dcrat | ceb3185469a2c0d23d25d9aa176943d04f9f7617d342bb20f187dc77105bee7c

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2024 06:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_ceb3185469a2c0d23d25d9aa176943d04f9f7617d342bb20f187dc77105bee7c.exe
Size

1.3MB
MD5

6ebb52511ef8fe3c68ea92efdb130b92
SHA1

32b434b83d3cf23fd1da29d0d3ba0d140f0a4cea
SHA256

ceb3185469a2c0d23d25d9aa176943d04f9f7617d342bb20f187dc77105bee7c
SHA512

c71cc4166832eda2f899969d54b39016b3dcf979be9c1d0961581f0fa60f529bf353847117ca1b3b2dcc90551c0b58ee97cac307e71ea075f748bcfcc49174d9
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 12 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2552	4472	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4280	4472	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3800	4472	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4596	4472	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4056	4472	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5080	4472	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2012	4472	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1288	4472	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3444	4472	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	428	4472	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	972	4472	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4004	4472	schtasks.exe	86

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x0007000000023ca6-10.dat	dcrat
behavioral2/memory/4740-13-0x0000000000B70000-0x0000000000C80000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
116	powershell.exe
4924	powershell.exe
3572	powershell.exe
3772	powershell.exe
4608	powershell.exe

Checks computer location settings 2 TTPs 15 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	JaffaCakes118_ceb3185469a2c0d23d25d9aa176943d04f9f7617d342bb20f187dc77105bee7c.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	Idle.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	Idle.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	Idle.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	Idle.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	Idle.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	Idle.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	Idle.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	Idle.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	Idle.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	Idle.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	Idle.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	Idle.exe

Executes dropped EXE 14 IoCs

pid	Process
4740	DllCommonsvc.exe
4372	Idle.exe
4500	Idle.exe
184	Idle.exe
2784	Idle.exe
4288	Idle.exe
2628	Idle.exe
2624	Idle.exe
4944	Idle.exe
972	Idle.exe
4820	Idle.exe
1936	Idle.exe
2644	Idle.exe
1480	Idle.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 13 IoCs

Web Service

T1102

flow	ioc
46	raw.githubusercontent.com
53	raw.githubusercontent.com
55	raw.githubusercontent.com
13	raw.githubusercontent.com
27	raw.githubusercontent.com
40	raw.githubusercontent.com
45	raw.githubusercontent.com
47	raw.githubusercontent.com
54	raw.githubusercontent.com
56	raw.githubusercontent.com
14	raw.githubusercontent.com
19	raw.githubusercontent.com
42	raw.githubusercontent.com

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Google\Temp\RuntimeBroker.exe	DllCommonsvc.exe
File opened for modification	C:\Program Files (x86)\Google\Temp\RuntimeBroker.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Google\Temp\9e8d7a4ca61bd9	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_ceb3185469a2c0d23d25d9aa176943d04f9f7617d342bb20f187dc77105bee7c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 13 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	Idle.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	Idle.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	Idle.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	Idle.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	Idle.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	Idle.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	JaffaCakes118_ceb3185469a2c0d23d25d9aa176943d04f9f7617d342bb20f187dc77105bee7c.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	Idle.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	Idle.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	Idle.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	Idle.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	Idle.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	Idle.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 12 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3444	schtasks.exe
428	schtasks.exe
2552	schtasks.exe
4280	schtasks.exe
4596	schtasks.exe
1288	schtasks.exe
972	schtasks.exe
4004	schtasks.exe
3800	schtasks.exe
4056	schtasks.exe
5080	schtasks.exe
2012	schtasks.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
4740	DllCommonsvc.exe
3772	powershell.exe
3572	powershell.exe
4608	powershell.exe
4924	powershell.exe
116	powershell.exe
4372	Idle.exe
3772	powershell.exe
3572	powershell.exe
4608	powershell.exe
4924	powershell.exe
116	powershell.exe
4500	Idle.exe
184	Idle.exe
2784	Idle.exe
4288	Idle.exe
2628	Idle.exe
2624	Idle.exe
4944	Idle.exe
972	Idle.exe
4820	Idle.exe
1936	Idle.exe
2644	Idle.exe
1480	Idle.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	4740	DllCommonsvc.exe
Token: SeDebugPrivilege	3572	powershell.exe
Token: SeDebugPrivilege	3772	powershell.exe
Token: SeDebugPrivilege	4608	powershell.exe
Token: SeDebugPrivilege	4372	Idle.exe
Token: SeDebugPrivilege	4924	powershell.exe
Token: SeDebugPrivilege	116	powershell.exe
Token: SeDebugPrivilege	4500	Idle.exe
Token: SeDebugPrivilege	184	Idle.exe
Token: SeDebugPrivilege	2784	Idle.exe
Token: SeDebugPrivilege	4288	Idle.exe
Token: SeDebugPrivilege	2628	Idle.exe
Token: SeDebugPrivilege	2624	Idle.exe
Token: SeDebugPrivilege	4944	Idle.exe
Token: SeDebugPrivilege	972	Idle.exe
Token: SeDebugPrivilege	4820	Idle.exe
Token: SeDebugPrivilege	1936	Idle.exe
Token: SeDebugPrivilege	2644	Idle.exe
Token: SeDebugPrivilege	1480	Idle.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2492 wrote to memory of 1076	2492	JaffaCakes118_ceb3185469a2c0d23d25d9aa176943d04f9f7617d342bb20f187dc77105bee7c.exe	82
PID 2492 wrote to memory of 1076	2492	JaffaCakes118_ceb3185469a2c0d23d25d9aa176943d04f9f7617d342bb20f187dc77105bee7c.exe	82
PID 2492 wrote to memory of 1076	2492	JaffaCakes118_ceb3185469a2c0d23d25d9aa176943d04f9f7617d342bb20f187dc77105bee7c.exe	82
PID 1076 wrote to memory of 452	1076	WScript.exe	83
PID 1076 wrote to memory of 452	1076	WScript.exe	83
PID 1076 wrote to memory of 452	1076	WScript.exe	83
PID 452 wrote to memory of 4740	452	cmd.exe	85
PID 452 wrote to memory of 4740	452	cmd.exe	85
PID 4740 wrote to memory of 4608	4740	DllCommonsvc.exe	99
PID 4740 wrote to memory of 4608	4740	DllCommonsvc.exe	99
PID 4740 wrote to memory of 116	4740	DllCommonsvc.exe	100
PID 4740 wrote to memory of 116	4740	DllCommonsvc.exe	100
PID 4740 wrote to memory of 4924	4740	DllCommonsvc.exe	101
PID 4740 wrote to memory of 4924	4740	DllCommonsvc.exe	101
PID 4740 wrote to memory of 3572	4740	DllCommonsvc.exe	102
PID 4740 wrote to memory of 3572	4740	DllCommonsvc.exe	102
PID 4740 wrote to memory of 3772	4740	DllCommonsvc.exe	103
PID 4740 wrote to memory of 3772	4740	DllCommonsvc.exe	103
PID 4740 wrote to memory of 4372	4740	DllCommonsvc.exe	108
PID 4740 wrote to memory of 4372	4740	DllCommonsvc.exe	108
PID 4372 wrote to memory of 1860	4372	Idle.exe	110
PID 4372 wrote to memory of 1860	4372	Idle.exe	110
PID 1860 wrote to memory of 4628	1860	cmd.exe	112
PID 1860 wrote to memory of 4628	1860	cmd.exe	112
PID 1860 wrote to memory of 4500	1860	cmd.exe	116
PID 1860 wrote to memory of 4500	1860	cmd.exe	116
PID 4500 wrote to memory of 1932	4500	Idle.exe	117
PID 4500 wrote to memory of 1932	4500	Idle.exe	117
PID 1932 wrote to memory of 5008	1932	cmd.exe	119
PID 1932 wrote to memory of 5008	1932	cmd.exe	119
PID 1932 wrote to memory of 184	1932	cmd.exe	123
PID 1932 wrote to memory of 184	1932	cmd.exe	123
PID 184 wrote to memory of 1116	184	Idle.exe	124
PID 184 wrote to memory of 1116	184	Idle.exe	124
PID 1116 wrote to memory of 2768	1116	cmd.exe	126
PID 1116 wrote to memory of 2768	1116	cmd.exe	126
PID 1116 wrote to memory of 2784	1116	cmd.exe	128
PID 1116 wrote to memory of 2784	1116	cmd.exe	128
PID 2784 wrote to memory of 1524	2784	Idle.exe	130
PID 2784 wrote to memory of 1524	2784	Idle.exe	130
PID 1524 wrote to memory of 4440	1524	cmd.exe	132
PID 1524 wrote to memory of 4440	1524	cmd.exe	132
PID 1524 wrote to memory of 4288	1524	cmd.exe	133
PID 1524 wrote to memory of 4288	1524	cmd.exe	133
PID 4288 wrote to memory of 2596	4288	Idle.exe	134
PID 4288 wrote to memory of 2596	4288	Idle.exe	134
PID 2596 wrote to memory of 2896	2596	cmd.exe	136
PID 2596 wrote to memory of 2896	2596	cmd.exe	136
PID 2596 wrote to memory of 2628	2596	cmd.exe	137
PID 2596 wrote to memory of 2628	2596	cmd.exe	137
PID 2628 wrote to memory of 4536	2628	Idle.exe	138
PID 2628 wrote to memory of 4536	2628	Idle.exe	138
PID 4536 wrote to memory of 3136	4536	cmd.exe	140
PID 4536 wrote to memory of 3136	4536	cmd.exe	140
PID 4536 wrote to memory of 2624	4536	cmd.exe	141
PID 4536 wrote to memory of 2624	4536	cmd.exe	141
PID 2624 wrote to memory of 4080	2624	Idle.exe	142
PID 2624 wrote to memory of 4080	2624	Idle.exe	142
PID 4080 wrote to memory of 1780	4080	cmd.exe	144
PID 4080 wrote to memory of 1780	4080	cmd.exe	144
PID 4080 wrote to memory of 4944	4080	cmd.exe	145
PID 4080 wrote to memory of 4944	4080	cmd.exe	145
PID 4944 wrote to memory of 4996	4944	Idle.exe	146
PID 4944 wrote to memory of 4996	4944	Idle.exe	146

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ceb3185469a2c0d23d25d9aa176943d04f9f7617d342bb20f187dc77105bee7c.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ceb3185469a2c0d23d25d9aa176943d04f9f7617d342bb20f187dc77105bee7c.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2492
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1076
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:452
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4740
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4608
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Google\Temp\RuntimeBroker.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:116
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\Idle.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4924
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3572
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\sppsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3772
    - - C:\providercommon\Idle.exe
        
        "C:\providercommon\Idle.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4372
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\NjKeWzk8OD.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1860
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:4628
        
        C:\providercommon\Idle.exe
        
        "C:\providercommon\Idle.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4500
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\z7AIE64VZ5.bat"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:1932
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:5008
        
        C:\providercommon\Idle.exe
        
        "C:\providercommon\Idle.exe"
        9⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:184
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\hYa1c8p3ob.bat"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:1116
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:2768
        
        C:\providercommon\Idle.exe
        
        "C:\providercommon\Idle.exe"
        11⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2784
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\WSSqGJyhfL.bat"
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:1524
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:4440
        
        C:\providercommon\Idle.exe
        
        "C:\providercommon\Idle.exe"
        13⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4288
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\OoUlhQHDc2.bat"
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:2596
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        15⤵
        
        PID:2896
        
        C:\providercommon\Idle.exe
        
        "C:\providercommon\Idle.exe"
        15⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2628
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Iu2jWrKESR.bat"
        16⤵
        Suspicious use of WriteProcessMemory
        
        PID:4536
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        17⤵
        
        PID:3136
        
        C:\providercommon\Idle.exe
        
        "C:\providercommon\Idle.exe"
        17⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2624
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\MsSi1KDKJG.bat"
        18⤵
        Suspicious use of WriteProcessMemory
        
        PID:4080
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        19⤵
        
        PID:1780
        
        C:\providercommon\Idle.exe
        
        "C:\providercommon\Idle.exe"
        19⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4944
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\EtrZeLjFvq.bat"
        20⤵
        
        PID:4996
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        21⤵
        
        PID:244
        
        C:\providercommon\Idle.exe
        
        "C:\providercommon\Idle.exe"
        21⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:972
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\YXbxSkVmu9.bat"
        22⤵
        
        PID:4988
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        23⤵
        
        PID:4276
        
        C:\providercommon\Idle.exe
        
        "C:\providercommon\Idle.exe"
        23⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4820
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\D2zd9hDRps.bat"
        24⤵
        
        PID:4780
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        25⤵
        
        PID:1920
        
        C:\providercommon\Idle.exe
        
        "C:\providercommon\Idle.exe"
        25⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1936
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\tDjG3X7WPV.bat"
        26⤵
        
        PID:748
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        27⤵
        
        PID:2596
        
        C:\providercommon\Idle.exe
        
        "C:\providercommon\Idle.exe"
        27⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2644
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\LgxiiauvsB.bat"
        28⤵
        
        PID:3836
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        29⤵
        
        PID:4412
        
        C:\providercommon\Idle.exe
        
        "C:\providercommon\Idle.exe"
        29⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Google\Temp\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\Temp\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4280

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Google\Temp\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\providercommon\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\providercommon\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 14 /tr "'C:\providercommon\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Users\Public\Videos\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Public\Videos\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1288

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Users\Public\Videos\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Idle.exe.log

Filesize
1KB

MD5
baf55b95da4a601229647f25dad12878

SHA1
abc16954ebfd213733c4493fc1910164d825cac8

SHA256
ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

SHA512
24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
77d622bb1a5b250869a3238b9bc1402b

SHA1
d47f4003c2554b9dfc4c16f22460b331886b191b

SHA256
f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

SHA512
d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Temp\D2zd9hDRps.bat

Filesize
191B

MD5
1cddbc6341c706b9ebf152978b024f7f

SHA1
81b151a7217d6778c592a6e54a8d49558189f203

SHA256
16136a832bcbba00f7dac625e28daef7de309e9afadeee758fcd1df71c3a2266

SHA512
6069e2f4ea6a375fdf9fb5d70673a1df4aa365c4344c46b10ab09815c20782b8ade3be38cb8ac2731cbbe5594bf73bf0dffaf9462923fc7025b81cd4297f334f

Download Submit
C:\Users\Admin\AppData\Local\Temp\EtrZeLjFvq.bat

Filesize
191B

MD5
abc7fca00dfef3826b8db3bd5d2186cb

SHA1
de1bbc5b7aeda62c056ee8c89d4aa6c346f6888b

SHA256
2e3b6d355905b9f68a37472cac97592eba6dbdaf2c6690f38bf8ba26e27608e7

SHA512
7dbae01605e85bc0a96b67ae298ce78b08e4f33fb74cd84e67f56f005c31015333bdc0e4e90296d32cd74ae91b789619a0fddaf86e4112587e0ade6f022fc8cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Iu2jWrKESR.bat

Filesize
191B

MD5
c5beb13046a0f36adc6d08ab78285734

SHA1
7a1e76b96887389f02c9822f73355879eb36ada2

SHA256
e695027266dceaecd9e7060beabca2748b19f6ea85f3ef130bd94974af3bcd44

SHA512
3afbb488f92ba9194e4800f16351bb326a5c29869ba74488fcac2ac44796fbfb42e110e63269aa3fda78350c01690fefae3120090a6b7b1a637ad6ba342d6f1e

Download Submit
C:\Users\Admin\AppData\Local\Temp\LgxiiauvsB.bat

Filesize
191B

MD5
65db2cb0a2e814b8aa351714c2057b59

SHA1
7cd8bd4ea14fb8298cdd3dec901019aff8253ceb

SHA256
b8efc62c1bfda74b439643dc22510dc9382236b4abad0142069254415ea3c8f3

SHA512
6f33082c93e7ed5488ecd7b8e64c416e00354dad1a17d8c070cbfefb56af123f628f223c3032aceba6e8f4ac9d0dc6044c111313d5b1cb0676c9d2a32cad3eb0

Download Submit
C:\Users\Admin\AppData\Local\Temp\MsSi1KDKJG.bat

Filesize
191B

MD5
9233eb8d55a6186095b88f8bb8d0c9ab

SHA1
bcfc13b4bcf4adacbf87602b13b40177128b00c5

SHA256
35c16493734d28eba93c9f6a3efcad8cd8709fdadc971c73043fe5744d96216e

SHA512
6462cf80d0ef9fe9037984c34fb689f5f0ef643dc1fa558f1d17fc435c04586f5072dd3d0d14fb46042aeb52bccd82b4f19f3899372a89d0815707abcbe7a94d

Download Submit
C:\Users\Admin\AppData\Local\Temp\NjKeWzk8OD.bat

Filesize
191B

MD5
b6437ddc4d9dc07f34b88eafceec8119

SHA1
8b6bb451b8da32e8872fe528921770a03435ee9a

SHA256
4b9b359a0ec2b6b889da645f5adf0aef19b139f097a5cf9e52a766db65f441a2

SHA512
05dc0c2286aaf6a631ec8048806cee861f037b88043afe3a5e457a9ffb7c1963c13016909b35ef91d6be456bad1762e1f471f948b1b7d134009e247e6bcab80e

Download Submit
C:\Users\Admin\AppData\Local\Temp\OoUlhQHDc2.bat

Filesize
191B

MD5
431cfa205cb62a11c38dbfbd05ca9ee1

SHA1
503ac94560bbb4fe4c233b02981c331753f8ce62

SHA256
4a269f67fd683797783e1d817b8ada5f51f6512f259951a426acd2447312e0c8

SHA512
08d56a085e67eddd55f843c49c49d323ac20acf94f660f8185bc32d9da001051d2254d1979b5b15879baf13e29e81dea25e41f2d1205912ff0cdd23368011df7

Download Submit
C:\Users\Admin\AppData\Local\Temp\WSSqGJyhfL.bat

Filesize
191B

MD5
4a99e0335b0bdbe5b47a47e96653b0fc

SHA1
dfbdeb1d37465293f58429fb9dfb5f5f7e2382af

SHA256
6f576442e93de5cc0457104139dc0577c420b72078fbe1499ac17c211a0b8c82

SHA512
d2c0f69716083bca308f9553cd3aaca577434fa1be885e3bb4fe4676f6b6a9ff7df2499c073e4601e74803d8669b212e35ac75e0f099c073deb2663db1479f9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\YXbxSkVmu9.bat

Filesize
191B

MD5
5e4e5c35f4e9e545ab4a17a880218e9b

SHA1
b18df2fadbc9e1cfe2879c538da8fd1f1cbfec48

SHA256
285e543efcd97d6e6ecd9fc6f23a217294c7f07c497e22be21612e74c8567057

SHA512
af3132ae8628c4de1fb9e2f4fe82f21edd4ab5710fb643e0e0b62bd1ca3eb8229b98fb30bee9181a7fc844a0a5f963bbd4aa7c9362522c0805c1b343e57e9dbc

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kgwyawau.p22.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\hYa1c8p3ob.bat

Filesize
191B

MD5
741b782724caac0d1049e9f7c811fb8f

SHA1
6319fd73a0d8b7bbeac8c609a529774309e49a30

SHA256
28f33d17f4b8e976a84d734cba9d49eebc9d2fc2ae5ea1ca40440cfb263d84d7

SHA512
c05be0dda29a7adef4fe59b52a9ba1ba150c0b858c4e53c9266b034073c83827f3ceeb14f18844bb7e1fcfcd7b0ec3cebe08680fcd4600add21244a204066001

Download Submit
C:\Users\Admin\AppData\Local\Temp\tDjG3X7WPV.bat

Filesize
191B

MD5
a3e04a993400a0cc2d30cf4a6048b1b8

SHA1
c5af66a0e1184208c55a7b5511a78cc2ea8a9f95

SHA256
d30f483d7c6cd3010d5335ea99fae6e75cffda50b24a8639aa88fb2d608dda9c

SHA512
6f12fa84ea2c07cb83578682ba4ef8226af5f5b77d8eefa23a37a8f2613ae2a10dd6e72add5282dd46453d924efcee978636b5b7be3abe242d3e719fcafc141c

Download Submit
C:\Users\Admin\AppData\Local\Temp\z7AIE64VZ5.bat

Filesize
191B

MD5
898104c509d40538b05da2ab40d40b2c

SHA1
55365229758ab7a00260e472c74a939fd5dd46de

SHA256
3a2381cc99172bbacafa7fcba0fc34e933b17454c405885a2dc2ac24b9a0c929

SHA512
68fc34e5c36c7d9bcc206df60632cc2f154ff51bbe2c59c3d4cbafd14bf1ffef017ebe83c3f787d516a2c326ac7dd97969f04f1abe4966648f1b2742c2023b9e

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/972-145-0x00000000013C0000-0x00000000013D2000-memory.dmp

Filesize
72KB

Download
memory/1480-171-0x00000000023A0000-0x00000000023B2000-memory.dmp

Filesize
72KB

Download
memory/3572-46-0x000001AB33810000-0x000001AB33832000-memory.dmp

Filesize
136KB

Download
memory/4372-74-0x0000000001280000-0x0000000001292000-memory.dmp

Filesize
72KB

Download
memory/4740-14-0x0000000002E40000-0x0000000002E52000-memory.dmp

Filesize
72KB

Download
memory/4740-12-0x00007FFC0CF63000-0x00007FFC0CF65000-memory.dmp

Filesize
8KB

Download
memory/4740-16-0x0000000002E50000-0x0000000002E5C000-memory.dmp

Filesize
48KB

Download
memory/4740-15-0x0000000002ED0000-0x0000000002EDC000-memory.dmp

Filesize
48KB

Download
memory/4740-13-0x0000000000B70000-0x0000000000C80000-memory.dmp

Filesize
1.1MB

Download
memory/4740-17-0x0000000002EE0000-0x0000000002EEC000-memory.dmp

Filesize
48KB

Download
memory/4820-152-0x0000000000C20000-0x0000000000C32000-memory.dmp

Filesize
72KB

Download