SHA256
caa6ff8542301b84b22255f39cfa3d4f1b64e76cfeabe30ca95bd7a76ad252d3

SHA512
7be2745f329d7039aa003dc5d2e5fbc2a77eebd572af8266d8842e609956e0f62c4d772bea996c49ef06b96c45c840ce4d3b2e0cf5196f0eff293cb1e4077d5d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1735caff782583295b3a2af0836a617f

SHA1
b542bec817c4b182b87071d548c03cddc9b78a41

SHA256
b469a0ce0544c0315afea636b474235171e2a78c99c4153976280bfee8ce3633

SHA512
6bca1290f0bab186a6d4d62ccf49d9fbf63e2a9e23bf73d75fd99b180242eaa02503e3ff1e096b2c7bbd1ce74a37efeb41fb811815862366aab03683ca8772e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
286a83c84cdacb5c4c5a4013853aa9d0

SHA1
4c7f2f12b7f8233944425fa9e5b015f37245500f

SHA256
91fcd4e1779cf1f9c1e51924c220414d143a0938f043a132d8839c2c0f953f0e

SHA512
a0b42638e56019b8780b59f0cf5cc318fc149dbbbbcc9cbfafebcde91a7d9cb6d42919ba88fde7545e2b513cf83e3b5feb62c97d67465edef8e78633a598f986

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
01781c19f088a6a58798713e93421495

SHA1
94768b6923a6f1207f828cda9f7aa68410c6543b

SHA256
2358baebd6d0d2f00f1edd220751cd2dd4cdd0e17292f84e2f45ff31d4d49ef6

SHA512
41dc05ed475a2d1160b898bbf1f82b5caa45b7fb80f42c1acf9db71d5d262d9b058a3f97085de04b5f6994bccc84dbfe6058bf274c11fd66bb2209ccb7b11eef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dc1beb75bd12c662dd710ea057b8681e

SHA1
4e8cb2ce5ed1e1995b8c3b5e2cb21731bb2e4438

SHA256
a11ba7bb051a93f858409325e9b1506c24ab9cf2291f7040bcb60fc42db24f6a

SHA512
059bd7e527549abe64c8bfa9e99d57cf64e0cfbc5e05a0476353af394caad451411a3eed2bcc0e814e4166ccb447e144ef152735a6fa60699d7c51b2b35e8763

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aa6a459de231d9a6d358121e66edcbcb

SHA1
b763e5cc6b27275a537156822fbd738e862f32a0

SHA256
3ca5faebb84b4e981239383b82c7b8e20af5ac03db7f8f68fddadb58c71c9bdc

SHA512
6515cf49140d727cd14caedcd3b49a1dc2f5d76682efd5c606ef2749f8e564418c48bfc268934688ee4a785aba0ea4a9dae320908b9eaa25a4a99141e45d9783

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab762.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\QHkN6qNcbm.bat

Filesize
189B

MD5
eb99b0348af2868dfbbdf9f3a6fc227d

SHA1
8718400337f394759fb7705c1df3b0eb6e1c7e36

SHA256
710c2a2411e62f61b3f17d5537f39468b432b214b7d48b5727729eefeabc762a

SHA512
05c57b61ef3cee810f10064e1d438a7c0fe9e6a0abbaf0d338ff458b0c604beda6923549a1f48dbcc948ad206e94ca1731b826b35d96194cce7a31f0cca1b81d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TZCyxGcg3L.bat

Filesize
189B

MD5
487835b3b122b0052f9fd648b719c6fe

SHA1
a54d8c26d7f8a4075451ce42166db559e0538944

SHA256
70b77a6e6e8d9140e6af84e6b4e558b0edc66d1b5c41df538149c309456d0e54

SHA512
fa22613038df580ea9dcb3742d4544d630ade43ec35201126d37efbb3b284c19c6f6cd2005ad6cfd98908d7f3cc8d058a19e917520bd0d9c7b3c434e53a2513a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar785.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tjn55VIiTw.bat

Filesize
189B

MD5
60d2ec6c3f27d7ee99588345060ad305

SHA1
dbc23af4a9c09ef74c059bc2c219693fb226bffa

SHA256
7599608d2ebf9096d9326ce23e2b8007955ac14fc9ab234d5e6656604dde7178

SHA512
d7e0f23b09c442ac27f93ba5a496d7d6fc801b59290c76f2df479e220f44d6043d5acffcfd6fe18cc358c48c264eb3eb49742b6c932f9d0207161f821529246b

Download Submit
C:\Users\Admin\AppData\Local\Temp\W0gPze1DKI.bat

Filesize
189B

MD5
a5246515bedc410619a8b356e2c3e244

SHA1
772f68afd94b3eb43af5aa2e1aadc2ef27065cd3

SHA256
99d50d671cfe7e534a40b7685f236bbd6c50044262e9a05ddd08b752ca1ce61a

SHA512
9ff624686582eb06712a140372b2334c7f86023bc37ad9979adaaac8cec8e8478cd71650c4e484f8aecfbe3a4477279574f047cc0cb32fcc184801a689d0c283

Download Submit
C:\Users\Admin\AppData\Local\Temp\aMI81VmL1g.bat

Filesize
189B

MD5
38c4f3de21db1caa9af79a0cf0147b47

SHA1
f072e362fa422c6263ab65e33bfb8899709c875e

SHA256
330c20b212ec1fa423d7c38c51e5e523064a22e160f163faff35151f3e05ef33

SHA512
d189d708d3b0d2a4773d3f55b1e8d0be2b0bd455c24e1481502af3d4c5c9b0812303135f516ea624a2cd541e4c0351c74582e2e8a59e8f1b6bad7a39f57dcaf1

Download Submit
C:\Users\Admin\AppData\Local\Temp\lHuJ4aKJis.bat

Filesize
189B

MD5
3a8a266cfb0250fdbbc5a96f085758c7

SHA1
e2013b4bb49b31566a2d305ae531cbcb66120c9c

SHA256
2915869029a87cd9cc8d6c92a95ba6e0175f8b8d90a57bff1d88ff4a45dd8b11

SHA512
a74a709f3d15909fb830d7c359e4e93c30a8d95b0e5927bcded28339c56935d83d8d6f35987b6b82d25a14ba07c6b7243b666f16149d1ae975542f4ed9cefcbb

Download Submit
C:\Users\Admin\AppData\Local\Temp\raSqT8qddO.bat

Filesize
189B

MD5
a7b29737e58231487dc781971f07a387

SHA1
8607005f198274ad00372d1c1988b4144b0e68ae

SHA256
6dd2c55182b3577948d599c67381e08abfa3042ce39f281f68edb059367981a8

SHA512
858857ade198f11da4e3437c0675f5ae6619dbaa534a2241af2ebc0f367d15b2046c1a5eeda60eb2526805e4ec8bf54829bf344e43b6187009b860ae5c0c5163

Download Submit
C:\Users\Admin\AppData\Local\Temp\rmFq19iy8Y.bat

Filesize
189B

MD5
b2fe501e1ae31dcb8efbbcd2f36c5809

SHA1
2866012b6f5a507db7ea2f1aadf83cddf2a4df26

SHA256
2323d01e29c46f95b7e89b591099365d78c5199a386b13f41106877c6d8dc92e

SHA512
a85dcc63de63f406e834472a82d52e131ef974a18afc805a4e50cc87cb6b531b5b26ef6da91d994b2f54199278af1f70cb5f1b13d6e6bbb4a2fc64f0dc970df5

Download Submit
C:\Users\Admin\AppData\Local\Temp\tDjG3X7WPV.bat

Filesize
189B

MD5
2f0aca394e9befd4d75ebfaba2efc965

SHA1
d416f8093f77e744dd5fec1121ebfe721c162b60

SHA256
0f503f1d21653c9ca3bb548095c0e6c56722253660bcbb03262ec2dca6cd7749

SHA512
93da8c34cb6da51b628dc5e39a8d96ac42fae94bf25e0465221949ce1c63c8e6c935116fce906107c5328d8644ecd4f357349d91abf658605f5d434cde077152

Download Submit
C:\Users\Admin\AppData\Local\Temp\vF7CrwxjwX.bat

Filesize
189B

MD5
c603dff4dba82459c76e6eb3be8a3e69

SHA1
9e7588de00904ae2961ecf31c80b8cbf4e8f2ccc

SHA256
f86f429fdcdca8a97d13535fd80752a9232aa7d3b603a789df5a6c35e9783928

SHA512
92263a2f8b49d6510adba9e7829e2e8481a7191c71a3d38ec77ed253af8992dc6fc5cbdccc851e3202c1e6ba32c093bb4c5b7200f0a7b7f2e341a3a57beba8fc

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\GWO3R98BBNIKIFQHHJ7L.temp

Filesize
7KB

MD5
d906af51e0f0097b8a641e8ba2cade23

SHA1
6384c1a268c49fd2d994f2a98b6f7b3dc6527cd2

SHA256
08f7861a1b2e9a6c51a32a945eebd9ad6f000dbc819bca0bc5f32834b9db6a47

SHA512
6085696b635c9966683d89ba09ca93db791c5d72b535c5cedf842e640b6440bbfb5b3bac46040f710411c43e1ff987de740d06013b1f8dec79eeb84fe512aa36

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
memory/436-488-0x0000000000010000-0x0000000000120000-memory.dmp

Filesize
1.1MB

Download
memory/1204-189-0x0000000000240000-0x0000000000252000-memory.dmp

Filesize
72KB

Download
memory/1296-549-0x00000000002C0000-0x00000000002D2000-memory.dmp

Filesize
72KB

Download
memory/1296-548-0x00000000011F0000-0x0000000001300000-memory.dmp

Filesize
1.1MB

Download
memory/1612-249-0x00000000010D0000-0x00000000011E0000-memory.dmp

Filesize
1.1MB

Download
memory/2012-65-0x0000000002410000-0x0000000002418000-memory.dmp

Filesize
32KB

Download
memory/2012-64-0x000000001B1D0000-0x000000001B4B2000-memory.dmp

Filesize
2.9MB

Download
memory/2032-15-0x0000000000250000-0x000000000025C000-memory.dmp

Filesize
48KB

Download
memory/2032-13-0x0000000000260000-0x0000000000370000-memory.dmp

Filesize
1.1MB

Download
memory/2032-14-0x00000000001C0000-0x00000000001D2000-memory.dmp

Filesize
72KB

Download
memory/2032-17-0x0000000000380000-0x000000000038C000-memory.dmp

Filesize
48KB

Download
memory/2032-16-0x0000000000370000-0x000000000037C000-memory.dmp

Filesize
48KB

Download
memory/2076-368-0x00000000002B0000-0x00000000003C0000-memory.dmp

Filesize
1.1MB

Download
memory/2108-609-0x0000000000360000-0x0000000000470000-memory.dmp

Filesize
1.1MB

Download
memory/2192-669-0x0000000001200000-0x0000000001310000-memory.dmp

Filesize
1.1MB

Download
memory/2380-129-0x0000000001350000-0x0000000001460000-memory.dmp

Filesize
1.1MB

Download
memory/2380-130-0x0000000000440000-0x0000000000452000-memory.dmp

Filesize
72KB

Download
memory/2996-428-0x0000000000B80000-0x0000000000C90000-memory.dmp

Filesize
1.1MB

Download