dcrat | 149fe8cb0905736943f27c64c3dbacfc42a84ceed4d78066566efb08c9e282e5

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22-12-2024 06:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_149fe8cb0905736943f27c64c3dbacfc42a84ceed4d78066566efb08c9e282e5.exe
Size

1.3MB
MD5

909e4d9c469f768c67cbd955bf3a9bbd
SHA1

751ce64503b9d2d345ab82d7e939602aeb833b5e
SHA256

149fe8cb0905736943f27c64c3dbacfc42a84ceed4d78066566efb08c9e282e5
SHA512

b1cca4617c564c5490a0e57b60b33f3e9e13070d242bb402ff24e31a2bffa9107e9f58826fb7ae4409af37044cfd508070e697c0293ac46c1f6bd17409ea3aaa
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 9 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2648	2620	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2952	2620	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2816	2620	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2668	2620	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2616	2620	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2676	2620	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3056	2620	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	984	2620	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1536	2620	schtasks.exe	34

DCRat payload 9 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0008000000015cd1-12.dat	dcrat
behavioral1/memory/2080-13-0x00000000010E0000-0x00000000011F0000-memory.dmp	dcrat
behavioral1/memory/1428-30-0x0000000000310000-0x0000000000420000-memory.dmp	dcrat
behavioral1/memory/2284-110-0x0000000000040000-0x0000000000150000-memory.dmp	dcrat
behavioral1/memory/2684-170-0x00000000010B0000-0x00000000011C0000-memory.dmp	dcrat
behavioral1/memory/1480-231-0x0000000001100000-0x0000000001210000-memory.dmp	dcrat
behavioral1/memory/2264-351-0x0000000000010000-0x0000000000120000-memory.dmp	dcrat
behavioral1/memory/2676-411-0x0000000000200000-0x0000000000310000-memory.dmp	dcrat
behavioral1/memory/2712-472-0x00000000012B0000-0x00000000013C0000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1872	powershell.exe
1480	powershell.exe
1764	powershell.exe
1572	powershell.exe

Executes dropped EXE 12 IoCs

pid	Process
2080	DllCommonsvc.exe
1428	audiodg.exe
2284	audiodg.exe
2684	audiodg.exe
1480	audiodg.exe
2304	audiodg.exe
2264	audiodg.exe
2676	audiodg.exe
2712	audiodg.exe
3044	audiodg.exe
2656	audiodg.exe
596	audiodg.exe

Loads dropped DLL 2 IoCs

pid	Process
2556	cmd.exe
2556	cmd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 11 IoCs

Web Service

T1102

flow	ioc
4	raw.githubusercontent.com
16	raw.githubusercontent.com
29	raw.githubusercontent.com
5	raw.githubusercontent.com
9	raw.githubusercontent.com
12	raw.githubusercontent.com
19	raw.githubusercontent.com
22	raw.githubusercontent.com
26	raw.githubusercontent.com
33	raw.githubusercontent.com
36	raw.githubusercontent.com

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Games\More Games\fr-FR\c5b4cb5e9653cc	DllCommonsvc.exe
File created	C:\Program Files\Uninstall Information\audiodg.exe	DllCommonsvc.exe
File created	C:\Program Files\Uninstall Information\42af1c969fbb7b	DllCommonsvc.exe
File created	C:\Program Files\Microsoft Games\More Games\fr-FR\services.exe	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_149fe8cb0905736943f27c64c3dbacfc42a84ceed4d78066566efb08c9e282e5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 9 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2648	schtasks.exe
2816	schtasks.exe
3056	schtasks.exe
984	schtasks.exe
1536	schtasks.exe
2952	schtasks.exe
2668	schtasks.exe
2616	schtasks.exe
2676	schtasks.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
2080	DllCommonsvc.exe
2080	DllCommonsvc.exe
2080	DllCommonsvc.exe
2080	DllCommonsvc.exe
2080	DllCommonsvc.exe
2080	DllCommonsvc.exe
2080	DllCommonsvc.exe
1872	powershell.exe
1764	powershell.exe
1572	powershell.exe
1480	powershell.exe
1428	audiodg.exe
2284	audiodg.exe
2684	audiodg.exe
1480	audiodg.exe
2304	audiodg.exe
2264	audiodg.exe
2676	audiodg.exe
2712	audiodg.exe
3044	audiodg.exe
2656	audiodg.exe
596	audiodg.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeDebugPrivilege	2080	DllCommonsvc.exe
Token: SeDebugPrivilege	1428	audiodg.exe
Token: SeDebugPrivilege	1872	powershell.exe
Token: SeDebugPrivilege	1764	powershell.exe
Token: SeDebugPrivilege	1572	powershell.exe
Token: SeDebugPrivilege	1480	powershell.exe
Token: SeDebugPrivilege	2284	audiodg.exe
Token: SeDebugPrivilege	2684	audiodg.exe
Token: SeDebugPrivilege	1480	audiodg.exe
Token: SeDebugPrivilege	2304	audiodg.exe
Token: SeDebugPrivilege	2264	audiodg.exe
Token: SeDebugPrivilege	2676	audiodg.exe
Token: SeDebugPrivilege	2712	audiodg.exe
Token: SeDebugPrivilege	3044	audiodg.exe
Token: SeDebugPrivilege	2656	audiodg.exe
Token: SeDebugPrivilege	596	audiodg.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2428 wrote to memory of 2256	2428	JaffaCakes118_149fe8cb0905736943f27c64c3dbacfc42a84ceed4d78066566efb08c9e282e5.exe	30
PID 2428 wrote to memory of 2256	2428	JaffaCakes118_149fe8cb0905736943f27c64c3dbacfc42a84ceed4d78066566efb08c9e282e5.exe	30
PID 2428 wrote to memory of 2256	2428	JaffaCakes118_149fe8cb0905736943f27c64c3dbacfc42a84ceed4d78066566efb08c9e282e5.exe	30
PID 2428 wrote to memory of 2256	2428	JaffaCakes118_149fe8cb0905736943f27c64c3dbacfc42a84ceed4d78066566efb08c9e282e5.exe	30
PID 2256 wrote to memory of 2556	2256	WScript.exe	31
PID 2256 wrote to memory of 2556	2256	WScript.exe	31
PID 2256 wrote to memory of 2556	2256	WScript.exe	31
PID 2256 wrote to memory of 2556	2256	WScript.exe	31
PID 2556 wrote to memory of 2080	2556	cmd.exe	33
PID 2556 wrote to memory of 2080	2556	cmd.exe	33
PID 2556 wrote to memory of 2080	2556	cmd.exe	33
PID 2556 wrote to memory of 2080	2556	cmd.exe	33
PID 2080 wrote to memory of 1572	2080	DllCommonsvc.exe	44
PID 2080 wrote to memory of 1572	2080	DllCommonsvc.exe	44
PID 2080 wrote to memory of 1572	2080	DllCommonsvc.exe	44
PID 2080 wrote to memory of 1872	2080	DllCommonsvc.exe	45
PID 2080 wrote to memory of 1872	2080	DllCommonsvc.exe	45
PID 2080 wrote to memory of 1872	2080	DllCommonsvc.exe	45
PID 2080 wrote to memory of 1480	2080	DllCommonsvc.exe	46
PID 2080 wrote to memory of 1480	2080	DllCommonsvc.exe	46
PID 2080 wrote to memory of 1480	2080	DllCommonsvc.exe	46
PID 2080 wrote to memory of 1764	2080	DllCommonsvc.exe	47
PID 2080 wrote to memory of 1764	2080	DllCommonsvc.exe	47
PID 2080 wrote to memory of 1764	2080	DllCommonsvc.exe	47
PID 2080 wrote to memory of 1428	2080	DllCommonsvc.exe	52
PID 2080 wrote to memory of 1428	2080	DllCommonsvc.exe	52
PID 2080 wrote to memory of 1428	2080	DllCommonsvc.exe	52
PID 1428 wrote to memory of 1036	1428	audiodg.exe	54
PID 1428 wrote to memory of 1036	1428	audiodg.exe	54
PID 1428 wrote to memory of 1036	1428	audiodg.exe	54
PID 1036 wrote to memory of 1652	1036	cmd.exe	56
PID 1036 wrote to memory of 1652	1036	cmd.exe	56
PID 1036 wrote to memory of 1652	1036	cmd.exe	56
PID 1036 wrote to memory of 2284	1036	cmd.exe	57
PID 1036 wrote to memory of 2284	1036	cmd.exe	57
PID 1036 wrote to memory of 2284	1036	cmd.exe	57
PID 2284 wrote to memory of 2876	2284	audiodg.exe	58
PID 2284 wrote to memory of 2876	2284	audiodg.exe	58
PID 2284 wrote to memory of 2876	2284	audiodg.exe	58
PID 2876 wrote to memory of 2624	2876	cmd.exe	60
PID 2876 wrote to memory of 2624	2876	cmd.exe	60
PID 2876 wrote to memory of 2624	2876	cmd.exe	60
PID 2876 wrote to memory of 2684	2876	cmd.exe	61
PID 2876 wrote to memory of 2684	2876	cmd.exe	61
PID 2876 wrote to memory of 2684	2876	cmd.exe	61
PID 2684 wrote to memory of 1284	2684	audiodg.exe	62
PID 2684 wrote to memory of 1284	2684	audiodg.exe	62
PID 2684 wrote to memory of 1284	2684	audiodg.exe	62
PID 1284 wrote to memory of 2796	1284	cmd.exe	64
PID 1284 wrote to memory of 2796	1284	cmd.exe	64
PID 1284 wrote to memory of 2796	1284	cmd.exe	64
PID 1284 wrote to memory of 1480	1284	cmd.exe	65
PID 1284 wrote to memory of 1480	1284	cmd.exe	65
PID 1284 wrote to memory of 1480	1284	cmd.exe	65
PID 1480 wrote to memory of 2988	1480	audiodg.exe	66
PID 1480 wrote to memory of 2988	1480	audiodg.exe	66
PID 1480 wrote to memory of 2988	1480	audiodg.exe	66
PID 2988 wrote to memory of 2680	2988	cmd.exe	68
PID 2988 wrote to memory of 2680	2988	cmd.exe	68
PID 2988 wrote to memory of 2680	2988	cmd.exe	68
PID 2988 wrote to memory of 2304	2988	cmd.exe	69
PID 2988 wrote to memory of 2304	2988	cmd.exe	69
PID 2988 wrote to memory of 2304	2988	cmd.exe	69
PID 2304 wrote to memory of 2840	2304	audiodg.exe	70

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_149fe8cb0905736943f27c64c3dbacfc42a84ceed4d78066566efb08c9e282e5.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_149fe8cb0905736943f27c64c3dbacfc42a84ceed4d78066566efb08c9e282e5.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2428
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2256
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2556
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2080
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1572
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\System.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1872
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Uninstall Information\audiodg.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1480
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Microsoft Games\More Games\fr-FR\services.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1764
    - - C:\Program Files\Uninstall Information\audiodg.exe
        
        "C:\Program Files\Uninstall Information\audiodg.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1428
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\x8TIUMdSeB.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1036
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:1652
        
        C:\Program Files\Uninstall Information\audiodg.exe
        
        "C:\Program Files\Uninstall Information\audiodg.exe"
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2284
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\mQe7zIwqSA.bat"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:2876
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:2624
        
        C:\Program Files\Uninstall Information\audiodg.exe
        
        "C:\Program Files\Uninstall Information\audiodg.exe"
        9⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2684
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\kyAhxuXJBD.bat"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:1284
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:2796
        
        C:\Program Files\Uninstall Information\audiodg.exe
        
        "C:\Program Files\Uninstall Information\audiodg.exe"
        11⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1480
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\o4pIGJu18c.bat"
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:2988
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:2680
        
        C:\Program Files\Uninstall Information\audiodg.exe
        
        "C:\Program Files\Uninstall Information\audiodg.exe"
        13⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2304
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\RBOUzXbIOW.bat"
        14⤵
        
        PID:2840
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        15⤵
        
        PID:2580
        
        C:\Program Files\Uninstall Information\audiodg.exe
        
        "C:\Program Files\Uninstall Information\audiodg.exe"
        15⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2264
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\1Gu59oh2IN.bat"
        16⤵
        
        PID:1796
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        17⤵
        
        PID:1712
        
        C:\Program Files\Uninstall Information\audiodg.exe
        
        "C:\Program Files\Uninstall Information\audiodg.exe"
        17⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2676
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\8Lq6d7xQt2.bat"
        18⤵
        
        PID:1548
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        19⤵
        
        PID:1768
        
        C:\Program Files\Uninstall Information\audiodg.exe
        
        "C:\Program Files\Uninstall Information\audiodg.exe"
        19⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2712
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\dgWvFyiHB2.bat"
        20⤵
        
        PID:476
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        21⤵
        
        PID:1716
        
        C:\Program Files\Uninstall Information\audiodg.exe
        
        "C:\Program Files\Uninstall Information\audiodg.exe"
        21⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3044
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\TfYr4aOzGb.bat"
        22⤵
        
        PID:2088
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        23⤵
        
        PID:1976
        
        C:\Program Files\Uninstall Information\audiodg.exe
        
        "C:\Program Files\Uninstall Information\audiodg.exe"
        23⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2656
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\cYhs0sn2L6.bat"
        24⤵
        
        PID:1516
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        25⤵
        
        PID:940
        
        C:\Program Files\Uninstall Information\audiodg.exe
        
        "C:\Program Files\Uninstall Information\audiodg.exe"
        25⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 13 /tr "'C:\providercommon\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\providercommon\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 8 /tr "'C:\providercommon\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 5 /tr "'C:\Program Files\Uninstall Information\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 14 /tr "'C:\Program Files\Uninstall Information\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 5 /tr "'C:\Program Files\Microsoft Games\More Games\fr-FR\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files\Microsoft Games\More Games\fr-FR\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 5 /tr "'C:\Program Files\Microsoft Games\More Games\fr-FR\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3659a1ed72d46b8561abf0f1b4cc270e

SHA1
7d33399d9859cc4e578e78ffcb0843ed30f2ccbf

SHA256
ba6d9cf422043082dc83fd817060998ea7a54b3d8237576eaebad845f4e857a4

SHA512
4d7bb578cb4f831e82abece0af43d870be80672d71af71aaf4da01b82c0dfbfc1cad44aeb1c75a6ba1a634811f47058829d5b9f53a9e56516331c95f0e567f88

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2483ad149e7c987875840c4224d7b8d3

SHA1
20447d9808ed12fdc3729222b336691e7916df49

SHA256
8f4104e0c81dc3243ec72236102e4361cb3bc05815a1ad0017a95ef7c6bc9e7c

SHA512
0a6e10fd62cef0b819fa2066643bc7269a90bdd0e88b37e484a7d27f35ee688b20af8b80943fddf71ead1080ae20ef0bb6ee0ee9b6de70447daf97f05a590361

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
83442f2d89626b35c59314a88959ebd4

SHA1
5dab4d433bd71e621dd201031b6142ed921d0b1c

SHA256
d6982b805f04e14e37ced6133c5903465a9b378ee37210fab1cadcd0dccefc48

SHA512
fc02e946719a17d99444718eba95d306930078562a84c455e5b3bdb1091b05ea8ebf2e60e93959f16c5b1999795517db76c9df9058acb00acb51e277528edfbc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
596fae6eece4ca0f5218daaf7ec00751

SHA1
dc9f23c04af3af8ec757e3ffb734f6c837e355c4

SHA256
a29f5d998fc2faffe44efa009a75d5e5a500060da70d44994aa4891a2ef00c69

SHA512
6b7b52bf22004612a0fd35f6656de940a22099f18aad3f3d3a88a9f06867bc6a50f3d9615c67248c44531571fdb435ae9e86d58c834c4d69dc26be469b86988a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1299ab3bf2581f15177c5ce8153f5516

SHA1
e8b7c7079e8507eca7730e6a7fe9e4742cc069d0

SHA256
6b034dcf6a4c4d277baa807b95850e60c746540fdaefeafb59315095972fbeda

SHA512
f3ad39fc20b43e0567b8a853c69330630636a4a92d1e1506252806123546ff2d3798a96f2e67f9eb5c22f5d1def7ce3576068375dbb43002bb6ad20006ada33a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b9ae331692a115008a5562708173ae16

SHA1
3861822bbc5a9ddd9b00e216cb183504d3486bbd

SHA256
a48983bcebbcf8eb8e6e0b311f2b5df69cd344bb74c465a9def5e66b71c0c3e3

SHA512
975a6779a1c9715509c64d0e0fb444af63778d8316e511892518c2132e847c1452cb716639baa2a0a81fbd6fa5caffdfe178ff9f165b316364b78264e05485cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b2c85531de90753611523dec69822218

SHA1
cd6769cef06cb7d1643241da63a1b6834a6fa3c5

SHA256
e41b412373fc92d358e3f0dbc8d4e764c8c399eebe542c6f9618e3dd192528a2

SHA512
6a3c9635fa515738a08839685e320d971bb5f253749c649e91f5731982c0fd701ea9ad30648e8878379f94dce52f39cef2a3f1035ce1ffeb4487ee7c692d192d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3f62f1e5d19f320ab2adcaedac475c56

SHA1
395f50f7b60e90d9d1c0905071ed30bf35b288a9

SHA256
01b53c5d2ea2cae92ec00869cfac28e42a6b2f1982b1055b055d4b8b0d68db70

SHA512
8a841af8b2e2e3e9bc4b8becc2e896040952b5ad284ef3043b9e2c2928b343c931d7a6770fe5963635eee4913b0a663bb66b9d0b2812860bd29be333a6dd9265

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dc018a047777978bc2e2f576ac02b0d0

SHA1
46684905df4e73aa0e503e538cc230e5d9625b87

SHA256
d84bf675eeeda246a293b151906efea114f7374c9a7dd042601a4d555275fb6b

SHA512
29a053381c7e97b49adc27bb6545359f366cab09528ac102ed6ff88b7aca5c8f99874d5f852ad0c1a1cbe3ad88b09e588eb02887ad6f9982c811b785ba6fe6ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\1Gu59oh2IN.bat

Filesize
215B

MD5
9a052cdf63d2feed576c1dc98a65db9b

SHA1
a682f2bfc49ec544b0e3743959e2f2f2787179cc

SHA256
b001cec9a1215ac67f9b347c38fb9cf6dd9b0d05f61d251ec77025c281c3d5e8

SHA512
9d244dec315153ec4aa046ddab23d986a1ac913d558aebc34c2d976e1ec846c78bc204949fb46858aaa2fa287d54f4cf37214700d988bb2612bb5f4a9a392f73

Download Submit
C:\Users\Admin\AppData\Local\Temp\8Lq6d7xQt2.bat

Filesize
215B

MD5
9dbfb46f288dec700a450498e97380bd

SHA1
5bfdc87fc9f299eeac2530d97064943cb678cf14

SHA256
a522dd1dd400e2db367658e735941d765624c788b61ec495f6406eda982d1aa9

SHA512
32b0302a1fa7a959c4f2872060158c0be9856c1c305a1f7694be2482aa29d7d898c2991752941e038cebbd685fef2bd9c234906f8c10c9f9ebcb44de53a90cae

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE523.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\RBOUzXbIOW.bat

Filesize
215B

MD5
10a490b474b98273d6e6692fd61716fb

SHA1
837d0ce6970222dfd08c9eadd090aabb7dcd9642

SHA256
07fd89c0a296498236d61d3cecea2ee20b8f6d91d8f12cdfcb079386804c164f

SHA512
32b2cd9e5acf6635b698c5b3ab82041ce07b78bd21d63da7aaa22b362f49cec23f8d766fba93da1d82f72b14030109dcf2cb38dad038be4127a00f76d662fc52

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE536.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TfYr4aOzGb.bat

Filesize
215B

MD5
003c5bb0f74de04803e247a594117f6b

SHA1
c84b5d659d7db5b5e698f269e780e38aa12ddbcd

SHA256
90c1fc4f14032cef6768561d1322c5eda5396274259929e939ae122d78b78134

SHA512
429249c4d2d7d4989b1c364a148a0ec5540cd660e65ca0b5f9e02b8a380d5b879237d27d30840f869bb84471f581f16aad120685916773a14b1e356c3f7779b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\cYhs0sn2L6.bat

Filesize
215B

MD5
e184bfc16bbe00c438892f49c8c88be6

SHA1
acd37f274e5f844e0385bfaff4f0caaeb2b606b2

SHA256
17ddde8af6f474d1816fe8caabcd78647723b273036192893f907fd2ad506749

SHA512
dafd4805240188461669002da88c3d03b49ddb5dbc65f428898a206dd7faec438a61e5fcb3e223020012193e447960e0210e5af46bff4f3cb2c6c61167a35368

Download Submit
C:\Users\Admin\AppData\Local\Temp\dgWvFyiHB2.bat

Filesize
215B

MD5
c9ed083f55128b029030b6471d3fe36e

SHA1
4735b145cbddbfee34d6504d23f05ad00d604132

SHA256
940e5534944d565c4543e0cf1fa604fe6fdd7d55e3dbfc70852655cc2ba8aba4

SHA512
7a3be0542b7d4a8bce90ec44c02ea49935d900414517838cc77af1d275eff61255224ec4489913229efad4b99706440592bf83b0a2cccfd44deb887816b6b992

Download Submit
C:\Users\Admin\AppData\Local\Temp\kyAhxuXJBD.bat

Filesize
215B

MD5
4341c4438f225b94a75a720c9809f61d

SHA1
7809b5155ad7b79ee607cfa677bc3ffe4096b296

SHA256
bb85886411cac295e1a624be72aa7939814950a922c4bef841adc4c6a6892e5e

SHA512
e5835b7cda433ea6321765617e360fe0cc869e36b58aaa43bfd2ec9c2789e7fbd89164144747962ecde772a1b0593cba3c3238ab1792bbdfbb765d86a7e6dd88

Download Submit
C:\Users\Admin\AppData\Local\Temp\mQe7zIwqSA.bat

Filesize
215B

MD5
f9b0e829c2d8f40f964f76bb2e2fb13c

SHA1
c4e416a78d3fe232782dba2810df55eee966a75f

SHA256
3a7208750925f728f3ac9951279241944de94f6516e69fa41526e3f3f2f231b6

SHA512
cd9e6a1ab20911a43efba87eceea7d9c653c15d8a6d44688fc452015f2758a7e7d2ad22635f363eaa92f781489fe39bbf094bb78ed2c2dba5e5a887d695899b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\o4pIGJu18c.bat

Filesize
215B

MD5
9d51cb8a81ff46a46c37924ce1c4c2dc

SHA1
80c43e19d517c37e9744f77572278d38161b0121

SHA256
3af90a25cfde7ee8347988af900753d5a016c1e1f62a97bc506b9fd8b6ba583f

SHA512
0322e03a843118a5a6a3d9d886075d40f9cdeff004e3165ab8573c3a7a26db58a6bc815f15823d679b59537a9fab246fa492a891da0fe0ed52c6211628a2e20f

Download Submit
C:\Users\Admin\AppData\Local\Temp\x8TIUMdSeB.bat

Filesize
215B

MD5
52216c767d6d8432a04309b2857e8afe

SHA1
9b6b47fc3717865c803242c15ec6595323d1f4cd

SHA256
65f1305ef32f790a5b5cb8d64f1c111f3a50660f796ab32068cec8ec425eae0d

SHA512
12bbc8f4649d915b8268077bf2f7fd1ea575713aff740fb197505def9431799eb24d71852ff32e8ec8641ccefdc1a65ac7a2927dd62f301af32577b43c155bc8

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
5368ff772add45e8a3704554e8aa131f

SHA1
0e8e65ca0e08aa706359378ff01ac9c947a444e3

SHA256
6f5569a04c31e07c86ad9fc8a98196f1f0fbfe79f9f74fa7554dee05f8c2f34d

SHA512
dd23081011b9036d7c8ae79d836fbbcf8f23a143155a494368f2d76332da86792ad1ada25956c8b80988b9a2842349e85405e96f63091092f2c88a279e548268

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/1428-30-0x0000000000310000-0x0000000000420000-memory.dmp

Filesize
1.1MB

Download
memory/1480-231-0x0000000001100000-0x0000000001210000-memory.dmp

Filesize
1.1MB

Download
memory/1480-232-0x0000000000540000-0x0000000000552000-memory.dmp

Filesize
72KB

Download
memory/1764-41-0x000000001B710000-0x000000001B9F2000-memory.dmp

Filesize
2.9MB

Download
memory/1872-42-0x0000000002870000-0x0000000002878000-memory.dmp

Filesize
32KB

Download
memory/2080-16-0x0000000000EF0000-0x0000000000EFC000-memory.dmp

Filesize
48KB

Download
memory/2080-14-0x0000000000150000-0x0000000000162000-memory.dmp

Filesize
72KB

Download
memory/2080-15-0x0000000000350000-0x000000000035C000-memory.dmp

Filesize
48KB

Download
memory/2080-13-0x00000000010E0000-0x00000000011F0000-memory.dmp

Filesize
1.1MB

Download
memory/2080-17-0x0000000000160000-0x000000000016C000-memory.dmp

Filesize
48KB

Download
memory/2264-351-0x0000000000010000-0x0000000000120000-memory.dmp

Filesize
1.1MB

Download
memory/2284-110-0x0000000000040000-0x0000000000150000-memory.dmp

Filesize
1.1MB

Download
memory/2676-411-0x0000000000200000-0x0000000000310000-memory.dmp

Filesize
1.1MB

Download
memory/2676-412-0x0000000000540000-0x0000000000552000-memory.dmp

Filesize
72KB

Download
memory/2684-171-0x00000000003D0000-0x00000000003E2000-memory.dmp

Filesize
72KB

Download
memory/2684-170-0x00000000010B0000-0x00000000011C0000-memory.dmp

Filesize
1.1MB

Download
memory/2712-472-0x00000000012B0000-0x00000000013C0000-memory.dmp

Filesize
1.1MB

Download
memory/2712-473-0x00000000003C0000-0x00000000003D2000-memory.dmp

Filesize
72KB

Download