dcrat | ff549f7f4b38998505efc15e3ba9ce1fb4fa0242e70a0c36f1a52b787603751b

Analysis

max time kernel
148s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22/12/2024, 11:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_ff549f7f4b38998505efc15e3ba9ce1fb4fa0242e70a0c36f1a52b787603751b.exe
Size

1.3MB
MD5

3afed2115908304ba8075c0c9cf34a0a
SHA1

f2ac352e787b3f5e5ba567baf5b51ca35469244f
SHA256

ff549f7f4b38998505efc15e3ba9ce1fb4fa0242e70a0c36f1a52b787603751b
SHA512

a1105003add5c1e3cdb4cbafefafb4b89c770e4761d8e4b8357899ed8a7a944e0ef1a7ca617432bca369a5705970489d3e93adc04831fcbd9f464cf81b5015f8
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 9 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1244	1376	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2740	1376	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2064	1376	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4780	1376	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2528	1376	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	952	1376	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3044	1376	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3944	1376	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	216	1376	schtasks.exe	86

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x000a000000023b6d-10.dat	dcrat
behavioral2/memory/3648-13-0x0000000000230000-0x0000000000340000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4268	powershell.exe
2104	powershell.exe
3520	powershell.exe
924	powershell.exe

Checks computer location settings 2 TTPs 16 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	JaffaCakes118_ff549f7f4b38998505efc15e3ba9ce1fb4fa0242e70a0c36f1a52b787603751b.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	dllhost.exe

Executes dropped EXE 15 IoCs

pid	Process
3648	DllCommonsvc.exe
3580	dllhost.exe
456	dllhost.exe
1484	dllhost.exe
2308	dllhost.exe
2956	dllhost.exe
4320	dllhost.exe
5056	dllhost.exe
4908	dllhost.exe
3944	dllhost.exe
3784	dllhost.exe
2628	dllhost.exe
4268	dllhost.exe
2952	dllhost.exe
5088	dllhost.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 14 IoCs

Web Service

T1102

flow	ioc
57	raw.githubusercontent.com
14	raw.githubusercontent.com
39	raw.githubusercontent.com
55	raw.githubusercontent.com
40	raw.githubusercontent.com
44	raw.githubusercontent.com
54	raw.githubusercontent.com
24	raw.githubusercontent.com
46	raw.githubusercontent.com
56	raw.githubusercontent.com
53	raw.githubusercontent.com
15	raw.githubusercontent.com
25	raw.githubusercontent.com
45	raw.githubusercontent.com

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files\Mozilla Firefox\winlogon.exe	DllCommonsvc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\winlogon.exe	DllCommonsvc.exe
File created	C:\Program Files\Mozilla Firefox\cc11b995f2a76d	DllCommonsvc.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\dllhost.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\5940a34987c991	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_ff549f7f4b38998505efc15e3ba9ce1fb4fa0242e70a0c36f1a52b787603751b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 14 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	JaffaCakes118_ff549f7f4b38998505efc15e3ba9ce1fb4fa0242e70a0c36f1a52b787603751b.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	dllhost.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 9 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2740	schtasks.exe
2528	schtasks.exe
952	schtasks.exe
3044	schtasks.exe
216	schtasks.exe
1244	schtasks.exe
2064	schtasks.exe
4780	schtasks.exe
3944	schtasks.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
3648	DllCommonsvc.exe
3520	powershell.exe
4268	powershell.exe
924	powershell.exe
2104	powershell.exe
2104	powershell.exe
3520	powershell.exe
3580	dllhost.exe
4268	powershell.exe
924	powershell.exe
456	dllhost.exe
1484	dllhost.exe
2308	dllhost.exe
2956	dllhost.exe
4320	dllhost.exe
5056	dllhost.exe
4908	dllhost.exe
3944	dllhost.exe
3784	dllhost.exe
2628	dllhost.exe
4268	dllhost.exe
2952	dllhost.exe
5088	dllhost.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	3648	DllCommonsvc.exe
Token: SeDebugPrivilege	3520	powershell.exe
Token: SeDebugPrivilege	2104	powershell.exe
Token: SeDebugPrivilege	4268	powershell.exe
Token: SeDebugPrivilege	924	powershell.exe
Token: SeDebugPrivilege	3580	dllhost.exe
Token: SeDebugPrivilege	456	dllhost.exe
Token: SeDebugPrivilege	1484	dllhost.exe
Token: SeDebugPrivilege	2308	dllhost.exe
Token: SeDebugPrivilege	2956	dllhost.exe
Token: SeDebugPrivilege	4320	dllhost.exe
Token: SeDebugPrivilege	5056	dllhost.exe
Token: SeDebugPrivilege	4908	dllhost.exe
Token: SeDebugPrivilege	3944	dllhost.exe
Token: SeDebugPrivilege	3784	dllhost.exe
Token: SeDebugPrivilege	2628	dllhost.exe
Token: SeDebugPrivilege	4268	dllhost.exe
Token: SeDebugPrivilege	2952	dllhost.exe
Token: SeDebugPrivilege	5088	dllhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3124 wrote to memory of 4128	3124	JaffaCakes118_ff549f7f4b38998505efc15e3ba9ce1fb4fa0242e70a0c36f1a52b787603751b.exe	82
PID 3124 wrote to memory of 4128	3124	JaffaCakes118_ff549f7f4b38998505efc15e3ba9ce1fb4fa0242e70a0c36f1a52b787603751b.exe	82
PID 3124 wrote to memory of 4128	3124	JaffaCakes118_ff549f7f4b38998505efc15e3ba9ce1fb4fa0242e70a0c36f1a52b787603751b.exe	82
PID 4128 wrote to memory of 3760	4128	WScript.exe	83
PID 4128 wrote to memory of 3760	4128	WScript.exe	83
PID 4128 wrote to memory of 3760	4128	WScript.exe	83
PID 3760 wrote to memory of 3648	3760	cmd.exe	85
PID 3760 wrote to memory of 3648	3760	cmd.exe	85
PID 3648 wrote to memory of 4268	3648	DllCommonsvc.exe	96
PID 3648 wrote to memory of 4268	3648	DllCommonsvc.exe	96
PID 3648 wrote to memory of 2104	3648	DllCommonsvc.exe	97
PID 3648 wrote to memory of 2104	3648	DllCommonsvc.exe	97
PID 3648 wrote to memory of 3520	3648	DllCommonsvc.exe	98
PID 3648 wrote to memory of 3520	3648	DllCommonsvc.exe	98
PID 3648 wrote to memory of 924	3648	DllCommonsvc.exe	99
PID 3648 wrote to memory of 924	3648	DllCommonsvc.exe	99
PID 3648 wrote to memory of 3580	3648	DllCommonsvc.exe	104
PID 3648 wrote to memory of 3580	3648	DllCommonsvc.exe	104
PID 3580 wrote to memory of 5044	3580	dllhost.exe	105
PID 3580 wrote to memory of 5044	3580	dllhost.exe	105
PID 5044 wrote to memory of 5040	5044	cmd.exe	107
PID 5044 wrote to memory of 5040	5044	cmd.exe	107
PID 5044 wrote to memory of 456	5044	cmd.exe	111
PID 5044 wrote to memory of 456	5044	cmd.exe	111
PID 456 wrote to memory of 560	456	dllhost.exe	115
PID 456 wrote to memory of 560	456	dllhost.exe	115
PID 560 wrote to memory of 1608	560	cmd.exe	117
PID 560 wrote to memory of 1608	560	cmd.exe	117
PID 560 wrote to memory of 1484	560	cmd.exe	118
PID 560 wrote to memory of 1484	560	cmd.exe	118
PID 1484 wrote to memory of 4064	1484	dllhost.exe	120
PID 1484 wrote to memory of 4064	1484	dllhost.exe	120
PID 4064 wrote to memory of 3524	4064	cmd.exe	122
PID 4064 wrote to memory of 3524	4064	cmd.exe	122
PID 4064 wrote to memory of 2308	4064	cmd.exe	124
PID 4064 wrote to memory of 2308	4064	cmd.exe	124
PID 2308 wrote to memory of 1436	2308	dllhost.exe	125
PID 2308 wrote to memory of 1436	2308	dllhost.exe	125
PID 1436 wrote to memory of 1684	1436	cmd.exe	127
PID 1436 wrote to memory of 1684	1436	cmd.exe	127
PID 1436 wrote to memory of 2956	1436	cmd.exe	128
PID 1436 wrote to memory of 2956	1436	cmd.exe	128
PID 2956 wrote to memory of 320	2956	dllhost.exe	129
PID 2956 wrote to memory of 320	2956	dllhost.exe	129
PID 320 wrote to memory of 1664	320	cmd.exe	131
PID 320 wrote to memory of 1664	320	cmd.exe	131
PID 320 wrote to memory of 4320	320	cmd.exe	132
PID 320 wrote to memory of 4320	320	cmd.exe	132
PID 4320 wrote to memory of 4620	4320	dllhost.exe	133
PID 4320 wrote to memory of 4620	4320	dllhost.exe	133
PID 4620 wrote to memory of 1600	4620	cmd.exe	135
PID 4620 wrote to memory of 1600	4620	cmd.exe	135
PID 4620 wrote to memory of 5056	4620	cmd.exe	136
PID 4620 wrote to memory of 5056	4620	cmd.exe	136
PID 5056 wrote to memory of 4408	5056	dllhost.exe	137
PID 5056 wrote to memory of 4408	5056	dllhost.exe	137
PID 4408 wrote to memory of 3492	4408	cmd.exe	139
PID 4408 wrote to memory of 3492	4408	cmd.exe	139
PID 4408 wrote to memory of 4908	4408	cmd.exe	140
PID 4408 wrote to memory of 4908	4408	cmd.exe	140
PID 4908 wrote to memory of 3240	4908	dllhost.exe	141
PID 4908 wrote to memory of 3240	4908	dllhost.exe	141
PID 3240 wrote to memory of 2272	3240	cmd.exe	143
PID 3240 wrote to memory of 2272	3240	cmd.exe	143

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ff549f7f4b38998505efc15e3ba9ce1fb4fa0242e70a0c36f1a52b787603751b.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ff549f7f4b38998505efc15e3ba9ce1fb4fa0242e70a0c36f1a52b787603751b.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3124
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4128
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3760
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3648
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4268
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Mozilla Firefox\winlogon.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2104
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\dllhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3520
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\WindowsHolographicDevices\SpatialStore\dllhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:924
    - - C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\dllhost.exe
        
        "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\dllhost.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3580
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\19YD2Vui68.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:5044
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:5040
        
        C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\dllhost.exe
        
        "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\dllhost.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:456
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\pdW26R6SPG.bat"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:560
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:1608
        
        C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\dllhost.exe
        
        "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\dllhost.exe"
        9⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1484
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\0IgHXqOu0A.bat"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:4064
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:3524
        
        C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\dllhost.exe
        
        "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\dllhost.exe"
        11⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2308
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\hYa1c8p3ob.bat"
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:1436
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:1684
        
        C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\dllhost.exe
        
        "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\dllhost.exe"
        13⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2956
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\XkJigN4PJf.bat"
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:320
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        15⤵
        
        PID:1664
        
        C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\dllhost.exe
        
        "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\dllhost.exe"
        15⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4320
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Oupdpj3XpI.bat"
        16⤵
        Suspicious use of WriteProcessMemory
        
        PID:4620
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        17⤵
        
        PID:1600
        
        C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\dllhost.exe
        
        "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\dllhost.exe"
        17⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5056
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\989MOUOnUX.bat"
        18⤵
        Suspicious use of WriteProcessMemory
        
        PID:4408
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        19⤵
        
        PID:3492
        
        C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\dllhost.exe
        
        "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\dllhost.exe"
        19⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4908
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Oupdpj3XpI.bat"
        20⤵
        Suspicious use of WriteProcessMemory
        
        PID:3240
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        21⤵
        
        PID:2272
        
        C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\dllhost.exe
        
        "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\dllhost.exe"
        21⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3944
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\hYa1c8p3ob.bat"
        22⤵
        
        PID:884
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        23⤵
        
        PID:3528
        
        C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\dllhost.exe
        
        "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\dllhost.exe"
        23⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3784
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\LnIbptgF5R.bat"
        24⤵
        
        PID:1280
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        25⤵
        
        PID:3488
        
        C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\dllhost.exe
        
        "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\dllhost.exe"
        25⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2628
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Oupdpj3XpI.bat"
        26⤵
        
        PID:1080
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        27⤵
        
        PID:4356
        
        C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\dllhost.exe
        
        "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\dllhost.exe"
        27⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4268
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\XkJigN4PJf.bat"
        28⤵
        
        PID:3836
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        29⤵
        
        PID:4320
        
        C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\dllhost.exe
        
        "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\dllhost.exe"
        29⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2952
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\mWzz7cjAeP.bat"
        30⤵
        
        PID:4988
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        31⤵
        
        PID:1876
        
        C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\dllhost.exe
        
        "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\dllhost.exe"
        31⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 10 /tr "'C:\Program Files\Mozilla Firefox\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2740

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 10 /tr "'C:\Program Files\Mozilla Firefox\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\WindowsHolographicDevices\SpatialStore\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\All Users\WindowsHolographicDevices\SpatialStore\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\WindowsHolographicDevices\SpatialStore\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\dllhost.exe.log

Filesize
1KB

MD5
baf55b95da4a601229647f25dad12878

SHA1
abc16954ebfd213733c4493fc1910164d825cac8

SHA256
ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

SHA512
24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
62623d22bd9e037191765d5083ce16a3

SHA1
4a07da6872672f715a4780513d95ed8ddeefd259

SHA256
95d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010

SHA512
9a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6d42b6da621e8df5674e26b799c8e2aa

SHA1
ab3ce1327ea1eeedb987ec823d5e0cb146bafa48

SHA256
5ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c

SHA512
53faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29

Download Submit
C:\Users\Admin\AppData\Local\Temp\0IgHXqOu0A.bat

Filesize
250B

MD5
5f827f8553e8f9f31cfc07ef9b1b2c08

SHA1
4448d252d4a14568ed997e5ad7b2868355556879

SHA256
5df73e066ca025122f2056074627a9359df9f690023a214551d5f63df651665c

SHA512
b9e55477ed6b74a785f456b685697e1e06b57876e3e945c509bac46ea288e0ff387e5518eadad6a33634dc97699049b598146196db3dfd607b2b92e407c121c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\19YD2Vui68.bat

Filesize
250B

MD5
3512d0efd9e87a0002b52e961b6675dd

SHA1
a5b374f74928f1b878e4db2725f312a1abcb216f

SHA256
f7ec7d2b37e471acf5f3074bb63c854f227ff37329a739e40f4c7a22f0960dd5

SHA512
530927acdab52562accec803fdc7f6a83a4c8958c553f7d5c3196e2a669a513bc37437ec2c3174345e66becb195c5c521ddf9aebfe9d56220a95a1e4325c164b

Download Submit
C:\Users\Admin\AppData\Local\Temp\989MOUOnUX.bat

Filesize
250B

MD5
98232ba95241ce557f07f28c121f73c3

SHA1
6c0098c99f1a77b22f5daccbf3b12bf81413a973

SHA256
55d12f3266cda2d6c729824cde7c9adcc090822c86db3e32accc760dfafc24b3

SHA512
cee627c1f1e6b08c39e850dcde2343a2fe29396cbf46321206d7c892a07bef10ba38e5407e8908ac08f4011c8bc8255e740d40ec30bf0500387da51395902392

Download Submit
C:\Users\Admin\AppData\Local\Temp\LnIbptgF5R.bat

Filesize
250B

MD5
9487f00fa26d8260eaeaa47f5d2ca828

SHA1
cc7e5a79674a536228b5a0cdecd93c3b73d2c7d8

SHA256
e2e9df61647bd44b8e1747a23065c5927296e4b2ecc1ad3217699cec58a6bb95

SHA512
c35c65d6e0302d3be7ee7ebf97fe12ed84bcae6421243e0e4076c75f3e8280767f2a2caa1193a994c608ddc5a0078f59df8bdde7c66f40cac212bc9d29aa35ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Oupdpj3XpI.bat

Filesize
250B

MD5
f62bce0a15d67dbf76df521cb05fb2a5

SHA1
4bfaa88bec0a9ace8e65ae35ba92d0d88a1df878

SHA256
5e6bc8b5604d4858cf37fe5c959207c8023235e5cb79107e3d09bcbd52112d85

SHA512
d050413efc8805ca097cfab561d9d1dfd054b729c21e726f1898decc69bc1930eb3e3e39415e197cfbda6af922d07497f714c2449f076936e36da011881a000a

Download Submit
C:\Users\Admin\AppData\Local\Temp\XkJigN4PJf.bat

Filesize
250B

MD5
3e6ac94004b613bbc63c75ef694678d6

SHA1
d1634d0b691dae80707cbbfb1c80857972aa2833

SHA256
dc6811410cdf0d19e40688d920601ae79a8b28b888d823821cba0d57df39add0

SHA512
342ba273c49e7d21fcd7dffca1553b27e2ae937dfaea8b09c322d9bfb888d3f1bb713c8110efa5215258e5241c76cf7e8d82bece651891cc81d11fc009ea598a

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_u2cq5t2h.ire.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\hYa1c8p3ob.bat

Filesize
250B

MD5
dba7034665c2185e8fb5e105e3716e24

SHA1
02f4f0a9efa3a94b286851b99ded3d23726686e2

SHA256
3be495df3966fcf59701851f62e51da5fdcb30f9ccfb838116748c6d8308388d

SHA512
e644f0f465d8145d94cd3136f62d8e44d93ffaac0df55f5865df43727f083ef7e5e8e9a76f66f887a55b0250835e07f0fe58d33596ba2608f5d8478d6570b3c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\mWzz7cjAeP.bat

Filesize
250B

MD5
f9eb03cae98d06f297cac08a9ae01628

SHA1
d56111c3536f6f5cc4b5c921a918e7adcc685f78

SHA256
8867d7bbf038db598bb6df93279cf7d95df002023e37012f4e1ecd7e37d0c8d0

SHA512
e9567f47d45883b79f5e04523a630d552b09da491102a61bd61b923014f9e326f7a0a8320ef18b4cc77fa10c884915dd0f3b4627637145eab0c9219e81cff638

Download Submit
C:\Users\Admin\AppData\Local\Temp\pdW26R6SPG.bat

Filesize
250B

MD5
d052f751daa1d0cfb4143e66221fcbc3

SHA1
d2a9ccfeca631dece40d565ad211a10fdb938cd5

SHA256
03a3f5ccb569de4a0920bf18eacca37fa17037dd8b68a2ad990ca16eb656b191

SHA512
943ef1964d51bb5b8a5f366e18c43272d1ad3f1ffcb635127e493aed745c372b8dc6b8b9517a8aac57cf56853a7e7ccb8caf71491efaa61e7cc0af06ace8509a

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/2628-144-0x0000000002C10000-0x0000000002C22000-memory.dmp

Filesize
72KB

Download
memory/3520-35-0x00000166EA190000-0x00000166EA1B2000-memory.dmp

Filesize
136KB

Download
memory/3580-86-0x000000001C3E0000-0x000000001C54A000-memory.dmp

Filesize
1.4MB

Download
memory/3648-14-0x0000000000D00000-0x0000000000D12000-memory.dmp

Filesize
72KB

Download
memory/3648-17-0x0000000002650000-0x000000000265C000-memory.dmp

Filesize
48KB

Download
memory/3648-16-0x0000000002640000-0x000000000264C000-memory.dmp

Filesize
48KB

Download
memory/3648-15-0x0000000000D10000-0x0000000000D1C000-memory.dmp

Filesize
48KB

Download
memory/3648-12-0x00007FFC7E803000-0x00007FFC7E805000-memory.dmp

Filesize
8KB

Download
memory/3648-13-0x0000000000230000-0x0000000000340000-memory.dmp

Filesize
1.1MB

Download