dcrat | 9fbcd186b057cdf53a7d34a98131c0f0d6a1849f90390771dda0de1ae83227d3

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2024 07:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_9fbcd186b057cdf53a7d34a98131c0f0d6a1849f90390771dda0de1ae83227d3.exe
Size

1.3MB
MD5

5b72a4a651f45f97ddbee6b337cc1dd2
SHA1

be4bd3170e6edb71abfe754a108d8ff6338881d2
SHA256

9fbcd186b057cdf53a7d34a98131c0f0d6a1849f90390771dda0de1ae83227d3
SHA512

d5938e52490c8087c60d7c26aecf536e916aaee23ff367b4466c8d4b8bcdab54f96092ff9a0f7291602e43050d934080ad1f35947a0c2d7abe714cfd53240ff9
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 6 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4644	4696	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	856	4696	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	400	4696	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	720	4696	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3204	4696	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4708	4696	schtasks.exe	90

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x0007000000023c93-10.dat	dcrat
behavioral2/memory/1056-13-0x0000000000B90000-0x0000000000CA0000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1852	powershell.exe
2184	powershell.exe
1936	powershell.exe

Checks computer location settings 2 TTPs 17 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	dwm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	dwm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	dwm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	dwm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	dwm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	dwm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	dwm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	dwm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	JaffaCakes118_9fbcd186b057cdf53a7d34a98131c0f0d6a1849f90390771dda0de1ae83227d3.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	dwm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	dwm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	dwm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	dwm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	dwm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	dwm.exe

Executes dropped EXE 15 IoCs

pid	Process
1056	DllCommonsvc.exe
696	dwm.exe
852	dwm.exe
4732	dwm.exe
2816	dwm.exe
2348	dwm.exe
668	dwm.exe
3408	dwm.exe
1988	dwm.exe
1244	dwm.exe
1140	dwm.exe
2636	dwm.exe
4528	dwm.exe
1116	dwm.exe
4660	dwm.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 15 IoCs

Web Service

T1102

flow	ioc
17	raw.githubusercontent.com
41	raw.githubusercontent.com
42	raw.githubusercontent.com
47	raw.githubusercontent.com
18	raw.githubusercontent.com
23	raw.githubusercontent.com
48	raw.githubusercontent.com
54	raw.githubusercontent.com
56	raw.githubusercontent.com
40	raw.githubusercontent.com
45	raw.githubusercontent.com
53	raw.githubusercontent.com
55	raw.githubusercontent.com
22	raw.githubusercontent.com
57	raw.githubusercontent.com

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\AdvancedInstallers\WaaSMedicAgent.exe	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_9fbcd186b057cdf53a7d34a98131c0f0d6a1849f90390771dda0de1ae83227d3.exe

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	JaffaCakes118_9fbcd186b057cdf53a7d34a98131c0f0d6a1849f90390771dda0de1ae83227d3.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3204	schtasks.exe
4708	schtasks.exe
4644	schtasks.exe
856	schtasks.exe
400	schtasks.exe
720	schtasks.exe

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
1056	DllCommonsvc.exe
2184	powershell.exe
1852	powershell.exe
1936	powershell.exe
1852	powershell.exe
1936	powershell.exe
2184	powershell.exe
696	dwm.exe
852	dwm.exe
4732	dwm.exe
2816	dwm.exe
2348	dwm.exe
668	dwm.exe
3408	dwm.exe
1988	dwm.exe
1244	dwm.exe
1140	dwm.exe
2636	dwm.exe
4528	dwm.exe
1116	dwm.exe
4660	dwm.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeDebugPrivilege	1056	DllCommonsvc.exe
Token: SeDebugPrivilege	2184	powershell.exe
Token: SeDebugPrivilege	1852	powershell.exe
Token: SeDebugPrivilege	1936	powershell.exe
Token: SeDebugPrivilege	696	dwm.exe
Token: SeDebugPrivilege	852	dwm.exe
Token: SeDebugPrivilege	4732	dwm.exe
Token: SeDebugPrivilege	2816	dwm.exe
Token: SeDebugPrivilege	2348	dwm.exe
Token: SeDebugPrivilege	668	dwm.exe
Token: SeDebugPrivilege	3408	dwm.exe
Token: SeDebugPrivilege	1988	dwm.exe
Token: SeDebugPrivilege	1244	dwm.exe
Token: SeDebugPrivilege	1140	dwm.exe
Token: SeDebugPrivilege	2636	dwm.exe
Token: SeDebugPrivilege	4528	dwm.exe
Token: SeDebugPrivilege	1116	dwm.exe
Token: SeDebugPrivilege	4660	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3148 wrote to memory of 2360	3148	JaffaCakes118_9fbcd186b057cdf53a7d34a98131c0f0d6a1849f90390771dda0de1ae83227d3.exe	83
PID 3148 wrote to memory of 2360	3148	JaffaCakes118_9fbcd186b057cdf53a7d34a98131c0f0d6a1849f90390771dda0de1ae83227d3.exe	83
PID 3148 wrote to memory of 2360	3148	JaffaCakes118_9fbcd186b057cdf53a7d34a98131c0f0d6a1849f90390771dda0de1ae83227d3.exe	83
PID 2360 wrote to memory of 3452	2360	WScript.exe	87
PID 2360 wrote to memory of 3452	2360	WScript.exe	87
PID 2360 wrote to memory of 3452	2360	WScript.exe	87
PID 3452 wrote to memory of 1056	3452	cmd.exe	89
PID 3452 wrote to memory of 1056	3452	cmd.exe	89
PID 1056 wrote to memory of 1936	1056	DllCommonsvc.exe	98
PID 1056 wrote to memory of 1936	1056	DllCommonsvc.exe	98
PID 1056 wrote to memory of 1852	1056	DllCommonsvc.exe	99
PID 1056 wrote to memory of 1852	1056	DllCommonsvc.exe	99
PID 1056 wrote to memory of 2184	1056	DllCommonsvc.exe	100
PID 1056 wrote to memory of 2184	1056	DllCommonsvc.exe	100
PID 1056 wrote to memory of 696	1056	DllCommonsvc.exe	103
PID 1056 wrote to memory of 696	1056	DllCommonsvc.exe	103
PID 696 wrote to memory of 4324	696	dwm.exe	108
PID 696 wrote to memory of 4324	696	dwm.exe	108
PID 4324 wrote to memory of 4588	4324	cmd.exe	110
PID 4324 wrote to memory of 4588	4324	cmd.exe	110
PID 4324 wrote to memory of 852	4324	cmd.exe	118
PID 4324 wrote to memory of 852	4324	cmd.exe	118
PID 852 wrote to memory of 464	852	dwm.exe	120
PID 852 wrote to memory of 464	852	dwm.exe	120
PID 464 wrote to memory of 3476	464	cmd.exe	122
PID 464 wrote to memory of 3476	464	cmd.exe	122
PID 464 wrote to memory of 4732	464	cmd.exe	124
PID 464 wrote to memory of 4732	464	cmd.exe	124
PID 4732 wrote to memory of 2880	4732	dwm.exe	126
PID 4732 wrote to memory of 2880	4732	dwm.exe	126
PID 2880 wrote to memory of 2136	2880	cmd.exe	128
PID 2880 wrote to memory of 2136	2880	cmd.exe	128
PID 2880 wrote to memory of 2816	2880	cmd.exe	130
PID 2880 wrote to memory of 2816	2880	cmd.exe	130
PID 2816 wrote to memory of 5008	2816	dwm.exe	135
PID 2816 wrote to memory of 5008	2816	dwm.exe	135
PID 5008 wrote to memory of 3028	5008	cmd.exe	137
PID 5008 wrote to memory of 3028	5008	cmd.exe	137
PID 5008 wrote to memory of 2348	5008	cmd.exe	139
PID 5008 wrote to memory of 2348	5008	cmd.exe	139
PID 2348 wrote to memory of 372	2348	dwm.exe	141
PID 2348 wrote to memory of 372	2348	dwm.exe	141
PID 372 wrote to memory of 1040	372	cmd.exe	143
PID 372 wrote to memory of 1040	372	cmd.exe	143
PID 372 wrote to memory of 668	372	cmd.exe	145
PID 372 wrote to memory of 668	372	cmd.exe	145
PID 668 wrote to memory of 3088	668	dwm.exe	147
PID 668 wrote to memory of 3088	668	dwm.exe	147
PID 3088 wrote to memory of 3868	3088	cmd.exe	149
PID 3088 wrote to memory of 3868	3088	cmd.exe	149
PID 3088 wrote to memory of 3408	3088	cmd.exe	151
PID 3088 wrote to memory of 3408	3088	cmd.exe	151
PID 3408 wrote to memory of 4896	3408	dwm.exe	153
PID 3408 wrote to memory of 4896	3408	dwm.exe	153
PID 4896 wrote to memory of 944	4896	cmd.exe	155
PID 4896 wrote to memory of 944	4896	cmd.exe	155
PID 4896 wrote to memory of 1988	4896	cmd.exe	157
PID 4896 wrote to memory of 1988	4896	cmd.exe	157
PID 1988 wrote to memory of 1540	1988	dwm.exe	159
PID 1988 wrote to memory of 1540	1988	dwm.exe	159
PID 1540 wrote to memory of 1512	1540	cmd.exe	161
PID 1540 wrote to memory of 1512	1540	cmd.exe	161
PID 1540 wrote to memory of 1244	1540	cmd.exe	163
PID 1540 wrote to memory of 1244	1540	cmd.exe	163

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9fbcd186b057cdf53a7d34a98131c0f0d6a1849f90390771dda0de1ae83227d3.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9fbcd186b057cdf53a7d34a98131c0f0d6a1849f90390771dda0de1ae83227d3.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3148
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2360
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3452
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1056
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1936
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\winlogon.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1852
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\dwm.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2184
    - - C:\Recovery\WindowsRE\dwm.exe
        
        "C:\Recovery\WindowsRE\dwm.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:696
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ddqzBJK7Zu.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4324
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:4588
        
        C:\Recovery\WindowsRE\dwm.exe
        
        "C:\Recovery\WindowsRE\dwm.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:852
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Bp0TjAk7l7.bat"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:464
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:3476
        
        C:\Recovery\WindowsRE\dwm.exe
        
        "C:\Recovery\WindowsRE\dwm.exe"
        9⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4732
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\BAdWWGXi7E.bat"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:2880
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:2136
        
        C:\Recovery\WindowsRE\dwm.exe
        
        "C:\Recovery\WindowsRE\dwm.exe"
        11⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2816
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\BAdWWGXi7E.bat"
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:5008
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:3028
        
        C:\Recovery\WindowsRE\dwm.exe
        
        "C:\Recovery\WindowsRE\dwm.exe"
        13⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2348
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\x8TIUMdSeB.bat"
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:372
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        15⤵
        
        PID:1040
        
        C:\Recovery\WindowsRE\dwm.exe
        
        "C:\Recovery\WindowsRE\dwm.exe"
        15⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:668
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\gQkyN2upze.bat"
        16⤵
        Suspicious use of WriteProcessMemory
        
        PID:3088
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        17⤵
        
        PID:3868
        
        C:\Recovery\WindowsRE\dwm.exe
        
        "C:\Recovery\WindowsRE\dwm.exe"
        17⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3408
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\gQkyN2upze.bat"
        18⤵
        Suspicious use of WriteProcessMemory
        
        PID:4896
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        19⤵
        
        PID:944
        
        C:\Recovery\WindowsRE\dwm.exe
        
        "C:\Recovery\WindowsRE\dwm.exe"
        19⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1988
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\hbGxgnDDQj.bat"
        20⤵
        Suspicious use of WriteProcessMemory
        
        PID:1540
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        21⤵
        
        PID:1512
        
        C:\Recovery\WindowsRE\dwm.exe
        
        "C:\Recovery\WindowsRE\dwm.exe"
        21⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1244
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\LkcfmFI5TJ.bat"
        22⤵
        
        PID:1508
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        23⤵
        
        PID:4428
        
        C:\Recovery\WindowsRE\dwm.exe
        
        "C:\Recovery\WindowsRE\dwm.exe"
        23⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1140
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\qKN9Q7Smhq.bat"
        24⤵
        
        PID:2948
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        25⤵
        
        PID:2060
        
        C:\Recovery\WindowsRE\dwm.exe
        
        "C:\Recovery\WindowsRE\dwm.exe"
        25⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2636
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ddqzBJK7Zu.bat"
        26⤵
        
        PID:2748
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        27⤵
        
        PID:2256
        
        C:\Recovery\WindowsRE\dwm.exe
        
        "C:\Recovery\WindowsRE\dwm.exe"
        27⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4528
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\nDq7RH5Uwz.bat"
        28⤵
        
        PID:4056
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        29⤵
        
        PID:5072
        
        C:\Recovery\WindowsRE\dwm.exe
        
        "C:\Recovery\WindowsRE\dwm.exe"
        29⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1116
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ZcfpJnj91J.bat"
        30⤵
        
        PID:2336
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        31⤵
        
        PID:2912
        
        C:\Recovery\WindowsRE\dwm.exe
        
        "C:\Recovery\WindowsRE\dwm.exe"
        31⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4660
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\C0VS1u4WCC.bat"
        32⤵
        
        PID:4740
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        33⤵
        
        PID:4456

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\providercommon\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\providercommon\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'C:\providercommon\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3204

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\dwm.exe.log

Filesize
1KB

MD5
baf55b95da4a601229647f25dad12878

SHA1
abc16954ebfd213733c4493fc1910164d825cac8

SHA256
ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

SHA512
24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6d3e9c29fe44e90aae6ed30ccf799ca8

SHA1
c7974ef72264bbdf13a2793ccf1aed11bc565dce

SHA256
2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

SHA512
60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

Download Submit
C:\Users\Admin\AppData\Local\Temp\BAdWWGXi7E.bat

Filesize
194B

MD5
b517ad6ad9ef2e5dc577b1c2e019b7c8

SHA1
9777bebd98be9fd7e0c06ec51207d0754b723f0b

SHA256
aab7b01f337f09be7b851f77b6c7b02a03dbe9566a08a98c26ddf440b55b6b44

SHA512
e685fb35bf58841c854a6c7e2e9a0397d8615de0f9c23b1552a734be02aa5a81b79fa70ee18b595432c0c5562f2728eda733eb85e2497ce537341678f55459e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Bp0TjAk7l7.bat

Filesize
194B

MD5
ef845a83e2c41f3494c95dfc2380b207

SHA1
5013f1de9d03535a1608cad7ef34a04479212ea3

SHA256
8f0b2c6b61be2451d5b8e6a06dd0b25766c05e70981ef30d966394bd10e77889

SHA512
761f934da13832e26ee836cef20a551e4e2bcbadfc6fd5d55709f3b2d9fb576782ace3ea4112d4e5a04361b97f617581bcdd98313a382f995fc3a14d57a0602d

Download Submit
C:\Users\Admin\AppData\Local\Temp\C0VS1u4WCC.bat

Filesize
194B

MD5
d866e4fc2e1802e48b899ff966a61a85

SHA1
b97c1e69305cb4410e3440a427b04091de29132d

SHA256
308c3575e36ea775413775e9c290dd219daaed4a4559b9dc0d5761e46713f96b

SHA512
83af1173998244e980b4e4b99c6edb96139a9a6a9e0be9b12a7c6f93455cba3811c92922b3d75925205fcea499c0ccc230728e9c725d773c256e687f875c51b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\LkcfmFI5TJ.bat

Filesize
194B

MD5
bfdc949f2cbe7555682d613f4969b4cd

SHA1
637bdf3949605019f2ac67aa12e32a0558adc21e

SHA256
2b11ab82cb54e34e18320d390353e77205da2d55f5c6b1c69aac908a780725a3

SHA512
37146dd1efb1524ded2d6ff0cf33ba776c422aac2a58de094401e4ef5e329a56d14d0b8ab752e827a9025dee986238880b41b546c4e469fdecf0254ebcbedf77

Download Submit
C:\Users\Admin\AppData\Local\Temp\ZcfpJnj91J.bat

Filesize
194B

MD5
529843f1881ca6dc1fed7fc8fbf28afe

SHA1
13c6690c64291a9552e5e558ed757137ecf5195d

SHA256
16efd095274b5985646926ab4c928e67ef86fee3954f69be2cf0c811f79e6efd

SHA512
cd723e74c313a91c865133b8af481841598bc0497bc1995a8d686e1f39a0736104b8251ed23e0502465bf448de1aecbea25fe70623b2946ded9d7c3ca85e3856

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_il0mu3w1.ev0.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\ddqzBJK7Zu.bat

Filesize
194B

MD5
a6c0b8496dca718da08ac75eed4579bc

SHA1
1101f2742e8a596059f5cf73a56fb5f3d2de1d34

SHA256
3b14465179fe3315cebee904c4b865ee603cbd228f227187c3e152206552a413

SHA512
3f77ef86459a7471cbf2bbcb51303fcc1818464d4c1437e1b597053913412d15387047419c3f8dd81ef6201a619d336ca5bd801084e3444ac23adafeece75f21

Download Submit
C:\Users\Admin\AppData\Local\Temp\gQkyN2upze.bat

Filesize
194B

MD5
0a929bd0e7d369146ffc03fae4e4b99e

SHA1
977120600c864dc3904b0df19bd31d04157928f6

SHA256
19ee0d6dc44df395fc5384026c8b3604b01d979ea33b792d19babfb042521c44

SHA512
ea9fea01dccf35ecb80719e8c41f9fd963371c76ff71fe91616d8e1136f045e33b3225bf8377e8f9af3ffd364abcccd925b2bf7cb9f42b3adf74b9fbe4fbba1a

Download Submit
C:\Users\Admin\AppData\Local\Temp\hbGxgnDDQj.bat

Filesize
194B

MD5
4a9246c835668dab4fe2f461cbd7869d

SHA1
4a90aa514c4e9678d962e13c8a1cece997e5c58d

SHA256
efeda27d0b0f838841ef42dafeb26d173c970c2cb87ee208949aa951a8b565e4

SHA512
cb073ca8ebd0216d0e3feae0bb69733fac901df1cb1c2ddea85efc33e1f30d351eb1877a92fd0bf68c42582689558cd237489d65b19892584e800f4d6091add8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nDq7RH5Uwz.bat

Filesize
194B

MD5
3366edac8c8ab9262fcbc1e0e3d72986

SHA1
efac735e2848715553a138257c09acf7b53ee011

SHA256
1682eceff19f90a26356e2043af2134782f7cc919f7eb20260457801a1bd2fab

SHA512
36d9fbacef84ba9a69b6a392a756bf77c3c04d860a2995dc74de4fee7a699bd70c10521226e8a3a37b0b826e3f9d2d5156b2befbb89d216ae30894bbe275b28f

Download Submit
C:\Users\Admin\AppData\Local\Temp\qKN9Q7Smhq.bat

Filesize
194B

MD5
18bf615a0a017b2943fbc6555d4f399f

SHA1
fe4619b9e6100160327c897b7b5429a24147cf77

SHA256
673752f87a0661f4a28e4b08ca168e87dc15072be740feb1e4f00094ca994b8a

SHA512
67da89e4d5300cc6fcfb08e3d505368adc89e08043f95cad0ff591711dc97763423a2a87a47a0a7308dd562955917915ab1fb9ed7f0a679c51179fef837b3ec2

Download Submit
C:\Users\Admin\AppData\Local\Temp\x8TIUMdSeB.bat

Filesize
194B

MD5
f480ef0cb3b3d73a171f1b61ed26742c

SHA1
511e21a9ba12c07d398c310b2220d9b1dd6d51ee

SHA256
129ee4395c0dee13ef7d1aeb0d2426e575a7c54044da9c8242556d5b57082c9e

SHA512
5948493612ff756c92f453cac2bf2d0ccc02ea833fbd075986467c12cf839d571e7e09d1362d02396907625e7e37955c711791320cef54cd1ec8621e8748ea7a

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/852-80-0x000000001C920000-0x000000001CA8A000-memory.dmp

Filesize
1.4MB

Download
memory/852-81-0x000000001CA90000-0x000000001CC39000-memory.dmp

Filesize
1.7MB

Download
memory/1056-17-0x0000000002CF0000-0x0000000002CFC000-memory.dmp

Filesize
48KB

Download
memory/1056-16-0x0000000002CE0000-0x0000000002CEC000-memory.dmp

Filesize
48KB

Download
memory/1056-15-0x0000000002CD0000-0x0000000002CDC000-memory.dmp

Filesize
48KB

Download
memory/1056-14-0x0000000002CC0000-0x0000000002CD2000-memory.dmp

Filesize
72KB

Download
memory/1056-13-0x0000000000B90000-0x0000000000CA0000-memory.dmp

Filesize
1.1MB

Download
memory/1056-12-0x00007FFA0FBE3000-0x00007FFA0FBE5000-memory.dmp

Filesize
8KB

Download
memory/2184-42-0x0000029C2F080000-0x0000029C2F0A2000-memory.dmp

Filesize
136KB

Download
memory/2348-98-0x00000000031D0000-0x00000000031E2000-memory.dmp

Filesize
72KB

Download
memory/4528-141-0x0000000002B10000-0x0000000002B22000-memory.dmp

Filesize
72KB

Download
memory/4732-89-0x000000001C9B0000-0x000000001CB59000-memory.dmp

Filesize
1.7MB

Download
memory/4732-88-0x000000001C800000-0x000000001C96A000-memory.dmp

Filesize
1.4MB

Download