dcrat | d9d18a4d821150c07a0d09524c4e5fe7ea34a3932f891b382352c237a9794231

Analysis

max time kernel
149s
max time network
145s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22-12-2024 06:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_d9d18a4d821150c07a0d09524c4e5fe7ea34a3932f891b382352c237a9794231.exe
Size

1.3MB
MD5

6a77ded6dfbee7f26edd24c1cd3ef2e4
SHA1

68eaeab7239150ca236f70e3f66dc734cc830ac1
SHA256

d9d18a4d821150c07a0d09524c4e5fe7ea34a3932f891b382352c237a9794231
SHA512

66aaf96fb1e97c6b34fb40d9bb76b6633cb6979c599abc69c0b7bca91b120a3e024fec893561402da8c7d9f9de666c1198ae6047deea76d3dbad9548950a5e03
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 39 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2208	2720	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2976	2720	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1932	2720	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2708	2720	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2592	2720	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2660	2720	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2160	2720	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2432	2720	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1924	2720	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2940	2720	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	604	2720	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2696	2720	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2684	2720	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1960	2720	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2036	2720	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2780	2720	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1852	2720	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1908	2720	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3056	2720	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	816	2720	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2636	2720	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1424	2720	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	780	2720	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2080	2720	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	580	2720	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2692	2720	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1132	2720	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2220	2720	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1012	2720	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1064	2720	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2580	2720	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1072	2720	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	956	2720	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	904	2720	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2020	2720	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1556	2720	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2480	2720	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2948	2720	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	916	2720	schtasks.exe	34

DCRat payload 8 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x000900000001747d-10.dat	dcrat
behavioral1/memory/2688-13-0x00000000013E0000-0x00000000014F0000-memory.dmp	dcrat
behavioral1/memory/2240-122-0x0000000000160000-0x0000000000270000-memory.dmp	dcrat
behavioral1/memory/2804-181-0x0000000001250000-0x0000000001360000-memory.dmp	dcrat
behavioral1/memory/2900-359-0x00000000003E0000-0x00000000004F0000-memory.dmp	dcrat
behavioral1/memory/1620-420-0x0000000000F10000-0x0000000001020000-memory.dmp	dcrat
behavioral1/memory/2880-539-0x00000000012F0000-0x0000000001400000-memory.dmp	dcrat
behavioral1/memory/1740-717-0x0000000000080000-0x0000000000190000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 14 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1692	powershell.exe
2200	powershell.exe
2412	powershell.exe
2456	powershell.exe
2500	powershell.exe
1648	powershell.exe
2572	powershell.exe
708	powershell.exe
2676	powershell.exe
1436	powershell.exe
3032	powershell.exe
572	powershell.exe
1912	powershell.exe
1312	powershell.exe

Executes dropped EXE 12 IoCs

pid	Process
2688	DllCommonsvc.exe
2240	lsass.exe
2804	lsass.exe
3036	lsass.exe
2292	lsass.exe
2900	lsass.exe
1620	lsass.exe
2220	lsass.exe
2880	lsass.exe
1516	lsass.exe
2724	lsass.exe
1740	lsass.exe

Loads dropped DLL 2 IoCs

pid	Process
1752	cmd.exe
1752	cmd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 11 IoCs

Web Service

T1102

flow	ioc
4	raw.githubusercontent.com
9	raw.githubusercontent.com
12	raw.githubusercontent.com
26	raw.githubusercontent.com
37	raw.githubusercontent.com
5	raw.githubusercontent.com
16	raw.githubusercontent.com
19	raw.githubusercontent.com
23	raw.githubusercontent.com
30	raw.githubusercontent.com
33	raw.githubusercontent.com

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files\VideoLAN\VLC\7a0fd90576e088	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Sidebar\es-ES\csrss.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Sidebar\es-ES\886983d96e3d3e	DllCommonsvc.exe
File created	C:\Program Files\Uninstall Information\System.exe	DllCommonsvc.exe
File created	C:\Program Files\Uninstall Information\27d1bcfc3c54e0	DllCommonsvc.exe
File created	C:\Program Files (x86)\Internet Explorer\winlogon.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Internet Explorer\cc11b995f2a76d	DllCommonsvc.exe
File created	C:\Program Files\VideoLAN\VLC\explorer.exe	DllCommonsvc.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\DllCommonsvc.exe	DllCommonsvc.exe
File opened for modification	C:\Windows\Tasks\DllCommonsvc.exe	DllCommonsvc.exe
File created	C:\Windows\Tasks\a76d7bf15d8370	DllCommonsvc.exe
File created	C:\Windows\IME\it-IT\lsass.exe	DllCommonsvc.exe
File created	C:\Windows\IME\it-IT\6203df4a6bafc7	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_d9d18a4d821150c07a0d09524c4e5fe7ea34a3932f891b382352c237a9794231.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 39 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2976	schtasks.exe
916	schtasks.exe
2208	schtasks.exe
2696	schtasks.exe
1960	schtasks.exe
2780	schtasks.exe
2948	schtasks.exe
2036	schtasks.exe
580	schtasks.exe
2220	schtasks.exe
2020	schtasks.exe
2708	schtasks.exe
1012	schtasks.exe
1556	schtasks.exe
2592	schtasks.exe
3056	schtasks.exe
1064	schtasks.exe
904	schtasks.exe
1908	schtasks.exe
2636	schtasks.exe
780	schtasks.exe
1852	schtasks.exe
1072	schtasks.exe
2660	schtasks.exe
2432	schtasks.exe
604	schtasks.exe
2684	schtasks.exe
816	schtasks.exe
1424	schtasks.exe
2080	schtasks.exe
2692	schtasks.exe
1932	schtasks.exe
2160	schtasks.exe
1924	schtasks.exe
2940	schtasks.exe
1132	schtasks.exe
2580	schtasks.exe
956	schtasks.exe
2480	schtasks.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
2688	DllCommonsvc.exe
2688	DllCommonsvc.exe
2688	DllCommonsvc.exe
3032	powershell.exe
2676	powershell.exe
1692	powershell.exe
2572	powershell.exe
2200	powershell.exe
1648	powershell.exe
2456	powershell.exe
1312	powershell.exe
2500	powershell.exe
572	powershell.exe
708	powershell.exe
1436	powershell.exe
1912	powershell.exe
2412	powershell.exe
2240	lsass.exe
2804	lsass.exe
3036	lsass.exe
2292	lsass.exe
2900	lsass.exe
1620	lsass.exe
2220	lsass.exe
2880	lsass.exe
1516	lsass.exe
2724	lsass.exe
1740	lsass.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: SeDebugPrivilege	2688	DllCommonsvc.exe
Token: SeDebugPrivilege	3032	powershell.exe
Token: SeDebugPrivilege	2676	powershell.exe
Token: SeDebugPrivilege	1692	powershell.exe
Token: SeDebugPrivilege	2572	powershell.exe
Token: SeDebugPrivilege	2200	powershell.exe
Token: SeDebugPrivilege	1648	powershell.exe
Token: SeDebugPrivilege	2456	powershell.exe
Token: SeDebugPrivilege	1312	powershell.exe
Token: SeDebugPrivilege	2500	powershell.exe
Token: SeDebugPrivilege	572	powershell.exe
Token: SeDebugPrivilege	708	powershell.exe
Token: SeDebugPrivilege	1436	powershell.exe
Token: SeDebugPrivilege	1912	powershell.exe
Token: SeDebugPrivilege	2412	powershell.exe
Token: SeDebugPrivilege	2240	lsass.exe
Token: SeDebugPrivilege	2804	lsass.exe
Token: SeDebugPrivilege	3036	lsass.exe
Token: SeDebugPrivilege	2292	lsass.exe
Token: SeDebugPrivilege	2900	lsass.exe
Token: SeDebugPrivilege	1620	lsass.exe
Token: SeDebugPrivilege	2220	lsass.exe
Token: SeDebugPrivilege	2880	lsass.exe
Token: SeDebugPrivilege	1516	lsass.exe
Token: SeDebugPrivilege	2724	lsass.exe
Token: SeDebugPrivilege	1740	lsass.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2452 wrote to memory of 2380	2452	JaffaCakes118_d9d18a4d821150c07a0d09524c4e5fe7ea34a3932f891b382352c237a9794231.exe	30
PID 2452 wrote to memory of 2380	2452	JaffaCakes118_d9d18a4d821150c07a0d09524c4e5fe7ea34a3932f891b382352c237a9794231.exe	30
PID 2452 wrote to memory of 2380	2452	JaffaCakes118_d9d18a4d821150c07a0d09524c4e5fe7ea34a3932f891b382352c237a9794231.exe	30
PID 2452 wrote to memory of 2380	2452	JaffaCakes118_d9d18a4d821150c07a0d09524c4e5fe7ea34a3932f891b382352c237a9794231.exe	30
PID 2380 wrote to memory of 1752	2380	WScript.exe	31
PID 2380 wrote to memory of 1752	2380	WScript.exe	31
PID 2380 wrote to memory of 1752	2380	WScript.exe	31
PID 2380 wrote to memory of 1752	2380	WScript.exe	31
PID 1752 wrote to memory of 2688	1752	cmd.exe	33
PID 1752 wrote to memory of 2688	1752	cmd.exe	33
PID 1752 wrote to memory of 2688	1752	cmd.exe	33
PID 1752 wrote to memory of 2688	1752	cmd.exe	33
PID 2688 wrote to memory of 2456	2688	DllCommonsvc.exe	74
PID 2688 wrote to memory of 2456	2688	DllCommonsvc.exe	74
PID 2688 wrote to memory of 2456	2688	DllCommonsvc.exe	74
PID 2688 wrote to memory of 1692	2688	DllCommonsvc.exe	75
PID 2688 wrote to memory of 1692	2688	DllCommonsvc.exe	75
PID 2688 wrote to memory of 1692	2688	DllCommonsvc.exe	75
PID 2688 wrote to memory of 2200	2688	DllCommonsvc.exe	76
PID 2688 wrote to memory of 2200	2688	DllCommonsvc.exe	76
PID 2688 wrote to memory of 2200	2688	DllCommonsvc.exe	76
PID 2688 wrote to memory of 2572	2688	DllCommonsvc.exe	77
PID 2688 wrote to memory of 2572	2688	DllCommonsvc.exe	77
PID 2688 wrote to memory of 2572	2688	DllCommonsvc.exe	77
PID 2688 wrote to memory of 1312	2688	DllCommonsvc.exe	78
PID 2688 wrote to memory of 1312	2688	DllCommonsvc.exe	78
PID 2688 wrote to memory of 1312	2688	DllCommonsvc.exe	78
PID 2688 wrote to memory of 2412	2688	DllCommonsvc.exe	79
PID 2688 wrote to memory of 2412	2688	DllCommonsvc.exe	79
PID 2688 wrote to memory of 2412	2688	DllCommonsvc.exe	79
PID 2688 wrote to memory of 1436	2688	DllCommonsvc.exe	80
PID 2688 wrote to memory of 1436	2688	DllCommonsvc.exe	80
PID 2688 wrote to memory of 1436	2688	DllCommonsvc.exe	80
PID 2688 wrote to memory of 3032	2688	DllCommonsvc.exe	81
PID 2688 wrote to memory of 3032	2688	DllCommonsvc.exe	81
PID 2688 wrote to memory of 3032	2688	DllCommonsvc.exe	81
PID 2688 wrote to memory of 2676	2688	DllCommonsvc.exe	82
PID 2688 wrote to memory of 2676	2688	DllCommonsvc.exe	82
PID 2688 wrote to memory of 2676	2688	DllCommonsvc.exe	82
PID 2688 wrote to memory of 2500	2688	DllCommonsvc.exe	83
PID 2688 wrote to memory of 2500	2688	DllCommonsvc.exe	83
PID 2688 wrote to memory of 2500	2688	DllCommonsvc.exe	83
PID 2688 wrote to memory of 572	2688	DllCommonsvc.exe	84
PID 2688 wrote to memory of 572	2688	DllCommonsvc.exe	84
PID 2688 wrote to memory of 572	2688	DllCommonsvc.exe	84
PID 2688 wrote to memory of 1648	2688	DllCommonsvc.exe	85
PID 2688 wrote to memory of 1648	2688	DllCommonsvc.exe	85
PID 2688 wrote to memory of 1648	2688	DllCommonsvc.exe	85
PID 2688 wrote to memory of 708	2688	DllCommonsvc.exe	86
PID 2688 wrote to memory of 708	2688	DllCommonsvc.exe	86
PID 2688 wrote to memory of 708	2688	DllCommonsvc.exe	86
PID 2688 wrote to memory of 1912	2688	DllCommonsvc.exe	87
PID 2688 wrote to memory of 1912	2688	DllCommonsvc.exe	87
PID 2688 wrote to memory of 1912	2688	DllCommonsvc.exe	87
PID 2688 wrote to memory of 2112	2688	DllCommonsvc.exe	102
PID 2688 wrote to memory of 2112	2688	DllCommonsvc.exe	102
PID 2688 wrote to memory of 2112	2688	DllCommonsvc.exe	102
PID 2112 wrote to memory of 2420	2112	cmd.exe	104
PID 2112 wrote to memory of 2420	2112	cmd.exe	104
PID 2112 wrote to memory of 2420	2112	cmd.exe	104
PID 2112 wrote to memory of 2240	2112	cmd.exe	105
PID 2112 wrote to memory of 2240	2112	cmd.exe	105
PID 2112 wrote to memory of 2240	2112	cmd.exe	105
PID 2240 wrote to memory of 1692	2240	lsass.exe	107

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d9d18a4d821150c07a0d09524c4e5fe7ea34a3932f891b382352c237a9794231.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d9d18a4d821150c07a0d09524c4e5fe7ea34a3932f891b382352c237a9794231.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2452
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2380
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1752
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2688
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2456
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Tasks\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1692
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Sidebar\es-ES\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2200
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Uninstall Information\System.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2572
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\dwm.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1312
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\IME\it-IT\lsass.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2412
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Internet Explorer\winlogon.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1436
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\VideoLAN\VLC\explorer.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3032
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2676
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2500
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Cookies\sppsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:572
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\NetHood\OSPPSVC.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1648
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:708
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\winlogon.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1912
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\1ViAyttYMZ.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2112
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:2420
      - C:\Windows\IME\it-IT\lsass.exe
        
        "C:\Windows\IME\it-IT\lsass.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2240
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\AQtyVABn1C.bat"
        7⤵
        
        PID:1692
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:1264
        
        C:\Windows\IME\it-IT\lsass.exe
        
        "C:\Windows\IME\it-IT\lsass.exe"
        8⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2804
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\c38FLB8gIG.bat"
        9⤵
        
        PID:1644
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:2192
        
        C:\Windows\IME\it-IT\lsass.exe
        
        "C:\Windows\IME\it-IT\lsass.exe"
        10⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3036
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ZDYK5nApHO.bat"
        11⤵
        
        PID:1240
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:1800
        
        C:\Windows\IME\it-IT\lsass.exe
        
        "C:\Windows\IME\it-IT\lsass.exe"
        12⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2292
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\j5PKlq1uIo.bat"
        13⤵
        
        PID:2520
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        14⤵
        
        PID:780
        
        C:\Windows\IME\it-IT\lsass.exe
        
        "C:\Windows\IME\it-IT\lsass.exe"
        14⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2900
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ph6jqiBtuj.bat"
        15⤵
        
        PID:2508
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        16⤵
        
        PID:1164
        
        C:\Windows\IME\it-IT\lsass.exe
        
        "C:\Windows\IME\it-IT\lsass.exe"
        16⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1620
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ISA3vp411k.bat"
        17⤵
        
        PID:2660
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        18⤵
        
        PID:1544
        
        C:\Windows\IME\it-IT\lsass.exe
        
        "C:\Windows\IME\it-IT\lsass.exe"
        18⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2220
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\crRU6Ya2tl.bat"
        19⤵
        
        PID:2888
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        20⤵
        
        PID:2112
        
        C:\Windows\IME\it-IT\lsass.exe
        
        "C:\Windows\IME\it-IT\lsass.exe"
        20⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2880
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\L9j9zErPDE.bat"
        21⤵
        
        PID:2624
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        22⤵
        
        PID:1612
        
        C:\Windows\IME\it-IT\lsass.exe
        
        "C:\Windows\IME\it-IT\lsass.exe"
        22⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1516
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Q0tVgmHuxR.bat"
        23⤵
        
        PID:2044
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        24⤵
        
        PID:2000
        
        C:\Windows\IME\it-IT\lsass.exe
        
        "C:\Windows\IME\it-IT\lsass.exe"
        24⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2724
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\MXvuXcjR4o.bat"
        25⤵
        
        PID:1500
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        26⤵
        
        PID:2224
        
        C:\Windows\IME\it-IT\lsass.exe
        
        "C:\Windows\IME\it-IT\lsass.exe"
        26⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1740

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 8 /tr "'C:\Windows\Tasks\DllCommonsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\Windows\Tasks\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 12 /tr "'C:\Windows\Tasks\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Sidebar\es-ES\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\es-ES\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Sidebar\es-ES\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'C:\Program Files\Uninstall Information\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2160

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 11 /tr "'C:\Program Files\Uninstall Information\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\Windows\IME\it-IT\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\IME\it-IT\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\Windows\IME\it-IT\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Internet Explorer\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Internet Explorer\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\Program Files\VideoLAN\VLC\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\VLC\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\Program Files\VideoLAN\VLC\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1424

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\DllCommonsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1132

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 7 /tr "'C:\Users\Default\Cookies\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Users\Default\Cookies\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 14 /tr "'C:\Users\Default\Cookies\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 14 /tr "'C:\Users\Default\NetHood\OSPPSVC.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Users\Default\NetHood\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1072

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 7 /tr "'C:\Users\Default\NetHood\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'C:\Users\Default User\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Users\Default User\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'C:\Users\Default User\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a3da46c41f3fb0f5495587a28518a228

SHA1
712c993eb581c5b2cab604ba4f2d9bde38d22c8a

SHA256
e6adf607b521ec058918f09f76dec62e7557cfb191d6c144b9ecd6f609dfe288

SHA512
c68c2021d011e678c550c1309defda4a892f027094fa27b6a38dbf24f42e52ca5cb8f4923cedc90a3ccd8055c776ad4ba2a3fabd1ba028b3f6c575f97360406e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
736cb69a6e9b9d562081a8d7f7e917f6

SHA1
32d0d7cd876243c949836d891b1332edb4ff01bc

SHA256
a0a5832c8c391ecdad09d3d538602a1096b7bc494078a7026f8e66534eee9b5f

SHA512
d71b2c0de5e5783fb74834ed8c1c3bc374f3b038d468ce8f48c41961d9d82a86b36fdb45641c16f1281f1e1f13d315d5ce8d262fc3381c518ee8d22363595720

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f15285feb607ea9847c14976d87dd1cd

SHA1
d6a2ef3a637fa950b34dcc9a737c80b334e4363f

SHA256
dca4aaca0e37983db1ad45319717a4acc89feeda6563195c50874c39fe4e14f5

SHA512
f9f40e86bfb0f6b40342418151eb31de01012a43a961c257f855ea305e4e47486b9b8787add51234f059841b333b48dc4168b21fefcd2055aa24631b4814a7d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dd78d3b8403dbaba122cf4dc5162abc9

SHA1
08e0f892f266c229a599c3c5c5069077339fea2b

SHA256
1538fee6401d374bcea11fc1fc5f8e99f88881f08180bee13645c8cb26192f00

SHA512
00d28058e4bbac56c8362f2338e40cd4c05ca63919f15ef4f6772a371552711822258daafb0fc25815e98ca7c4ea24ba5ac77586f2489a7c15e4028aa59f85ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
134ba7d467666492297f16d0c7b207ea

SHA1
78cac783dca90ddc5605d150c9b66ce4d45593b0

SHA256
3232e87f94d232c0d26522cf26f81dd96ea421f3b881bdd28fff6e3a77d363f9

SHA512
198395ffe7b15cce00a392dc4008958ef0cc916baccf6ab1c1306c7bd73e7598dfa86b9f1dc24ffed53615408c4f903bd7d25914c59b59e289008595b04f3df4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e2bc0f1953eb5efcdc8e1975156271ed

SHA1
fefe0fd4e4446dd8903412cb67d73cb4f9e96e26

SHA256
e7e00ea305474ec527f748a2697601ef5419b8756318f703ef2982dcc07bff3f

SHA512
2b8c2f579fd2f2fb435be2b92efefc374a8565175d178a7512c005e1f4c61f026414976d24b38ce07cf94fafd1f1890072de69e594133539b762cc66359b570f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
058b18c50feafd965950507f904f90f2

SHA1
5107598db0a0cb9605d15472ee2a4f6c9dcbcac6

SHA256
0fbdc459d9409c6ec3977016f597e7f19d736da778be56ad41cf4f8f53bb3eea

SHA512
57adaa03a199484b426ca59daa987f796daa6c564e87fd870417c6dab1e4c1fe6b43c3f5c942275487f43d908bcf1b0dea5b1ded67542bd047435d85b4088787

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
399a8c7d4368decaa36e670cb9f5fd30

SHA1
719420ed7c7603f3b0d09c8a943224a21d0a5507

SHA256
63cea2e47bfe8037a1a10787dbd465a8fdcfc1872d07fbc3c29f38722d874c35

SHA512
35f0c0321e94efec409dcf0b54e6cd31247a36c3f74888afa9e9f88054c7d52664d4b34d7aa0146e6641f178c553d35e6f34109fdd4e4a92419271d4225bc8f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
983f5d7179d4e103d4d6a3b9f0cf34a2

SHA1
1106ddeb55014cdf6ed6db8b0e7592d546a2a2a8

SHA256
35ed7047719c2454730554070ae3a067cd481e512f5644effd2d9fd5d901e82b

SHA512
2bf3fb09248e1953f89f794a263cb4dc4150b77dd4f208acef67dd36d501d2a89b9a32291f6cd0a73c264203de1a25435b446dddb309d9b0a70516083271012b

Download Submit
C:\Users\Admin\AppData\Local\Temp\1ViAyttYMZ.bat

Filesize
195B

MD5
45ee2a8af3d10d45b7ad2464968acdff

SHA1
8efcaa8ae7b520ab3cbcd9a6d1b40582cc8e2e89

SHA256
30ac5f57e23c736c075f30dc66cec725e960a458c05a3f94d837daab99b9d07c

SHA512
f88d21967d4de8f84a7bbf0edcfa855569da42090c5304201e30bc964e36ae259e1f4f70191b146f4515e5b9abcbe93b0def695b9b1965f7f738be1a106eb1df

Download Submit
C:\Users\Admin\AppData\Local\Temp\AQtyVABn1C.bat

Filesize
195B

MD5
e8dd29fa3e0e00cceba19f477c90282d

SHA1
dcbf5968d1c871e42134984c2045512ec2ee2db8

SHA256
1e382dd2ca3ef7835b998391a8204c879fc5ef537778d6d45c78cbe9dccd7105

SHA512
382983cd4c5eb3355120cd4b90beb588477a5aa5be9089cdfa02feb03552ea3e5b4a20bbdf2d6668aad0cebdc5965bdcd971b95b27bef2e98cfb754c021f504a

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE793.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\ISA3vp411k.bat

Filesize
195B

MD5
5242da481d3bf066aab6bbe237a80c4a

SHA1
4917fd205c6b572ea745dfc9a3d6778f32a855a5

SHA256
b4891462cd0498921a86733146d411892430089ece44a2c4567bb946813cd0f7

SHA512
dc8760ac4976446bd2185719d0c60c100db4356104a324f15e82756b66afa14ad0ac5c13a51bb5ce2aa5111c1d1b4927abaa79dda4371a75e6219fd32433a379

Download Submit
C:\Users\Admin\AppData\Local\Temp\L9j9zErPDE.bat

Filesize
195B

MD5
70ac68f6fc163687c70c4cd212bb4e17

SHA1
b34fc3fc6c56252c768759003be4aa3dd50d2d48

SHA256
e02e7dfc63945075fc28d3ccdf1fc89264e0f6cb0b93235e0f1155a179b3ac05

SHA512
0458ed72608972e5ea3b834b0f2b7e4aa3a1fd8755ba0a00fdadcd9e973abcf6cd9d89a7a34b651cefe4c3d6b8270e9de55fdc8377df89f273812209d5b439cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\MXvuXcjR4o.bat

Filesize
195B

MD5
c7bdd24b4997b64eb8d5db9de8fd699b

SHA1
3bc2e4c0dceb3e535717b080089f72a62f93fb8d

SHA256
e35226ccb6ec7a16a8518ba64e76ae1c59cd3530352d77eec30e2380af1c758b

SHA512
b1acc160dae9f727e68f470f2b64a54e86f6bce1a00afe682db682979c4d198eccf71c7e6feb2b47bbc9277c88742aa064801b26fd4e3b328428f68c19bf4fbd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Q0tVgmHuxR.bat

Filesize
195B

MD5
a4c4e599164312d556a14ca672712de3

SHA1
47793f089fd7141a18a4f91acd9cce07029864b2

SHA256
2b0f0354cf81c4f39d7d20ca4a6d759fbcc5cb90961e3bac4157b7243e5d327e

SHA512
2514ee6c69e882507084f7989c3a49e5840d7c08414b9a4baae31e38789fa3a70ebde6e70c1d6cf73e29e7bd8c4a75ab0e42278af02c1c6786290b1abfa33d8f

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE7A6.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\ZDYK5nApHO.bat

Filesize
195B

MD5
5789cf3925f44a22de8e1099246fa07d

SHA1
48fcdad8b9616c41b55087e07a219582bdb97a9d

SHA256
27cb58fda883c226f24270503702bc295e75b4254b718aba72773095be88cd9c

SHA512
741679e85ee538875189a6473a56eee1a6d01e0861c1b089c9abb73b1fe00aec26023c4f11afdcb522c563454716b1072468c07854a1790f1263f1863e88ae4b

Download Submit
C:\Users\Admin\AppData\Local\Temp\c38FLB8gIG.bat

Filesize
195B

MD5
6c0c8fbe5b06d2e80ad3861d2f79d919

SHA1
94542eed45c77b7ee90457134459d6c3be1fb0a7

SHA256
ffcf7cbf5119e905d5583dc17bd29277fe37e33c1c0cb53c109ce9dbb135ba5f

SHA512
eb9cef5218c202f11c7b791de7dca680b32628a2a3055e17ec6a64324285d6360319eb81c98db7b7e99b5b131918e23c3a2ba25dbd320630ad8b6dd24beab694

Download Submit
C:\Users\Admin\AppData\Local\Temp\crRU6Ya2tl.bat

Filesize
195B

MD5
a3e724b266722f449b95254322a43b35

SHA1
94217c9ed4a01ac165d33598fa9b3024a3edf898

SHA256
ca1bcbf6358cfb6c3b99c5212186fc37c994a466c4c9e04e7edf9dccc1311174

SHA512
d9e29bbfee72461898bddedbbfa32dab45e8dc6777848d4ecfb5deed3a06dedd1733bdd8a3781ab03e96b7d8dc621ac3da39d1d7d1e89deefbe9448de2c4f1ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\j5PKlq1uIo.bat

Filesize
195B

MD5
999c0caa1d5b4a79b8e1210eda2e26b7

SHA1
6166f304d9e1a569f97731568d832f2639e598a1

SHA256
45cc6919d76ee08806d652053d8904c9924316b71df8ac1f9102cb61b3cb8fd0

SHA512
8cf3ec7c3b9a0a6bca9d3644700f93167565d3800d10ef6de69a7b68390e71ee3be6ba58a504be469045f2acdc1b552d87b78e2f697558fd473f91b1b04c687e

Download Submit
C:\Users\Admin\AppData\Local\Temp\ph6jqiBtuj.bat

Filesize
195B

MD5
3dc934d3f62b8d2455bdc635b1297f46

SHA1
640775ee6671afd6de6ae91aaef414494fcdad0d

SHA256
2b157340c45c5c8ef2a101f9242a795b6364711679bcec4fedd0d7509d0a9a07

SHA512
5a415bc778e704e3a93887dceafed759fc99aa8e027e1de4a589d60074b3b10b15170bb3d4403880eea3a2b84dd7e3eb32e3da3499c997399fc2b78906e54245

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
a3e3c07e7e02831c65c732d3d527972b

SHA1
a2442f518e87f18290256ca6efbd2ac4fecc01f0

SHA256
b5deab6b7e72f49f9d05930eb1347c92aff393d121ca99631ae4a54ec267b986

SHA512
0f8ece3a7c9a91f259061eafeb90f4e8fedfe1cf833e30fe2f557f452b405736436b96b16466428da4b3321367ba791632fb1b7079d92e32fbd7e99532a94ad1

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/1620-420-0x0000000000F10000-0x0000000001020000-memory.dmp

Filesize
1.1MB

Download
memory/1692-70-0x000000001B5A0000-0x000000001B882000-memory.dmp

Filesize
2.9MB

Download
memory/1740-717-0x0000000000080000-0x0000000000190000-memory.dmp

Filesize
1.1MB

Download
memory/2240-122-0x0000000000160000-0x0000000000270000-memory.dmp

Filesize
1.1MB

Download
memory/2688-16-0x00000000004E0000-0x00000000004EC000-memory.dmp

Filesize
48KB

Download
memory/2688-17-0x00000000004F0000-0x00000000004FC000-memory.dmp

Filesize
48KB

Download
memory/2688-15-0x00000000004D0000-0x00000000004DC000-memory.dmp

Filesize
48KB

Download
memory/2688-14-0x00000000004C0000-0x00000000004D2000-memory.dmp

Filesize
72KB

Download
memory/2688-13-0x00000000013E0000-0x00000000014F0000-memory.dmp

Filesize
1.1MB

Download
memory/2804-181-0x0000000001250000-0x0000000001360000-memory.dmp

Filesize
1.1MB

Download
memory/2880-539-0x00000000012F0000-0x0000000001400000-memory.dmp

Filesize
1.1MB

Download
memory/2900-360-0x00000000003D0000-0x00000000003E2000-memory.dmp

Filesize
72KB

Download
memory/2900-359-0x00000000003E0000-0x00000000004F0000-memory.dmp

Filesize
1.1MB

Download
memory/3032-71-0x0000000001DD0000-0x0000000001DD8000-memory.dmp

Filesize
32KB

Download