dcrat | ba099f212647b418c123a48c46767baac59297826025423e53e72d068c100121

Analysis

max time kernel
146s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22/12/2024, 11:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_ba099f212647b418c123a48c46767baac59297826025423e53e72d068c100121.exe
Size

1.3MB
MD5

441496886fe207aecce88f72ded7acc0
SHA1

11734e54de9fc0693e1e601d33537b38dde8ba88
SHA256

ba099f212647b418c123a48c46767baac59297826025423e53e72d068c100121
SHA512

31ccc3a66e5e2b10eb735eef501de5ff34e3864adc6ad704512be2292067003365b1782b2a63ff96e285e7b9a26da5c3863637628d0952c826c5cd880fe9f05a
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 6 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4124	3704	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3820	3704	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2420	3704	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1684	3704	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4396	3704	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2576	3704	schtasks.exe	88

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x000a000000023b92-10.dat	dcrat
behavioral2/memory/1600-13-0x0000000000320000-0x0000000000430000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4744	powershell.exe
4716	powershell.exe
5048	powershell.exe

Checks computer location settings 2 TTPs 16 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	wininit.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	wininit.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	wininit.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	wininit.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	wininit.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	wininit.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	JaffaCakes118_ba099f212647b418c123a48c46767baac59297826025423e53e72d068c100121.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	wininit.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	wininit.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	wininit.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	wininit.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	wininit.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	wininit.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	wininit.exe

Executes dropped EXE 14 IoCs

pid	Process
1600	DllCommonsvc.exe
2448	wininit.exe
432	wininit.exe
3032	wininit.exe
2140	wininit.exe
3392	wininit.exe
4716	wininit.exe
1636	wininit.exe
4532	wininit.exe
3432	wininit.exe
4240	wininit.exe
472	wininit.exe
4916	wininit.exe
3620	wininit.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 14 IoCs

Web Service

T1102

flow	ioc
58	raw.githubusercontent.com
23	raw.githubusercontent.com
42	raw.githubusercontent.com
44	raw.githubusercontent.com
48	raw.githubusercontent.com
51	raw.githubusercontent.com
17	raw.githubusercontent.com
18	raw.githubusercontent.com
57	raw.githubusercontent.com
60	raw.githubusercontent.com
43	raw.githubusercontent.com
52	raw.githubusercontent.com
56	raw.githubusercontent.com
59	raw.githubusercontent.com

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Media Player\Skins\wininit.exe	DllCommonsvc.exe
File opened for modification	C:\Program Files\Windows Media Player\Skins\wininit.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Media Player\Skins\56085415360792	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_ba099f212647b418c123a48c46767baac59297826025423e53e72d068c100121.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	wininit.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	wininit.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	wininit.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	wininit.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	wininit.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	wininit.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	wininit.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	wininit.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	wininit.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	wininit.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	wininit.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	wininit.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	wininit.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	JaffaCakes118_ba099f212647b418c123a48c46767baac59297826025423e53e72d068c100121.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2576	schtasks.exe
4124	schtasks.exe
3820	schtasks.exe
2420	schtasks.exe
1684	schtasks.exe
4396	schtasks.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
1600	DllCommonsvc.exe
1600	DllCommonsvc.exe
1600	DllCommonsvc.exe
4716	powershell.exe
4744	powershell.exe
5048	powershell.exe
4744	powershell.exe
4716	powershell.exe
5048	powershell.exe
2448	wininit.exe
432	wininit.exe
3032	wininit.exe
2140	wininit.exe
3392	wininit.exe
4716	wininit.exe
1636	wininit.exe
4532	wininit.exe
3432	wininit.exe
4240	wininit.exe
472	wininit.exe
4916	wininit.exe
3620	wininit.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeDebugPrivilege	1600	DllCommonsvc.exe
Token: SeDebugPrivilege	4716	powershell.exe
Token: SeDebugPrivilege	4744	powershell.exe
Token: SeDebugPrivilege	5048	powershell.exe
Token: SeDebugPrivilege	2448	wininit.exe
Token: SeDebugPrivilege	432	wininit.exe
Token: SeDebugPrivilege	3032	wininit.exe
Token: SeDebugPrivilege	2140	wininit.exe
Token: SeDebugPrivilege	3392	wininit.exe
Token: SeDebugPrivilege	4716	wininit.exe
Token: SeDebugPrivilege	1636	wininit.exe
Token: SeDebugPrivilege	4532	wininit.exe
Token: SeDebugPrivilege	3432	wininit.exe
Token: SeDebugPrivilege	4240	wininit.exe
Token: SeDebugPrivilege	472	wininit.exe
Token: SeDebugPrivilege	4916	wininit.exe
Token: SeDebugPrivilege	3620	wininit.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4076 wrote to memory of 1624	4076	JaffaCakes118_ba099f212647b418c123a48c46767baac59297826025423e53e72d068c100121.exe	84
PID 4076 wrote to memory of 1624	4076	JaffaCakes118_ba099f212647b418c123a48c46767baac59297826025423e53e72d068c100121.exe	84
PID 4076 wrote to memory of 1624	4076	JaffaCakes118_ba099f212647b418c123a48c46767baac59297826025423e53e72d068c100121.exe	84
PID 1624 wrote to memory of 4652	1624	WScript.exe	85
PID 1624 wrote to memory of 4652	1624	WScript.exe	85
PID 1624 wrote to memory of 4652	1624	WScript.exe	85
PID 4652 wrote to memory of 1600	4652	cmd.exe	87
PID 4652 wrote to memory of 1600	4652	cmd.exe	87
PID 1600 wrote to memory of 5048	1600	DllCommonsvc.exe	95
PID 1600 wrote to memory of 5048	1600	DllCommonsvc.exe	95
PID 1600 wrote to memory of 4716	1600	DllCommonsvc.exe	96
PID 1600 wrote to memory of 4716	1600	DllCommonsvc.exe	96
PID 1600 wrote to memory of 4744	1600	DllCommonsvc.exe	97
PID 1600 wrote to memory of 4744	1600	DllCommonsvc.exe	97
PID 1600 wrote to memory of 3872	1600	DllCommonsvc.exe	101
PID 1600 wrote to memory of 3872	1600	DllCommonsvc.exe	101
PID 3872 wrote to memory of 1400	3872	cmd.exe	103
PID 3872 wrote to memory of 1400	3872	cmd.exe	103
PID 3872 wrote to memory of 2448	3872	cmd.exe	104
PID 3872 wrote to memory of 2448	3872	cmd.exe	104
PID 2448 wrote to memory of 4516	2448	wininit.exe	107
PID 2448 wrote to memory of 4516	2448	wininit.exe	107
PID 4516 wrote to memory of 4588	4516	cmd.exe	109
PID 4516 wrote to memory of 4588	4516	cmd.exe	109
PID 4516 wrote to memory of 432	4516	cmd.exe	112
PID 4516 wrote to memory of 432	4516	cmd.exe	112
PID 432 wrote to memory of 1124	432	wininit.exe	115
PID 432 wrote to memory of 1124	432	wininit.exe	115
PID 1124 wrote to memory of 3584	1124	cmd.exe	117
PID 1124 wrote to memory of 3584	1124	cmd.exe	117
PID 1124 wrote to memory of 3032	1124	cmd.exe	119
PID 1124 wrote to memory of 3032	1124	cmd.exe	119
PID 3032 wrote to memory of 2108	3032	wininit.exe	121
PID 3032 wrote to memory of 2108	3032	wininit.exe	121
PID 2108 wrote to memory of 2988	2108	cmd.exe	123
PID 2108 wrote to memory of 2988	2108	cmd.exe	123
PID 2108 wrote to memory of 2140	2108	cmd.exe	124
PID 2108 wrote to memory of 2140	2108	cmd.exe	124
PID 2140 wrote to memory of 2596	2140	wininit.exe	125
PID 2140 wrote to memory of 2596	2140	wininit.exe	125
PID 2596 wrote to memory of 404	2596	cmd.exe	127
PID 2596 wrote to memory of 404	2596	cmd.exe	127
PID 2596 wrote to memory of 3392	2596	cmd.exe	128
PID 2596 wrote to memory of 3392	2596	cmd.exe	128
PID 3392 wrote to memory of 2180	3392	wininit.exe	129
PID 3392 wrote to memory of 2180	3392	wininit.exe	129
PID 2180 wrote to memory of 576	2180	cmd.exe	131
PID 2180 wrote to memory of 576	2180	cmd.exe	131
PID 2180 wrote to memory of 4716	2180	cmd.exe	132
PID 2180 wrote to memory of 4716	2180	cmd.exe	132
PID 4716 wrote to memory of 1712	4716	wininit.exe	133
PID 4716 wrote to memory of 1712	4716	wininit.exe	133
PID 1712 wrote to memory of 2796	1712	cmd.exe	135
PID 1712 wrote to memory of 2796	1712	cmd.exe	135
PID 1712 wrote to memory of 1636	1712	cmd.exe	136
PID 1712 wrote to memory of 1636	1712	cmd.exe	136
PID 1636 wrote to memory of 4044	1636	wininit.exe	137
PID 1636 wrote to memory of 4044	1636	wininit.exe	137
PID 4044 wrote to memory of 4544	4044	cmd.exe	139
PID 4044 wrote to memory of 4544	4044	cmd.exe	139
PID 4044 wrote to memory of 4532	4044	cmd.exe	140
PID 4044 wrote to memory of 4532	4044	cmd.exe	140
PID 4532 wrote to memory of 1376	4532	wininit.exe	141
PID 4532 wrote to memory of 1376	4532	wininit.exe	141

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ba099f212647b418c123a48c46767baac59297826025423e53e72d068c100121.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ba099f212647b418c123a48c46767baac59297826025423e53e72d068c100121.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4076
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1624
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4652
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Program Files directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1600
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5048
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Media Player\Skins\wininit.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4716
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\SppExtComObj.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4744
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\MyWP5Zn5XF.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3872
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:1400
      - C:\Program Files\Windows Media Player\Skins\wininit.exe
        
        "C:\Program Files\Windows Media Player\Skins\wininit.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2448
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\1F0LTC0kP2.bat"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:4516
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:4588
        
        C:\Program Files\Windows Media Player\Skins\wininit.exe
        
        "C:\Program Files\Windows Media Player\Skins\wininit.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:432
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\HmDgHlPzdV.bat"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:1124
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:3584
        
        C:\Program Files\Windows Media Player\Skins\wininit.exe
        
        "C:\Program Files\Windows Media Player\Skins\wininit.exe"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3032
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\iMm147yiIR.bat"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:2108
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:2988
        
        C:\Program Files\Windows Media Player\Skins\wininit.exe
        
        "C:\Program Files\Windows Media Player\Skins\wininit.exe"
        12⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2140
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\bhowVEGEG8.bat"
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:2596
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        14⤵
        
        PID:404
        
        C:\Program Files\Windows Media Player\Skins\wininit.exe
        
        "C:\Program Files\Windows Media Player\Skins\wininit.exe"
        14⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3392
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\vCRFnHZZKP.bat"
        15⤵
        Suspicious use of WriteProcessMemory
        
        PID:2180
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        16⤵
        
        PID:576
        
        C:\Program Files\Windows Media Player\Skins\wininit.exe
        
        "C:\Program Files\Windows Media Player\Skins\wininit.exe"
        16⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4716
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\aWJwCUxpp4.bat"
        17⤵
        Suspicious use of WriteProcessMemory
        
        PID:1712
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        18⤵
        
        PID:2796
        
        C:\Program Files\Windows Media Player\Skins\wininit.exe
        
        "C:\Program Files\Windows Media Player\Skins\wininit.exe"
        18⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1636
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\p9sA7N8NGm.bat"
        19⤵
        Suspicious use of WriteProcessMemory
        
        PID:4044
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        20⤵
        
        PID:4544
        
        C:\Program Files\Windows Media Player\Skins\wininit.exe
        
        "C:\Program Files\Windows Media Player\Skins\wininit.exe"
        20⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4532
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\qKN9Q7Smhq.bat"
        21⤵
        
        PID:1376
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        22⤵
        
        PID:2460
        
        C:\Program Files\Windows Media Player\Skins\wininit.exe
        
        "C:\Program Files\Windows Media Player\Skins\wininit.exe"
        22⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3432
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\EqBdbgL5Ji.bat"
        23⤵
        
        PID:2584
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        24⤵
        
        PID:4384
        
        C:\Program Files\Windows Media Player\Skins\wininit.exe
        
        "C:\Program Files\Windows Media Player\Skins\wininit.exe"
        24⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4240
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\KtkjGbmHOL.bat"
        25⤵
        
        PID:5016
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        26⤵
        
        PID:4008
        
        C:\Program Files\Windows Media Player\Skins\wininit.exe
        
        "C:\Program Files\Windows Media Player\Skins\wininit.exe"
        26⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:472
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\kQw8FYVnXF.bat"
        27⤵
        
        PID:4824
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        28⤵
        
        PID:4464
        
        C:\Program Files\Windows Media Player\Skins\wininit.exe
        
        "C:\Program Files\Windows Media Player\Skins\wininit.exe"
        28⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4916
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\NfeiSKMyn5.bat"
        29⤵
        
        PID:2740
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        30⤵
        
        PID:4276
        
        C:\Program Files\Windows Media Player\Skins\wininit.exe
        
        "C:\Program Files\Windows Media Player\Skins\wininit.exe"
        30⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3620
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\2zXOrWkEHk.bat"
        31⤵
        
        PID:3976
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        32⤵
        
        PID:5076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Media Player\Skins\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4124

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files\Windows Media Player\Skins\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Media Player\Skins\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2420

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\wininit.exe.log

Filesize
1KB

MD5
baf55b95da4a601229647f25dad12878

SHA1
abc16954ebfd213733c4493fc1910164d825cac8

SHA256
ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

SHA512
24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6d42b6da621e8df5674e26b799c8e2aa

SHA1
ab3ce1327ea1eeedb987ec823d5e0cb146bafa48

SHA256
5ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c

SHA512
53faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29

Download Submit
C:\Users\Admin\AppData\Local\Temp\1F0LTC0kP2.bat

Filesize
220B

MD5
852e19e82ea930e81d62463233aa0cd3

SHA1
7b02d9a85a063a8282bad1729afa178d22b818b6

SHA256
4604756af8a3474217580756e435e53b1ef9aec62f8d9890f38a8d22ce32bc91

SHA512
bbeea0a63876140463d09742c9dd7a0846393aec21826bd3bac092a271e0eff8cdaf621cd52c15ad6240196a23d520d9a6515ee6f97ef1d4ac25370e78f1d9f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\2zXOrWkEHk.bat

Filesize
220B

MD5
e16d843d912994ac13b39a0d9cf4767d

SHA1
539b228b41546ef1e7dbf89b69dfc975364b5e10

SHA256
0d3949949d62e2668dc76338f228308ba2968cc85f275548178dae60a1eec868

SHA512
c8915ef1892c7e585b72fdea810a129b49fbaf5b2022c8a039acc3ef607f18685a480a70d42f8b88de37826b431f561fcbf40b77a6e2a71e4ad3ffee603ec26f

Download Submit
C:\Users\Admin\AppData\Local\Temp\EqBdbgL5Ji.bat

Filesize
220B

MD5
115a54096eae4eacf0fae551aee8a9df

SHA1
5a724e0865cd49c5b3a58e63bac3df569230c646

SHA256
cef5af9675d6d763dce29469f266cac1e620d565e803e8b405b396bceb0cb31f

SHA512
47add0281993a43303927b88eba58e1c2df987aac8b6838cb7dc7af848e83657a34ad0ef5a4ba746962a25230afe0946371383f5c3f7cc046aa716ac8aca4cf4

Download Submit
C:\Users\Admin\AppData\Local\Temp\HmDgHlPzdV.bat

Filesize
220B

MD5
45ac8a94c8b47d91c1945495faad81b0

SHA1
52e23f02869a1bca0d335e9dfeef76f32116334a

SHA256
278c422231cdb581f155e308ddee93c5202443ec00615ea38274585ab42183c2

SHA512
47b02988cb99a693a38cd6cb70f1466d0f67f0c018baa11bc04a0db2df3dd9baa0c6ef29086cf5c7e53840e154c9be8997941771abebef4cfd411178f51c1915

Download Submit
C:\Users\Admin\AppData\Local\Temp\KtkjGbmHOL.bat

Filesize
220B

MD5
fb6d18410bdd049857785fc1f5ada24b

SHA1
723a92f0e73eb20bea13bbf26b255e408ba9214c

SHA256
470ac65abff80f2abe6d71255f30ea9b7f2cdb00d3df8d3511ea934b43a73309

SHA512
e63a01527ac426ff33f509b77b65c5619ea7af503fd80b1db520ef43326dd7b9050180dc91b30b1cb4ecd0200bdd0b2131093f03ad7872678b8b2a1b4ed38cb9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MyWP5Zn5XF.bat

Filesize
220B

MD5
7a7855c2694c4ac964627301f5e36317

SHA1
dda692644364aab59defc0f68c36bd9e98a85e90

SHA256
45b8bcc4c33a619c23658ded7a8f38f91f651cf07324f540b4a1bfcadfdd52be

SHA512
60021f2fb7d86f59bb2878379580d8b485d872f76e4866f4ec8a00810ecb0b20f1ef4993a199a7806ae6a834f18c758cd94218ead36dca039fb89e534d2698c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\NfeiSKMyn5.bat

Filesize
220B

MD5
7d5de831d8ebe51eaa3a184bc401b0f2

SHA1
e81ce9a945d1c1465ba69354e7709b1cf72949cf

SHA256
b04daf29221023042d50a4fc431961fa48fa6480ded4603fcce303e513f79c9c

SHA512
2d7d8cf5d3460fec8e01ef76815eaacf894da3440091146368159f1bc3149311982bc71c92a48b93dbcfa773061b58aaf86340e79790389df12f282b795676f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_c3fjquv3.pre.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\aWJwCUxpp4.bat

Filesize
220B

MD5
198f1c75cb264adfaece2c1ce5bf5e57

SHA1
df8bc984a0ac926514c0d9356062dd1ac35d35ce

SHA256
071870cec618cec96764a5b45c2a33aa371960379dde6cf68042deaf4b924886

SHA512
c8735d7f9559a4df47768fd94162f0f86b48580ce4916aa785230035cc54565d0a315bf29aabdf87899de8355ac0a80b43c88d41f2aaad3a508cb28fd0fcd576

Download Submit
C:\Users\Admin\AppData\Local\Temp\bhowVEGEG8.bat

Filesize
220B

MD5
5ff46daa87766b424773a1c8ebbab12d

SHA1
9f96410f20fb6199c1c3c6b4b1c0f7007f4c20d6

SHA256
f044a57a7e9534f6904138f2059acb4c7225bcaed3c3417db33260d33ddc5074

SHA512
e5a400b306eac69557a5328b745bb115fe8c6fa3f974cadcd70582ad807240c9dad67687b2833bba49d9773fd6da079dd53fff746e4a12775e3ff5a261ad3013

Download Submit
C:\Users\Admin\AppData\Local\Temp\iMm147yiIR.bat

Filesize
220B

MD5
a7b2adbbd1c0710095e671352cc13d98

SHA1
8a79f15b8c4a47d51663ea81013b258c3ac35989

SHA256
b253555a5f60c568a98b97f703f22159fcc6b4f8baeee421aa602f84100bdd27

SHA512
c1dd764327659e5910806006d99c82c57e889e9d1bbfb11c1cac3edfdf4486255cb0df0a78ef23bc7594592787a6b4b5d38e0204682a96852733df4a50ae598c

Download Submit
C:\Users\Admin\AppData\Local\Temp\kQw8FYVnXF.bat

Filesize
220B

MD5
8bfb33cdbb0ceef04f1621e7cfd2b33e

SHA1
514b5cd8896a768122c5d8bf284621b109e557e4

SHA256
1f2f73dd4e6291813d6e8431f90ad28bbc49c42fae1a1f5c69ee42b4c6610543

SHA512
addd7624af421b8ece0ae2b9a44397aa599663c9304b47e89a6504cff9bd99e6e3eee4d1ac57627f69a943e8fff0fdeec65d02187c27f92296d40c2177d1ca5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\p9sA7N8NGm.bat

Filesize
220B

MD5
a5112cd52da26ae290a975612c514bec

SHA1
52f470cddd5a12734f3d789a73efefbc3da5f6ec

SHA256
ffbcbfb9ed6cabda3c028d0b58e09e1df310904fc889d3558716160012206599

SHA512
2e968fcf82cfd5744b228fe67038feb3bd122597929651462ccfcc2d061c4a5c1bbc85ab8ce2b4abc532f8dc0a51988b8de3c5bbb1ff6f73cfaef2cb4e1dc881

Download Submit
C:\Users\Admin\AppData\Local\Temp\qKN9Q7Smhq.bat

Filesize
220B

MD5
5c87edbed007c09a031d25e8bc6f2450

SHA1
f98b25648f58a1f7022ce160f257dbc931dc5e89

SHA256
0a46ead9adfa550dc965b6df6155ba22af7906565660e1c23e0d525b554d8146

SHA512
6b3ee3fdef709fe8fe39502634b7c0a8c09e225356f7db24a958938aede6987c5e8b53e102b016340b5eb1941ba2d0a0f96c5c77a1da00602097b8085d1caa61

Download Submit
C:\Users\Admin\AppData\Local\Temp\vCRFnHZZKP.bat

Filesize
220B

MD5
7facf3a8202192c6d96451eaf0004819

SHA1
41b88e18b08b05dd060d522efa328e0e34df328f

SHA256
b92707b246282e57da7ea249d3eaf96b271d2db25de834c85aad3159c648a2cb

SHA512
7e811b7a41a1f1d0ca28f0dfea7195919fc6dd0d0247da5337debf3019ce96baafdade86b50c61b416018c342a1e8f713f8fd85564e4324fb754aaf6b7a04620

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/472-132-0x0000000002950000-0x0000000002962000-memory.dmp

Filesize
72KB

Download
memory/1600-12-0x00007FFE0C5E3000-0x00007FFE0C5E5000-memory.dmp

Filesize
8KB

Download
memory/1600-16-0x0000000002540000-0x000000000254C000-memory.dmp

Filesize
48KB

Download
memory/1600-15-0x0000000002550000-0x000000000255C000-memory.dmp

Filesize
48KB

Download
memory/1600-17-0x0000000002560000-0x000000000256C000-memory.dmp

Filesize
48KB

Download
memory/1600-14-0x0000000000AE0000-0x0000000000AF2000-memory.dmp

Filesize
72KB

Download
memory/1600-13-0x0000000000320000-0x0000000000430000-memory.dmp

Filesize
1.1MB

Download
memory/2448-66-0x0000000000E50000-0x0000000000E62000-memory.dmp

Filesize
72KB

Download
memory/3432-118-0x00000000012D0000-0x00000000012E2000-memory.dmp

Filesize
72KB

Download
memory/4240-125-0x0000000002D70000-0x0000000002D82000-memory.dmp

Filesize
72KB

Download
memory/4716-36-0x0000028CE00B0000-0x0000028CE00D2000-memory.dmp

Filesize
136KB

Download
memory/4716-99-0x0000000002630000-0x0000000002642000-memory.dmp

Filesize
72KB

Download