Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22/12/2024, 08:42
Behavioral task
behavioral1
Sample
JaffaCakes118_0439084aa3446284d0fa721c6b6becc7ddc3220691ff089fabc25af38bab10ea.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_0439084aa3446284d0fa721c6b6becc7ddc3220691ff089fabc25af38bab10ea.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_0439084aa3446284d0fa721c6b6becc7ddc3220691ff089fabc25af38bab10ea.exe
-
Size
1.3MB
-
MD5
0b113ec15bb5ccb71d4ddde8fd6c9cd9
-
SHA1
ba4196d40fb55a3cea9843d6705c7c4c8dfb50d0
-
SHA256
0439084aa3446284d0fa721c6b6becc7ddc3220691ff089fabc25af38bab10ea
-
SHA512
fc4b066a243ac3ec4dba01eff8745b60a672c8c38466cc08f3d3461a45f45386ad9ab3f5459b6fe2b403ab18603f0ba3a76a1f89c5da5a6507abdc9e3585abfa
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Process spawned unexpected child process 12 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4304 1372 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3244 1372 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 880 1372 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3448 1372 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3512 1372 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3728 1372 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2780 1372 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3544 1372 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4004 1372 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2752 1372 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4036 1372 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2396 1372 schtasks.exe 86 -
resource yara_rule behavioral2/files/0x000a000000023b8a-10.dat dcrat behavioral2/memory/4344-13-0x0000000000CF0000-0x0000000000E00000-memory.dmp dcrat -
Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 3552 powershell.exe 3032 powershell.exe 2272 powershell.exe 3184 powershell.exe 1548 powershell.exe -
Checks computer location settings 2 TTPs 14 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation Idle.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation Idle.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation Idle.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation Idle.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation DllCommonsvc.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation Idle.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation Idle.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation Idle.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation Idle.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation JaffaCakes118_0439084aa3446284d0fa721c6b6becc7ddc3220691ff089fabc25af38bab10ea.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation Idle.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation Idle.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation Idle.exe -
Executes dropped EXE 12 IoCs
pid Process 4344 DllCommonsvc.exe 4032 Idle.exe 3484 Idle.exe 1168 Idle.exe 2288 Idle.exe 1744 Idle.exe 2280 Idle.exe 3612 Idle.exe 4028 Idle.exe 3908 Idle.exe 4420 Idle.exe 736 Idle.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 12 IoCs
flow ioc 46 raw.githubusercontent.com 19 raw.githubusercontent.com 20 raw.githubusercontent.com 32 raw.githubusercontent.com 36 raw.githubusercontent.com 37 raw.githubusercontent.com 40 raw.githubusercontent.com 41 raw.githubusercontent.com 53 raw.githubusercontent.com 47 raw.githubusercontent.com 48 raw.githubusercontent.com 49 raw.githubusercontent.com -
Drops file in Program Files directory 5 IoCs
description ioc Process File created C:\Program Files\Windows NT\Accessories\es-ES\6ccacd8608530f DllCommonsvc.exe File created C:\Program Files\Windows Defender\es-ES\Idle.exe DllCommonsvc.exe File opened for modification C:\Program Files\Windows Defender\es-ES\Idle.exe DllCommonsvc.exe File created C:\Program Files\Windows Defender\es-ES\6ccacd8608530f DllCommonsvc.exe File created C:\Program Files\Windows NT\Accessories\es-ES\Idle.exe DllCommonsvc.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\OCR\en-us\csrss.exe DllCommonsvc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_0439084aa3446284d0fa721c6b6becc7ddc3220691ff089fabc25af38bab10ea.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies registry class 13 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings Idle.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings Idle.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings Idle.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings Idle.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings JaffaCakes118_0439084aa3446284d0fa721c6b6becc7ddc3220691ff089fabc25af38bab10ea.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings DllCommonsvc.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings Idle.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings Idle.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings Idle.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings Idle.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings Idle.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings Idle.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings Idle.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 12 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2752 schtasks.exe 2396 schtasks.exe 3244 schtasks.exe 3512 schtasks.exe 4004 schtasks.exe 3728 schtasks.exe 2780 schtasks.exe 3544 schtasks.exe 4036 schtasks.exe 4304 schtasks.exe 880 schtasks.exe 3448 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 26 IoCs
pid Process 4344 DllCommonsvc.exe 4344 DllCommonsvc.exe 4344 DllCommonsvc.exe 4344 DllCommonsvc.exe 4344 DllCommonsvc.exe 3552 powershell.exe 3184 powershell.exe 2272 powershell.exe 3032 powershell.exe 1548 powershell.exe 3552 powershell.exe 3184 powershell.exe 1548 powershell.exe 3032 powershell.exe 2272 powershell.exe 4032 Idle.exe 3484 Idle.exe 1168 Idle.exe 2288 Idle.exe 1744 Idle.exe 2280 Idle.exe 3612 Idle.exe 4028 Idle.exe 3908 Idle.exe 4420 Idle.exe 736 Idle.exe -
Suspicious use of AdjustPrivilegeToken 17 IoCs
description pid Process Token: SeDebugPrivilege 4344 DllCommonsvc.exe Token: SeDebugPrivilege 3552 powershell.exe Token: SeDebugPrivilege 3184 powershell.exe Token: SeDebugPrivilege 2272 powershell.exe Token: SeDebugPrivilege 3032 powershell.exe Token: SeDebugPrivilege 1548 powershell.exe Token: SeDebugPrivilege 4032 Idle.exe Token: SeDebugPrivilege 3484 Idle.exe Token: SeDebugPrivilege 1168 Idle.exe Token: SeDebugPrivilege 2288 Idle.exe Token: SeDebugPrivilege 1744 Idle.exe Token: SeDebugPrivilege 2280 Idle.exe Token: SeDebugPrivilege 3612 Idle.exe Token: SeDebugPrivilege 4028 Idle.exe Token: SeDebugPrivilege 3908 Idle.exe Token: SeDebugPrivilege 4420 Idle.exe Token: SeDebugPrivilege 736 Idle.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4792 wrote to memory of 832 4792 JaffaCakes118_0439084aa3446284d0fa721c6b6becc7ddc3220691ff089fabc25af38bab10ea.exe 82 PID 4792 wrote to memory of 832 4792 JaffaCakes118_0439084aa3446284d0fa721c6b6becc7ddc3220691ff089fabc25af38bab10ea.exe 82 PID 4792 wrote to memory of 832 4792 JaffaCakes118_0439084aa3446284d0fa721c6b6becc7ddc3220691ff089fabc25af38bab10ea.exe 82 PID 832 wrote to memory of 2184 832 WScript.exe 83 PID 832 wrote to memory of 2184 832 WScript.exe 83 PID 832 wrote to memory of 2184 832 WScript.exe 83 PID 2184 wrote to memory of 4344 2184 cmd.exe 85 PID 2184 wrote to memory of 4344 2184 cmd.exe 85 PID 4344 wrote to memory of 1548 4344 DllCommonsvc.exe 99 PID 4344 wrote to memory of 1548 4344 DllCommonsvc.exe 99 PID 4344 wrote to memory of 3184 4344 DllCommonsvc.exe 100 PID 4344 wrote to memory of 3184 4344 DllCommonsvc.exe 100 PID 4344 wrote to memory of 2272 4344 DllCommonsvc.exe 101 PID 4344 wrote to memory of 2272 4344 DllCommonsvc.exe 101 PID 4344 wrote to memory of 3032 4344 DllCommonsvc.exe 102 PID 4344 wrote to memory of 3032 4344 DllCommonsvc.exe 102 PID 4344 wrote to memory of 3552 4344 DllCommonsvc.exe 103 PID 4344 wrote to memory of 3552 4344 DllCommonsvc.exe 103 PID 4344 wrote to memory of 3128 4344 DllCommonsvc.exe 109 PID 4344 wrote to memory of 3128 4344 DllCommonsvc.exe 109 PID 3128 wrote to memory of 3524 3128 cmd.exe 111 PID 3128 wrote to memory of 3524 3128 cmd.exe 111 PID 3128 wrote to memory of 4032 3128 cmd.exe 115 PID 3128 wrote to memory of 4032 3128 cmd.exe 115 PID 4032 wrote to memory of 3096 4032 Idle.exe 119 PID 4032 wrote to memory of 3096 4032 Idle.exe 119 PID 3096 wrote to memory of 2092 3096 cmd.exe 121 PID 3096 wrote to memory of 2092 3096 cmd.exe 121 PID 3096 wrote to memory of 3484 3096 cmd.exe 122 PID 3096 wrote to memory of 3484 3096 cmd.exe 122 PID 3484 wrote to memory of 2396 3484 Idle.exe 125 PID 3484 wrote to memory of 2396 3484 Idle.exe 125 PID 2396 wrote to memory of 4484 2396 cmd.exe 127 PID 2396 wrote to memory of 4484 2396 cmd.exe 127 PID 2396 wrote to memory of 1168 2396 cmd.exe 128 PID 2396 wrote to memory of 1168 2396 cmd.exe 128 PID 1168 wrote to memory of 4344 1168 Idle.exe 129 PID 1168 wrote to memory of 4344 1168 Idle.exe 129 PID 4344 wrote to memory of 3068 4344 cmd.exe 131 PID 4344 wrote to memory of 3068 4344 cmd.exe 131 PID 4344 wrote to memory of 2288 4344 cmd.exe 132 PID 4344 wrote to memory of 2288 4344 cmd.exe 132 PID 2288 wrote to memory of 4956 2288 Idle.exe 133 PID 2288 wrote to memory of 4956 2288 Idle.exe 133 PID 4956 wrote to memory of 2116 4956 cmd.exe 135 PID 4956 wrote to memory of 2116 4956 cmd.exe 135 PID 4956 wrote to memory of 1744 4956 cmd.exe 136 PID 4956 wrote to memory of 1744 4956 cmd.exe 136 PID 1744 wrote to memory of 644 1744 Idle.exe 137 PID 1744 wrote to memory of 644 1744 Idle.exe 137 PID 644 wrote to memory of 2160 644 cmd.exe 139 PID 644 wrote to memory of 2160 644 cmd.exe 139 PID 644 wrote to memory of 2280 644 cmd.exe 140 PID 644 wrote to memory of 2280 644 cmd.exe 140 PID 2280 wrote to memory of 4540 2280 Idle.exe 141 PID 2280 wrote to memory of 4540 2280 Idle.exe 141 PID 4540 wrote to memory of 1436 4540 cmd.exe 143 PID 4540 wrote to memory of 1436 4540 cmd.exe 143 PID 4540 wrote to memory of 3612 4540 cmd.exe 144 PID 4540 wrote to memory of 3612 4540 cmd.exe 144 PID 3612 wrote to memory of 1288 3612 Idle.exe 145 PID 3612 wrote to memory of 1288 3612 Idle.exe 145 PID 1288 wrote to memory of 1788 1288 cmd.exe 147 PID 1288 wrote to memory of 1788 1288 cmd.exe 147 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0439084aa3446284d0fa721c6b6becc7ddc3220691ff089fabc25af38bab10ea.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0439084aa3446284d0fa721c6b6becc7ddc3220691ff089fabc25af38bab10ea.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:832 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\providercommon\DllCommonsvc.exe"C:\providercommon\DllCommonsvc.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1548
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Defender\es-ES\Idle.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3184
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\dwm.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2272
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows NT\Accessories\es-ES\Idle.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3032
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\System.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3552
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\c46SgfL9Er.bat"5⤵
- Suspicious use of WriteProcessMemory
PID:3128 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:26⤵PID:3524
-
-
C:\Program Files\Windows Defender\es-ES\Idle.exe"C:\Program Files\Windows Defender\es-ES\Idle.exe"6⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4032 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\8qIUyQJ4qD.bat"7⤵
- Suspicious use of WriteProcessMemory
PID:3096 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:28⤵PID:2092
-
-
C:\Program Files\Windows Defender\es-ES\Idle.exe"C:\Program Files\Windows Defender\es-ES\Idle.exe"8⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3484 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ZZzsG8LzQB.bat"9⤵
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:210⤵PID:4484
-
-
C:\Program Files\Windows Defender\es-ES\Idle.exe"C:\Program Files\Windows Defender\es-ES\Idle.exe"10⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\z7AIE64VZ5.bat"11⤵
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:212⤵PID:3068
-
-
C:\Program Files\Windows Defender\es-ES\Idle.exe"C:\Program Files\Windows Defender\es-ES\Idle.exe"12⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\1CKPPXbanu.bat"13⤵
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:214⤵PID:2116
-
-
C:\Program Files\Windows Defender\es-ES\Idle.exe"C:\Program Files\Windows Defender\es-ES\Idle.exe"14⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\38MS6cfT7h.bat"15⤵
- Suspicious use of WriteProcessMemory
PID:644 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:216⤵PID:2160
-
-
C:\Program Files\Windows Defender\es-ES\Idle.exe"C:\Program Files\Windows Defender\es-ES\Idle.exe"16⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\be8zRZs4e0.bat"17⤵
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:218⤵PID:1436
-
-
C:\Program Files\Windows Defender\es-ES\Idle.exe"C:\Program Files\Windows Defender\es-ES\Idle.exe"18⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3612 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\38MS6cfT7h.bat"19⤵
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:220⤵PID:1788
-
-
C:\Program Files\Windows Defender\es-ES\Idle.exe"C:\Program Files\Windows Defender\es-ES\Idle.exe"20⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4028 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\76lQa6YaxV.bat"21⤵PID:1824
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:222⤵PID:2260
-
-
C:\Program Files\Windows Defender\es-ES\Idle.exe"C:\Program Files\Windows Defender\es-ES\Idle.exe"22⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3908 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\VhvmsyECnd.bat"23⤵PID:1064
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:224⤵PID:2808
-
-
C:\Program Files\Windows Defender\es-ES\Idle.exe"C:\Program Files\Windows Defender\es-ES\Idle.exe"24⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4420 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Zi7wkUpBKE.bat"25⤵PID:4764
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:226⤵PID:520
-
-
C:\Program Files\Windows Defender\es-ES\Idle.exe"C:\Program Files\Windows Defender\es-ES\Idle.exe"26⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:736 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\xB9FX11cFJ.bat"27⤵PID:3276
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:228⤵PID:5076
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Defender\es-ES\Idle.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4304
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\es-ES\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3244
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Defender\es-ES\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:880
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\providercommon\dwm.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3448
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\providercommon\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3512
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 5 /tr "'C:\providercommon\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3728
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows NT\Accessories\es-ES\Idle.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2780
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files\Windows NT\Accessories\es-ES\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3544
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows NT\Accessories\es-ES\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4004
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\System.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2752
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4036
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2396
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5baf55b95da4a601229647f25dad12878
SHA1abc16954ebfd213733c4493fc1910164d825cac8
SHA256ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
SHA51224f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD5cadef9abd087803c630df65264a6c81c
SHA1babbf3636c347c8727c35f3eef2ee643dbcc4bd2
SHA256cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438
SHA5127278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085
-
Filesize
944B
MD56d42b6da621e8df5674e26b799c8e2aa
SHA1ab3ce1327ea1eeedb987ec823d5e0cb146bafa48
SHA2565ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c
SHA51253faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29
-
Filesize
213B
MD57a45db5ff4be2c106be5495e457cec7b
SHA16309dd32a2466b16a1bbb5a5aebfb5a8e7acc52b
SHA256abf4c5c78a50307c0528e679bd75998560856c7abd55ed219fa3800993ccae8e
SHA512be66a108365a3e43c27903e55652ae80ccbd30abb43448c03bd5443cbb84fc3ead161455b396d9380a7a1edb46dbd31fc09423ca1cacda7742c531e3fd3f29ae
-
Filesize
213B
MD5e469957c9de759bc297351a970de0fed
SHA12fddf3f4993f1d5559baad89b3efe10631ddacd5
SHA2562b0c9e2a5a19415635cb938e048fba1c34bce17d37bfbbffa904c7eb9fb7d1bf
SHA5128838e89c385cc0cd76c2803b094188f3e67d712dff472551c544113793272c1f91ee9b9c4c9ec3a60bed95dd696e5bd9997c30a2aa62b8fc1c24338a0be951a5
-
Filesize
213B
MD5df5d4b986c9908ead6f93ada53d644e5
SHA1e540047914eb5fb8d7c03e95146ddec56221f34b
SHA2568885af75cca4f4c77cdacdb9d674afddf692c8a86205ce939c504ceabe36d605
SHA512404080d615d36e9250fef8be04e5ec3feb58881801bda2c7a94b5722954b9448f78dba9f21a2c96a568cf34ce615938e8e875b9bfdbd929d4ff8722f75b76529
-
Filesize
213B
MD5bb5b3d4d9af57f97593b6c80a25a2d22
SHA1c52adad04d840375cf7b7c7b17c6b3ecd211ec86
SHA256265d0072cd633daebbf996fc1563f81696529eee1259008b3fd630665ad29d9a
SHA51238e1f4ebcbfe6016ea425d15b9da7a9b880d1edd673b7e141bd6aa0c1240665a89f1a2abdfdcd75cda2c6666c15aae3e25333c86e7735c6bf19cac03c9644d91
-
Filesize
213B
MD5c98808b115862366e948489296018dba
SHA1ee256315b898c9779604835b3711c4482c859f1b
SHA256bcb826a1bc1a614d1a240fc2b7f7b2ca0a9437fc8d14a6408f271ce5c399aacb
SHA512f5978fdd365b6a7ac7c01e6e2c1fb9b5ad0929aa17685c00472b7137a9bf4102b5d603a34528dcd1ce9176e0978298a6452d85a72edebbcfc4e75f768805ada7
-
Filesize
213B
MD57a89df6714513231735c4a8879f879bd
SHA19ad0bd3ddc601beaf4888c429836caee0785891a
SHA256fcd19b9618aed198612a44f5a0466aaee7451ab3f5cff426ac2648af623a37f4
SHA51242ef65f4d3dde5dc6de9350c59a2e047cbd1f89d948dfd403d04e7339d7ad50455e5ebe6d4e9c271496e686e97a920692c89690e74570c4b55a19dd490553074
-
Filesize
213B
MD5a2a045b33ed9bf53970601ba64bde76a
SHA1ba1a1a4d8bacd0c96edab2ad3e787cd88d812305
SHA256bda2487cd715d3a9a101e46b277c8290755b27eca44e8be2ac1ca7f8c6c6819c
SHA51227699ea87478e671685dc8ab84e7018aa041aed8bd026af6d87e0ddaf41735dd1b113f046d143c0061eb21ee9a4799f0eaf37870905089589c350aa4a9859eb8
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
213B
MD5011a472363b10a7b96daee9a6a2322ee
SHA1ba8d412ca32fe665ed6271ca709659550cbdf138
SHA2569e233079259b5f9471665f34d888862f9b4d9ced12dc121314f736bfe2834207
SHA51211cf52d64155d208346a852715fb06a74c7d6428e0efe350d1a81395352a4296fe9934c2db9100f7b5861c2f739452fa1c858abc74ccdc7271111243cda390f3
-
Filesize
213B
MD57ea7176f10f23103f30e28d9114ab762
SHA1b8571cbd6a038c75ffb111b2243c2573bdcedbae
SHA2566f55eaeab8f40c06215d1ddfb868b546f3ef1bd7c6e299cee1fe55ff10d78568
SHA51215701a1a566fe6ef353cd0c94d7590033c8fefd54f8fae8951cd899b22f847b11008a74b34f6c1a41e8dea9494dca42501db465df4b7533d7cb62d9ee3d734a4
-
Filesize
213B
MD59252815b4cadc86751636634fbc5dbb6
SHA10cb9816a106f78b02dc9bbfea074038c8f6ca2eb
SHA25673532052cea4f22272d7c918bc62f9bfef5b93464de7c7042f06b30f2adb3569
SHA5129a7164a3f541c80f365853089267271959ea4c5de7fc74dda5af417df5455266c5f0f37763b2ff1f7b97750be55f8708ae5c5b656a2c64a890e9d667a67a8572
-
Filesize
213B
MD599c0d397731f9e08978daa197fd50315
SHA17f8b8888c0e733f8a6b93ba1ecdd79f252ad14b9
SHA2568b8ced07c1e53560ced9e138cae122b93f6c634a82b3cf397a339b06977a659e
SHA512e6e594335e38e7d943698821099f064d748f518d8634d15c3c86ede3cc20621ce402dbd71149469f4da50d7e61a32d4458b6f1dfc71e234541cbb992d017ba56
-
Filesize
36B
MD56783c3ee07c7d151ceac57f1f9c8bed7
SHA117468f98f95bf504cc1f83c49e49a78526b3ea03
SHA2568ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322
SHA512c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8
-
Filesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
Filesize
197B
MD58088241160261560a02c84025d107592
SHA1083121f7027557570994c9fc211df61730455bb5
SHA2562072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1
SHA51220d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478