dcrat | 950692092fbe9533fbaa8efa361a2d3f69b0cbf5ba919cf124eec089e36587e0

Analysis

max time kernel
150s
max time network
145s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22/12/2024, 18:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_950692092fbe9533fbaa8efa361a2d3f69b0cbf5ba919cf124eec089e36587e0.exe
Size

1.3MB
MD5

7f397d0b3842f1b99f104d6f8e50df6a
SHA1

49d6b35fdc8c22fe36b6a1c5b7946bcc88d9f063
SHA256

950692092fbe9533fbaa8efa361a2d3f69b0cbf5ba919cf124eec089e36587e0
SHA512

01803593037ddae77fc084cda04af2993bac8e79b92a13c428de055ff4f62d57637f30fe54e11e2b97997f84ebf1a5849c8093270bd6c12f357a253c1159f03a
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 12 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2724	2624	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3024	2624	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1096	2624	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2588	2624	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2216	2624	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2148	2624	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2772	2624	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	236	2624	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2044	2624	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1628	2624	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2860	2624	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1704	2624	schtasks.exe	34

DCRat payload 12 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0008000000017079-9.dat	dcrat
behavioral1/memory/2052-13-0x0000000000960000-0x0000000000A70000-memory.dmp	dcrat
behavioral1/memory/2108-58-0x0000000000AA0000-0x0000000000BB0000-memory.dmp	dcrat
behavioral1/memory/2980-118-0x0000000000E70000-0x0000000000F80000-memory.dmp	dcrat
behavioral1/memory/1720-237-0x00000000002A0000-0x00000000003B0000-memory.dmp	dcrat
behavioral1/memory/1972-297-0x0000000000AC0000-0x0000000000BD0000-memory.dmp	dcrat
behavioral1/memory/2412-357-0x0000000000C80000-0x0000000000D90000-memory.dmp	dcrat
behavioral1/memory/1260-417-0x0000000000330000-0x0000000000440000-memory.dmp	dcrat
behavioral1/memory/1864-478-0x00000000008C0000-0x00000000009D0000-memory.dmp	dcrat
behavioral1/memory/816-538-0x0000000000DA0000-0x0000000000EB0000-memory.dmp	dcrat
behavioral1/memory/2384-598-0x0000000001240000-0x0000000001350000-memory.dmp	dcrat
behavioral1/memory/3068-658-0x00000000012C0000-0x00000000013D0000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
324	powershell.exe
1480	powershell.exe
496	powershell.exe
1424	powershell.exe
2076	powershell.exe

Executes dropped EXE 12 IoCs

pid	Process
2052	DllCommonsvc.exe
2108	taskhost.exe
2980	taskhost.exe
2184	taskhost.exe
1720	taskhost.exe
1972	taskhost.exe
2412	taskhost.exe
1260	taskhost.exe
1864	taskhost.exe
816	taskhost.exe
2384	taskhost.exe
3068	taskhost.exe

Loads dropped DLL 2 IoCs

pid	Process
2384	cmd.exe
2384	cmd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 11 IoCs

Web Service

T1102

flow	ioc
31	raw.githubusercontent.com
35	raw.githubusercontent.com
38	raw.githubusercontent.com
4	raw.githubusercontent.com
16	raw.githubusercontent.com
13	raw.githubusercontent.com
20	raw.githubusercontent.com
24	raw.githubusercontent.com
28	raw.githubusercontent.com
5	raw.githubusercontent.com
9	raw.githubusercontent.com

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\MSBuild\Microsoft\taskhost.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\b75386f1303e64	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows NT\OSPPSVC.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows NT\1610b97d3ab4a7	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_950692092fbe9533fbaa8efa361a2d3f69b0cbf5ba919cf124eec089e36587e0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 12 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2860	schtasks.exe
1704	schtasks.exe
2724	schtasks.exe
2216	schtasks.exe
2148	schtasks.exe
1628	schtasks.exe
236	schtasks.exe
2044	schtasks.exe
3024	schtasks.exe
1096	schtasks.exe
2588	schtasks.exe
2772	schtasks.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
2052	DllCommonsvc.exe
496	powershell.exe
2076	powershell.exe
1424	powershell.exe
1480	powershell.exe
324	powershell.exe
2108	taskhost.exe
2980	taskhost.exe
2184	taskhost.exe
1720	taskhost.exe
1972	taskhost.exe
2412	taskhost.exe
1260	taskhost.exe
1864	taskhost.exe
816	taskhost.exe
2384	taskhost.exe
3068	taskhost.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeDebugPrivilege	2052	DllCommonsvc.exe
Token: SeDebugPrivilege	496	powershell.exe
Token: SeDebugPrivilege	2076	powershell.exe
Token: SeDebugPrivilege	1424	powershell.exe
Token: SeDebugPrivilege	1480	powershell.exe
Token: SeDebugPrivilege	324	powershell.exe
Token: SeDebugPrivilege	2108	taskhost.exe
Token: SeDebugPrivilege	2980	taskhost.exe
Token: SeDebugPrivilege	2184	taskhost.exe
Token: SeDebugPrivilege	1720	taskhost.exe
Token: SeDebugPrivilege	1972	taskhost.exe
Token: SeDebugPrivilege	2412	taskhost.exe
Token: SeDebugPrivilege	1260	taskhost.exe
Token: SeDebugPrivilege	1864	taskhost.exe
Token: SeDebugPrivilege	816	taskhost.exe
Token: SeDebugPrivilege	2384	taskhost.exe
Token: SeDebugPrivilege	3068	taskhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 2820	2232	JaffaCakes118_950692092fbe9533fbaa8efa361a2d3f69b0cbf5ba919cf124eec089e36587e0.exe	30
PID 2232 wrote to memory of 2820	2232	JaffaCakes118_950692092fbe9533fbaa8efa361a2d3f69b0cbf5ba919cf124eec089e36587e0.exe	30
PID 2232 wrote to memory of 2820	2232	JaffaCakes118_950692092fbe9533fbaa8efa361a2d3f69b0cbf5ba919cf124eec089e36587e0.exe	30
PID 2232 wrote to memory of 2820	2232	JaffaCakes118_950692092fbe9533fbaa8efa361a2d3f69b0cbf5ba919cf124eec089e36587e0.exe	30
PID 2820 wrote to memory of 2384	2820	WScript.exe	31
PID 2820 wrote to memory of 2384	2820	WScript.exe	31
PID 2820 wrote to memory of 2384	2820	WScript.exe	31
PID 2820 wrote to memory of 2384	2820	WScript.exe	31
PID 2384 wrote to memory of 2052	2384	cmd.exe	33
PID 2384 wrote to memory of 2052	2384	cmd.exe	33
PID 2384 wrote to memory of 2052	2384	cmd.exe	33
PID 2384 wrote to memory of 2052	2384	cmd.exe	33
PID 2052 wrote to memory of 1424	2052	DllCommonsvc.exe	47
PID 2052 wrote to memory of 1424	2052	DllCommonsvc.exe	47
PID 2052 wrote to memory of 1424	2052	DllCommonsvc.exe	47
PID 2052 wrote to memory of 2076	2052	DllCommonsvc.exe	48
PID 2052 wrote to memory of 2076	2052	DllCommonsvc.exe	48
PID 2052 wrote to memory of 2076	2052	DllCommonsvc.exe	48
PID 2052 wrote to memory of 496	2052	DllCommonsvc.exe	49
PID 2052 wrote to memory of 496	2052	DllCommonsvc.exe	49
PID 2052 wrote to memory of 496	2052	DllCommonsvc.exe	49
PID 2052 wrote to memory of 324	2052	DllCommonsvc.exe	50
PID 2052 wrote to memory of 324	2052	DllCommonsvc.exe	50
PID 2052 wrote to memory of 324	2052	DllCommonsvc.exe	50
PID 2052 wrote to memory of 1480	2052	DllCommonsvc.exe	51
PID 2052 wrote to memory of 1480	2052	DllCommonsvc.exe	51
PID 2052 wrote to memory of 1480	2052	DllCommonsvc.exe	51
PID 2052 wrote to memory of 2108	2052	DllCommonsvc.exe	57
PID 2052 wrote to memory of 2108	2052	DllCommonsvc.exe	57
PID 2052 wrote to memory of 2108	2052	DllCommonsvc.exe	57
PID 2108 wrote to memory of 2324	2108	taskhost.exe	58
PID 2108 wrote to memory of 2324	2108	taskhost.exe	58
PID 2108 wrote to memory of 2324	2108	taskhost.exe	58
PID 2324 wrote to memory of 1948	2324	cmd.exe	60
PID 2324 wrote to memory of 1948	2324	cmd.exe	60
PID 2324 wrote to memory of 1948	2324	cmd.exe	60
PID 2324 wrote to memory of 2980	2324	cmd.exe	61
PID 2324 wrote to memory of 2980	2324	cmd.exe	61
PID 2324 wrote to memory of 2980	2324	cmd.exe	61
PID 2980 wrote to memory of 2724	2980	taskhost.exe	62
PID 2980 wrote to memory of 2724	2980	taskhost.exe	62
PID 2980 wrote to memory of 2724	2980	taskhost.exe	62
PID 2724 wrote to memory of 2360	2724	cmd.exe	64
PID 2724 wrote to memory of 2360	2724	cmd.exe	64
PID 2724 wrote to memory of 2360	2724	cmd.exe	64
PID 2724 wrote to memory of 2184	2724	cmd.exe	65
PID 2724 wrote to memory of 2184	2724	cmd.exe	65
PID 2724 wrote to memory of 2184	2724	cmd.exe	65
PID 2184 wrote to memory of 1868	2184	taskhost.exe	66
PID 2184 wrote to memory of 1868	2184	taskhost.exe	66
PID 2184 wrote to memory of 1868	2184	taskhost.exe	66
PID 1868 wrote to memory of 1424	1868	cmd.exe	68
PID 1868 wrote to memory of 1424	1868	cmd.exe	68
PID 1868 wrote to memory of 1424	1868	cmd.exe	68
PID 1868 wrote to memory of 1720	1868	cmd.exe	69
PID 1868 wrote to memory of 1720	1868	cmd.exe	69
PID 1868 wrote to memory of 1720	1868	cmd.exe	69
PID 1720 wrote to memory of 1048	1720	taskhost.exe	70
PID 1720 wrote to memory of 1048	1720	taskhost.exe	70
PID 1720 wrote to memory of 1048	1720	taskhost.exe	70
PID 1048 wrote to memory of 2072	1048	cmd.exe	72
PID 1048 wrote to memory of 2072	1048	cmd.exe	72
PID 1048 wrote to memory of 2072	1048	cmd.exe	72
PID 1048 wrote to memory of 1972	1048	cmd.exe	73

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_950692092fbe9533fbaa8efa361a2d3f69b0cbf5ba919cf124eec089e36587e0.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_950692092fbe9533fbaa8efa361a2d3f69b0cbf5ba919cf124eec089e36587e0.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2820
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2384
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2052
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1424
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Links\lsass.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2076
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\MSBuild\Microsoft\taskhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:496
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\WmiPrvSE.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:324
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows NT\OSPPSVC.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1480
    - - C:\Program Files (x86)\MSBuild\Microsoft\taskhost.exe
        
        "C:\Program Files (x86)\MSBuild\Microsoft\taskhost.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2108
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\OoUlhQHDc2.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2324
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:1948
        
        C:\Program Files (x86)\MSBuild\Microsoft\taskhost.exe
        
        "C:\Program Files (x86)\MSBuild\Microsoft\taskhost.exe"
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2980
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\xgactKMGCU.bat"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:2724
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:2360
        
        C:\Program Files (x86)\MSBuild\Microsoft\taskhost.exe
        
        "C:\Program Files (x86)\MSBuild\Microsoft\taskhost.exe"
        9⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2184
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ZgKlNS7JdR.bat"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:1868
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:1424
        
        C:\Program Files (x86)\MSBuild\Microsoft\taskhost.exe
        
        "C:\Program Files (x86)\MSBuild\Microsoft\taskhost.exe"
        11⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1720
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\sJ59Arupck.bat"
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:1048
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:2072
        
        C:\Program Files (x86)\MSBuild\Microsoft\taskhost.exe
        
        "C:\Program Files (x86)\MSBuild\Microsoft\taskhost.exe"
        13⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1972
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\7hZg3igX7v.bat"
        14⤵
        
        PID:2356
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        15⤵
        
        PID:1820
        
        C:\Program Files (x86)\MSBuild\Microsoft\taskhost.exe
        
        "C:\Program Files (x86)\MSBuild\Microsoft\taskhost.exe"
        15⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2412
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\AXFqcUy7ES.bat"
        16⤵
        
        PID:592
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        17⤵
        
        PID:1092
        
        C:\Program Files (x86)\MSBuild\Microsoft\taskhost.exe
        
        "C:\Program Files (x86)\MSBuild\Microsoft\taskhost.exe"
        17⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1260
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Iu2jWrKESR.bat"
        18⤵
        
        PID:2224
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        19⤵
        
        PID:2252
        
        C:\Program Files (x86)\MSBuild\Microsoft\taskhost.exe
        
        "C:\Program Files (x86)\MSBuild\Microsoft\taskhost.exe"
        19⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1864
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\2sHl3bGdB9.bat"
        20⤵
        
        PID:1204
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        21⤵
        
        PID:3012
        
        C:\Program Files (x86)\MSBuild\Microsoft\taskhost.exe
        
        "C:\Program Files (x86)\MSBuild\Microsoft\taskhost.exe"
        21⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:816
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\syYKg8QxNI.bat"
        22⤵
        
        PID:624
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        23⤵
        
        PID:2844
        
        C:\Program Files (x86)\MSBuild\Microsoft\taskhost.exe
        
        "C:\Program Files (x86)\MSBuild\Microsoft\taskhost.exe"
        23⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2384
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\YzNOjOTGFC.bat"
        24⤵
        
        PID:1740
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        25⤵
        
        PID:2064
        
        C:\Program Files (x86)\MSBuild\Microsoft\taskhost.exe
        
        "C:\Program Files (x86)\MSBuild\Microsoft\taskhost.exe"
        25⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\Links\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Users\Admin\Links\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\Links\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1096

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\Microsoft\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2148

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows NT\OSPPSVC.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows NT\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
61225b39b3599e5138f1648ecfd3a838

SHA1
4117c0da213a21f31fb608b203eb3d090e9ac53b

SHA256
a4d5c4c6cdfc219c0957156dcda0c303ba7996424fce5e24b22fbe14b3adac35

SHA512
ec999765430dd896c93a52aae4123c736d9f24911c9e8a938c76007c0975c53fa738505e3506b6a78663f0bfeb374de387c059a94848ddd4814bbb94c80b394e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
83f40bc08b931278ed0e2385df108ae2

SHA1
7ffe3ebef6c3c95a95999c956c662bdbeb3585c1

SHA256
353fb3bfb7980c011646370d44ca9e43985835a6e17db36a7d47bd26e2062c7c

SHA512
1f0bcec12117718a81bc790421b1381bbd64ecfb1affa982a43e82e623ea6d1dd8b2bf861342ae7f20a57420f7400c5d4506037b2185ecf263d175296c2f50e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
01ed29ce511ccd4f343692835d8e2bc9

SHA1
c655cf1b9d862cf4dffd5dc4b94e5c02889034eb

SHA256
d3e13b454f8ee96f5ae8a35b53f385572137c9977eba4d4343e37d294dcb823b

SHA512
bb5c58be612dc6f0ee32881ebf8a04a72595581a83f1502d51be72720ccf931ab27c3b3987d110db503b9d946b5b6e893c760d33c23d1f7cfa994b6c9e0195b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4bb82a6ac4ca509386ab8db2979daf37

SHA1
fea28834eede57bf97cd50cabbd3bfe44ccc4fd9

SHA256
5772a6c0249bf1c31cca98873f615413ad76f4a6f89c531ce0d055fa408d1771

SHA512
5c465900ce5146c71d853d931e89505eb41bd8ef54d820d6090b2b5fd873acb9e696e2a95e10a2a3dbbb66a3f3943bb1dd6fa4a2154ae7f177d9de5d5443de0b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
de91e51c81f9b66deeb81b47c58dd273

SHA1
de7bbb65f1d0c10c1c535ad977de00589b14a922

SHA256
bc4eb4da43fd84c205a033de77a8d029596d92ca624fed96251a0d78bbe1b63d

SHA512
a98ec23cec1b7d515a5a2a545d15290a4c8899f3c4145a0db624ea8c981081476be2d47cb29361a6093478d6dc22e2069d7b124dc70a38c800a798ea889e1713

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b08292cdbbab3f17d4d355040f221d79

SHA1
1e95a1a8da9e3c3f05bbc19329241e310924661a

SHA256
83d7f0cc14140f9c6eb7097bba342896583dedc84d308522841b7845e8be969f

SHA512
ef48df901d0c220ad1b285e20d1a83fcded525f3d1bdf1a572fc47cf00b0af1231f148aa18ee7c983680e6c66981d6fee1adf02d3f9bd0a025f52acc37cef16a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
53b7d807be5b3e75d551f9c8046c7aee

SHA1
28dd0c4f04f1ba9996c42cbf94b959028f2f1afc

SHA256
5a0350a9c9b058104a61000f5efe0c2f128ebaf56a5dc43f382941bebeaffaf8

SHA512
d1baa731600eba46ec9f1319d4cfc1a20aed7cf57e8b6f854809eee4985986a175977e5485f7e410e6d19711d251a5c8f3c4ecc345b6a99bda372d8d6cf514f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
04aa162918019a84580df00093e1328a

SHA1
92ac56400cb890b72de09ae8894d4d2231a9b340

SHA256
46bc151cf979ce22afabb4740e5dcc01e95083ebc45fc4479a63c53093854b2f

SHA512
08aebcede20c3780fdcb03458f8f445837bbe6f911a26f668a3c7dbf924bea298e5151bb3d8b7fc88ff3173a01d188e307b43416adf796280d6a88fb8634b0e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c46ecedd50753025e28b1b9196bd93b9

SHA1
83141056500309ee69d78ec3644ba9c5942439ba

SHA256
fb942f7ac5d151b911c104b5a311c026fdf8fbb9a87312d32350b6ce38f47587

SHA512
4274befbe4485a5aef624f4f00ff539893d989ce179cf8109b373ea2a89843da489cf68e332fe9d7f8f8e70c070963b9638cfba0a5bd5aaf428c0c392eb7f4e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\2sHl3bGdB9.bat

Filesize
218B

MD5
b77a67b368301e517456cff4b5004a05

SHA1
b35a6119b528d21c476dfd8be701d97bfe91dadc

SHA256
de95f73e21af7cdd5792cfb42912033a3a8ca6d7f7df4d9a3a25e432ba750cac

SHA512
775f4b28ce2e80a78b385eed31975d52b0cbd7e874dd4c89ea9b081611750922ee3b36f5fc3f54009a4b8cc8bf81461db3e8eb68aea4ffe8454d6c8888ac8263

Download Submit
C:\Users\Admin\AppData\Local\Temp\7hZg3igX7v.bat

Filesize
218B

MD5
22353145ab12f193cbc92396cea8641e

SHA1
ad2ad021e1563557a1a5590aaac6f4b5d9282b06

SHA256
de474a871ced478bdb82217c8c4bef69ea803d0bc30ddc6e9379100cca013657

SHA512
145aa1928e47218893b4ed78deb9a7bc8877266295f806da21fb5d8f0f5c180d48f1242ed6bbe5230a0c8788ccd635948ff9c29e2143cac7887bba87deafc27b

Download Submit
C:\Users\Admin\AppData\Local\Temp\AXFqcUy7ES.bat

Filesize
218B

MD5
4b7aacee6ea558c4f0ab877331846a10

SHA1
a453b81deac13efed6e59f82519b033cc424dea2

SHA256
edef93cb22db01d473cb4a26511b6ddea89eaafdb6b90962ef7ff2209ad71fb1

SHA512
c00eab3e9066458cf6ccc05cd65a9377da1d45514fe983a698ad65a8987b130712065e3efefed487a39a0408b67391a82ecc0e11c05d28279f44ff8d6e4d9c30

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3333.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Iu2jWrKESR.bat

Filesize
218B

MD5
679aea951147f59e14edc5d433296d67

SHA1
00a5d220aa1b17777e0f033935033de2580f901e

SHA256
fb713432364b7f0b2f53fec6f4013e03dc5538899768514e0cc1a8d9eb94e523

SHA512
e7136c6425c4faa8e21cff453aed4083247838e38fc595f8784459124bd191ece626ea5ae6be601e9e60d8f63968f05b404d021f7776627f1d7293018b9e33e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\OoUlhQHDc2.bat

Filesize
218B

MD5
94444403577a40a456c8c239326dcaa3

SHA1
90e217479ef560b879da0dbcec0a54d655fc411f

SHA256
7df3c7359e70eaab60a0cc8925b20a7c8ea98b11fd401c2f4f8803b8e584703e

SHA512
96e5ac89c4e8f1dc00f30105b3c34a3a5da7693436f17b5ffd03ba6dce43e30855ad0127f3f23927c3d1b2d05ffc995798f9cd7a1707795a6f04532128d4d872

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3355.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\YzNOjOTGFC.bat

Filesize
218B

MD5
32856273a045b6868a59be0014e7312d

SHA1
49ddf166a875e1fb0c9a9d4e82c25c79e7d0e075

SHA256
448098f03cbb57d2520b418b958402ab7fec1cf6b7e316156813b2ac43e778bb

SHA512
496ac20be0b46adc39094a65e46e52428d78d1e0c3e444a7b9c523423254b6c79855a65ef12f408904c6b6fbe3bcdffd9fe253245a88d96580c3f995e2954c87

Download Submit
C:\Users\Admin\AppData\Local\Temp\ZgKlNS7JdR.bat

Filesize
218B

MD5
27ea70e4fd44a1994db00697fe4af532

SHA1
4740c788be3a0f5b3128bd62f6ab63a527b01fb2

SHA256
6f52da50147cb39d5006e4582e220198973d4e4578efbd1e2ca5ae20aa2ec5be

SHA512
f6c27123f239fd03e196ead83a713ecaae93c3d856cef0500ba739bb92bf466d90401a5906f6aa1143e9854df853cc3982a9d9b6cabcc2b39d42a53edbfc4391

Download Submit
C:\Users\Admin\AppData\Local\Temp\sJ59Arupck.bat

Filesize
218B

MD5
38f7d96d67db10fc07752df98629187b

SHA1
71aedd0656f83c7e903c2815ee16e4d6fe349848

SHA256
21338c51e5afb3d65c355300746b9a234434c2d46b85ead26ed9309d8e8c2b8d

SHA512
b86536cbf9f370dfaee8e52fec4fb741f2a86a39f728ff062a95966227e038c8bd09973f83dd61d91e2d2c9a118c4f37003503a8805d21f257556cefd0513d10

Download Submit
C:\Users\Admin\AppData\Local\Temp\syYKg8QxNI.bat

Filesize
218B

MD5
30eaddd21ea81e24b485df2e13ad3712

SHA1
75662d0debb387e41c080e7fbd14178595d3f8a2

SHA256
1ed1d55812f12514d6c05424f268286c944aff400ee29612abbba8198581ecca

SHA512
cee7269bc597f8fe371658a799d107600ebae834b738b10ef99bdda0a32e381cf01c037563a41c14f910dc388394500414b507c89684afdfef5f5467ea14388e

Download Submit
C:\Users\Admin\AppData\Local\Temp\xgactKMGCU.bat

Filesize
218B

MD5
fdb0fec7a4676dbb0fb3260124e70f9d

SHA1
c53c264b80786faae3cdbc0e5eb63b956c07655d

SHA256
24649bbbd129b79e1627418cbb200fc1a27700b01c741e5845bd1eb7e93b2bff

SHA512
d4ec7dce6803545f19542c8e6d7486716bc8b1057572321ce59798d7d0df31bf693cad668396ed13ec6c8aba565a0f7d4f52cb2ee29f2f71a41eae7b04b14f2c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
b786b3a3614e54ea2ca84a12c959778f

SHA1
8ce12e45944c2ae8aad418c8f5dcb61cf4f565fe

SHA256
ffdc2d61c9e06e70e093a11d2b56c762df0d930e449fd889c123ea2ee4a1a35c

SHA512
dfe6999482d0bbe615b2d81c3de49c696a2e9eef766de556e578316829ce318565ac90af7d3cccd8b454e5e972a93c3d0a7bd64d41b363b0d518fabec22b940d

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
memory/496-47-0x0000000001EF0000-0x0000000001EF8000-memory.dmp

Filesize
32KB

Download
memory/816-538-0x0000000000DA0000-0x0000000000EB0000-memory.dmp

Filesize
1.1MB

Download
memory/1260-417-0x0000000000330000-0x0000000000440000-memory.dmp

Filesize
1.1MB

Download
memory/1260-418-0x0000000000240000-0x0000000000252000-memory.dmp

Filesize
72KB

Download
memory/1720-237-0x00000000002A0000-0x00000000003B0000-memory.dmp

Filesize
1.1MB

Download
memory/1864-478-0x00000000008C0000-0x00000000009D0000-memory.dmp

Filesize
1.1MB

Download
memory/1972-297-0x0000000000AC0000-0x0000000000BD0000-memory.dmp

Filesize
1.1MB

Download
memory/2052-17-0x00000000002F0000-0x00000000002FC000-memory.dmp

Filesize
48KB

Download
memory/2052-15-0x0000000000250000-0x000000000025C000-memory.dmp

Filesize
48KB

Download
memory/2052-16-0x00000000002E0000-0x00000000002EC000-memory.dmp

Filesize
48KB

Download
memory/2052-14-0x0000000000140000-0x0000000000152000-memory.dmp

Filesize
72KB

Download
memory/2052-13-0x0000000000960000-0x0000000000A70000-memory.dmp

Filesize
1.1MB

Download
memory/2076-41-0x000000001B720000-0x000000001BA02000-memory.dmp

Filesize
2.9MB

Download
memory/2108-58-0x0000000000AA0000-0x0000000000BB0000-memory.dmp

Filesize
1.1MB

Download
memory/2108-59-0x0000000000140000-0x0000000000152000-memory.dmp

Filesize
72KB

Download
memory/2384-598-0x0000000001240000-0x0000000001350000-memory.dmp

Filesize
1.1MB

Download
memory/2412-357-0x0000000000C80000-0x0000000000D90000-memory.dmp

Filesize
1.1MB

Download
memory/2980-118-0x0000000000E70000-0x0000000000F80000-memory.dmp

Filesize
1.1MB

Download
memory/3068-658-0x00000000012C0000-0x00000000013D0000-memory.dmp

Filesize
1.1MB

Download