dcrat | 2ce0d2fd91c92c1e4631131c089f664c97739fcf1072d1f3aa8f1e59b5f21e5c

Analysis

max time kernel
148s
max time network
150s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
22-12-2024 20:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_2ce0d2fd91c92c1e4631131c089f664c97739fcf1072d1f3aa8f1e59b5f21e5c.exe
Size

1.3MB
MD5

bf996e31e0ad13b08bd4d9af3149f1dc
SHA1

cdee9a3da3a98acce2da8e505504bf50e52f0164
SHA256

2ce0d2fd91c92c1e4631131c089f664c97739fcf1072d1f3aa8f1e59b5f21e5c
SHA512

0bb5a44e0b5db4fff08ef1a7c79ccba2c00baed11269fd2a3e5f7e7d27dd88b0fd070b7324fac2c20bafc2fca661cf9389640b3f17d452afe168180964d84812
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 39 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2648	2564	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2132	2564	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1896	2564	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2552	2564	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2952	2564	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2256	2564	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2312	2564	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2000	2564	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2896	2564	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2760	2564	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2872	2564	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1832	2564	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2888	2564	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	540	2564	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2900	2564	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	484	2564	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1944	2564	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1252	2564	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1260	2564	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1996	2564	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1392	2564	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3032	2564	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2384	2564	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1040	2564	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2192	2564	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	300	2564	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2232	2564	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	828	2564	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	956	2564	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1552	2564	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1436	2564	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1656	2564	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	896	2564	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	692	2564	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2980	2564	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2488	2564	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2004	2564	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2520	2564	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2060	2564	schtasks.exe	35

DCRat payload 8 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0007000000018636-9.dat	dcrat
behavioral1/memory/2852-13-0x0000000001390000-0x00000000014A0000-memory.dmp	dcrat
behavioral1/memory/1256-122-0x00000000012B0000-0x00000000013C0000-memory.dmp	dcrat
behavioral1/memory/1944-358-0x0000000000390000-0x00000000004A0000-memory.dmp	dcrat
behavioral1/memory/2520-418-0x0000000000DD0000-0x0000000000EE0000-memory.dmp	dcrat
behavioral1/memory/860-538-0x00000000001B0000-0x00000000002C0000-memory.dmp	dcrat
behavioral1/memory/2060-598-0x00000000008F0000-0x0000000000A00000-memory.dmp	dcrat
behavioral1/memory/2648-658-0x0000000001230000-0x0000000001340000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 14 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3052	powershell.exe
624	powershell.exe
584	powershell.exe
976	powershell.exe
1416	powershell.exe
984	powershell.exe
2472	powershell.exe
1576	powershell.exe
1640	powershell.exe
1836	powershell.exe
1044	powershell.exe
1000	powershell.exe
352	powershell.exe
1008	powershell.exe

Executes dropped EXE 11 IoCs

pid	Process
2852	DllCommonsvc.exe
1256	csrss.exe
2664	csrss.exe
2684	csrss.exe
2892	csrss.exe
1944	csrss.exe
2520	csrss.exe
1940	csrss.exe
860	csrss.exe
2060	csrss.exe
2648	csrss.exe

Loads dropped DLL 2 IoCs

pid	Process
2704	cmd.exe
2704	cmd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 10 IoCs

Web Service

T1102

flow	ioc
4	raw.githubusercontent.com
5	raw.githubusercontent.com
9	raw.githubusercontent.com
23	raw.githubusercontent.com
31	raw.githubusercontent.com
35	raw.githubusercontent.com
12	raw.githubusercontent.com
16	raw.githubusercontent.com
20	raw.githubusercontent.com
27	raw.githubusercontent.com

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\sppsvc.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\0a1fd5f707cd16	DllCommonsvc.exe
File created	C:\Program Files (x86)\Uninstall Information\lsm.exe	DllCommonsvc.exe
File opened for modification	C:\Program Files (x86)\Uninstall Information\lsm.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Uninstall Information\101b941d020240	DllCommonsvc.exe
File created	C:\Program Files\Windows Portable Devices\explorer.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Portable Devices\7a0fd90576e088	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_2ce0d2fd91c92c1e4631131c089f664c97739fcf1072d1f3aa8f1e59b5f21e5c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 39 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
956	schtasks.exe
1436	schtasks.exe
896	schtasks.exe
2520	schtasks.exe
2060	schtasks.exe
2312	schtasks.exe
2000	schtasks.exe
3032	schtasks.exe
2760	schtasks.exe
540	schtasks.exe
2232	schtasks.exe
1392	schtasks.exe
2952	schtasks.exe
484	schtasks.exe
2888	schtasks.exe
1944	schtasks.exe
1260	schtasks.exe
1656	schtasks.exe
2004	schtasks.exe
2552	schtasks.exe
2872	schtasks.exe
1996	schtasks.exe
300	schtasks.exe
828	schtasks.exe
692	schtasks.exe
2980	schtasks.exe
2648	schtasks.exe
1832	schtasks.exe
2896	schtasks.exe
1896	schtasks.exe
2256	schtasks.exe
1252	schtasks.exe
2384	schtasks.exe
1040	schtasks.exe
2192	schtasks.exe
1552	schtasks.exe
2488	schtasks.exe
2132	schtasks.exe
2900	schtasks.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
2852	DllCommonsvc.exe
2852	DllCommonsvc.exe
2852	DllCommonsvc.exe
2852	DllCommonsvc.exe
2852	DllCommonsvc.exe
2852	DllCommonsvc.exe
2852	DllCommonsvc.exe
2852	DllCommonsvc.exe
2852	DllCommonsvc.exe
2852	DllCommonsvc.exe
2852	DllCommonsvc.exe
584	powershell.exe
1576	powershell.exe
1008	powershell.exe
1836	powershell.exe
984	powershell.exe
1000	powershell.exe
352	powershell.exe
624	powershell.exe
1044	powershell.exe
3052	powershell.exe
2472	powershell.exe
1640	powershell.exe
1416	powershell.exe
976	powershell.exe
1256	csrss.exe
2664	csrss.exe
2684	csrss.exe
2892	csrss.exe
1944	csrss.exe
2520	csrss.exe
1940	csrss.exe
860	csrss.exe
2060	csrss.exe
2648	csrss.exe

Suspicious use of AdjustPrivilegeToken 25 IoCs

description	pid	Process
Token: SeDebugPrivilege	2852	DllCommonsvc.exe
Token: SeDebugPrivilege	584	powershell.exe
Token: SeDebugPrivilege	1576	powershell.exe
Token: SeDebugPrivilege	1008	powershell.exe
Token: SeDebugPrivilege	1836	powershell.exe
Token: SeDebugPrivilege	984	powershell.exe
Token: SeDebugPrivilege	1000	powershell.exe
Token: SeDebugPrivilege	352	powershell.exe
Token: SeDebugPrivilege	624	powershell.exe
Token: SeDebugPrivilege	1044	powershell.exe
Token: SeDebugPrivilege	3052	powershell.exe
Token: SeDebugPrivilege	2472	powershell.exe
Token: SeDebugPrivilege	1640	powershell.exe
Token: SeDebugPrivilege	1416	powershell.exe
Token: SeDebugPrivilege	976	powershell.exe
Token: SeDebugPrivilege	1256	csrss.exe
Token: SeDebugPrivilege	2664	csrss.exe
Token: SeDebugPrivilege	2684	csrss.exe
Token: SeDebugPrivilege	2892	csrss.exe
Token: SeDebugPrivilege	1944	csrss.exe
Token: SeDebugPrivilege	2520	csrss.exe
Token: SeDebugPrivilege	1940	csrss.exe
Token: SeDebugPrivilege	860	csrss.exe
Token: SeDebugPrivilege	2060	csrss.exe
Token: SeDebugPrivilege	2648	csrss.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2756 wrote to memory of 1744	2756	JaffaCakes118_2ce0d2fd91c92c1e4631131c089f664c97739fcf1072d1f3aa8f1e59b5f21e5c.exe	31
PID 2756 wrote to memory of 1744	2756	JaffaCakes118_2ce0d2fd91c92c1e4631131c089f664c97739fcf1072d1f3aa8f1e59b5f21e5c.exe	31
PID 2756 wrote to memory of 1744	2756	JaffaCakes118_2ce0d2fd91c92c1e4631131c089f664c97739fcf1072d1f3aa8f1e59b5f21e5c.exe	31
PID 2756 wrote to memory of 1744	2756	JaffaCakes118_2ce0d2fd91c92c1e4631131c089f664c97739fcf1072d1f3aa8f1e59b5f21e5c.exe	31
PID 1744 wrote to memory of 2704	1744	WScript.exe	32
PID 1744 wrote to memory of 2704	1744	WScript.exe	32
PID 1744 wrote to memory of 2704	1744	WScript.exe	32
PID 1744 wrote to memory of 2704	1744	WScript.exe	32
PID 2704 wrote to memory of 2852	2704	cmd.exe	34
PID 2704 wrote to memory of 2852	2704	cmd.exe	34
PID 2704 wrote to memory of 2852	2704	cmd.exe	34
PID 2704 wrote to memory of 2852	2704	cmd.exe	34
PID 2852 wrote to memory of 584	2852	DllCommonsvc.exe	75
PID 2852 wrote to memory of 584	2852	DllCommonsvc.exe	75
PID 2852 wrote to memory of 584	2852	DllCommonsvc.exe	75
PID 2852 wrote to memory of 1044	2852	DllCommonsvc.exe	76
PID 2852 wrote to memory of 1044	2852	DllCommonsvc.exe	76
PID 2852 wrote to memory of 1044	2852	DllCommonsvc.exe	76
PID 2852 wrote to memory of 1000	2852	DllCommonsvc.exe	77
PID 2852 wrote to memory of 1000	2852	DllCommonsvc.exe	77
PID 2852 wrote to memory of 1000	2852	DllCommonsvc.exe	77
PID 2852 wrote to memory of 984	2852	DllCommonsvc.exe	78
PID 2852 wrote to memory of 984	2852	DllCommonsvc.exe	78
PID 2852 wrote to memory of 984	2852	DllCommonsvc.exe	78
PID 2852 wrote to memory of 3052	2852	DllCommonsvc.exe	79
PID 2852 wrote to memory of 3052	2852	DllCommonsvc.exe	79
PID 2852 wrote to memory of 3052	2852	DllCommonsvc.exe	79
PID 2852 wrote to memory of 2472	2852	DllCommonsvc.exe	80
PID 2852 wrote to memory of 2472	2852	DllCommonsvc.exe	80
PID 2852 wrote to memory of 2472	2852	DllCommonsvc.exe	80
PID 2852 wrote to memory of 352	2852	DllCommonsvc.exe	81
PID 2852 wrote to memory of 352	2852	DllCommonsvc.exe	81
PID 2852 wrote to memory of 352	2852	DllCommonsvc.exe	81
PID 2852 wrote to memory of 1008	2852	DllCommonsvc.exe	82
PID 2852 wrote to memory of 1008	2852	DllCommonsvc.exe	82
PID 2852 wrote to memory of 1008	2852	DllCommonsvc.exe	82
PID 2852 wrote to memory of 976	2852	DllCommonsvc.exe	83
PID 2852 wrote to memory of 976	2852	DllCommonsvc.exe	83
PID 2852 wrote to memory of 976	2852	DllCommonsvc.exe	83
PID 2852 wrote to memory of 1576	2852	DllCommonsvc.exe	84
PID 2852 wrote to memory of 1576	2852	DllCommonsvc.exe	84
PID 2852 wrote to memory of 1576	2852	DllCommonsvc.exe	84
PID 2852 wrote to memory of 624	2852	DllCommonsvc.exe	85
PID 2852 wrote to memory of 624	2852	DllCommonsvc.exe	85
PID 2852 wrote to memory of 624	2852	DllCommonsvc.exe	85
PID 2852 wrote to memory of 1416	2852	DllCommonsvc.exe	87
PID 2852 wrote to memory of 1416	2852	DllCommonsvc.exe	87
PID 2852 wrote to memory of 1416	2852	DllCommonsvc.exe	87
PID 2852 wrote to memory of 1640	2852	DllCommonsvc.exe	88
PID 2852 wrote to memory of 1640	2852	DllCommonsvc.exe	88
PID 2852 wrote to memory of 1640	2852	DllCommonsvc.exe	88
PID 2852 wrote to memory of 1836	2852	DllCommonsvc.exe	89
PID 2852 wrote to memory of 1836	2852	DllCommonsvc.exe	89
PID 2852 wrote to memory of 1836	2852	DllCommonsvc.exe	89
PID 2852 wrote to memory of 2756	2852	DllCommonsvc.exe	103
PID 2852 wrote to memory of 2756	2852	DllCommonsvc.exe	103
PID 2852 wrote to memory of 2756	2852	DllCommonsvc.exe	103
PID 2756 wrote to memory of 2892	2756	cmd.exe	105
PID 2756 wrote to memory of 2892	2756	cmd.exe	105
PID 2756 wrote to memory of 2892	2756	cmd.exe	105
PID 2756 wrote to memory of 1256	2756	cmd.exe	107
PID 2756 wrote to memory of 1256	2756	cmd.exe	107
PID 2756 wrote to memory of 1256	2756	cmd.exe	107
PID 1256 wrote to memory of 2220	1256	csrss.exe	108

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2ce0d2fd91c92c1e4631131c089f664c97739fcf1072d1f3aa8f1e59b5f21e5c.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2ce0d2fd91c92c1e4631131c089f664c97739fcf1072d1f3aa8f1e59b5f21e5c.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2756
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1744
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2704
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2852
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:584
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Uninstall Information\lsm.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1044
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\lsm.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1000
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\taskhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:984
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Local Settings\lsass.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3052
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Portable Devices\explorer.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2472
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:352
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Desktop\smss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1008
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:976
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1576
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\taskhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:624
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Recorded TV\Sample Media\services.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1416
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Pictures\Sample Pictures\dwm.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1640
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\sppsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1836
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\5sJNb3zpI1.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2756
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:2892
      - C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\csrss.exe
        
        "C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\csrss.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1256
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\pCY6B1XXru.bat"
        7⤵
        
        PID:2220
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:2680
        
        C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\csrss.exe
        
        "C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\csrss.exe"
        8⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2664
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\cu7QADyCUt.bat"
        9⤵
        
        PID:776
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:348
        
        C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\csrss.exe
        
        "C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\csrss.exe"
        10⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2684
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\XIXHPi7vyc.bat"
        11⤵
        
        PID:1512
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:976
        
        C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\csrss.exe
        
        "C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\csrss.exe"
        12⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2892
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\1e6qhBZ49x.bat"
        13⤵
        
        PID:2988
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        14⤵
        
        PID:2244
        
        C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\csrss.exe
        
        "C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\csrss.exe"
        14⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1944
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\PeSwWR6joe.bat"
        15⤵
        
        PID:1716
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        16⤵
        
        PID:2760
        
        C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\csrss.exe
        
        "C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\csrss.exe"
        16⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2520
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\n6bUdMbtqP.bat"
        17⤵
        
        PID:320
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        18⤵
        
        PID:888
        
        C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\csrss.exe
        
        "C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\csrss.exe"
        18⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1940
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\3HNGHapxv4.bat"
        19⤵
        
        PID:1020
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        20⤵
        
        PID:1408
        
        C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\csrss.exe
        
        "C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\csrss.exe"
        20⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:860
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\b3FUfZROOv.bat"
        21⤵
        
        PID:1516
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        22⤵
        
        PID:1720
        
        C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\csrss.exe
        
        "C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\csrss.exe"
        22⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2060
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\04VLARgLyy.bat"
        23⤵
        
        PID:2640
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        24⤵
        
        PID:2568
        
        C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\csrss.exe
        
        "C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\csrss.exe"
        24⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Uninstall Information\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Program Files (x86)\Uninstall Information\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2132

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Uninstall Information\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1896

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 8 /tr "'C:\providercommon\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\providercommon\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 12 /tr "'C:\providercommon\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2256

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 12 /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2312

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 8 /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2896

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\Users\Default\Local Settings\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Users\Default\Local Settings\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 10 /tr "'C:\Users\Default\Local Settings\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Portable Devices\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Portable Devices\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1252

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 9 /tr "'C:\Users\Public\Desktop\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1260

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Users\Public\Desktop\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\Users\Public\Desktop\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2384

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2192

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2232

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 9 /tr "'C:\Users\Default User\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Users\Default User\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 7 /tr "'C:\Users\Default User\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 8 /tr "'C:\Users\Public\Recorded TV\Sample Media\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Users\Public\Recorded TV\Sample Media\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\Users\Public\Recorded TV\Sample Media\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:896

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 12 /tr "'C:\Users\Public\Pictures\Sample Pictures\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Users\Public\Pictures\Sample Pictures\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\Users\Public\Pictures\Sample Pictures\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4c4f7499fb902ab4379758ca27ce4db1

SHA1
e1670ee3da7ac836cef3b522fb85597d2ad1dcf3

SHA256
0c764888141d6e74fbc6441c9b18bc838b402de4c75812754313491320a399c8

SHA512
b737db00d6c0114ac4cc0ac83ff29c622f43e48c4f6cedda722e37820969d295bfb78675284318df678db29366feb31d73f420e5f2945ba16cde73eac0ca3ddc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
56d583466ca0710e2c25b234e5cbc0e4

SHA1
ee44aededb2f03538b59982ded2e760610d6b63d

SHA256
1408a30d493fd192be5b1e8427044782e3b8195b7f85f2f2bcb57edcd54232f7

SHA512
31b090eec907aa733d3edd9782502aa3d4bd9f01b5091974a9cc7743666949b183043c62f335ca9aed6061a28a38ccb6975abde426cca22ef3a6c35caa304efb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
26566978edc94cdeafbbc62b3fa705af

SHA1
2064b961bca685c5d27f43ea50be1d5451b31de6

SHA256
ba17371abab99f1784dd4af143f64f47302f6e64744cfe01031da4dfd344b3d7

SHA512
047ccd24709c0de02414df96683b37405175243e7f217c897a8a01981c72ed705c783f188a0b32c35965a1a330c87fab543b702bdb8c8823e0df10fc26d3542e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
df7f94fffd8b16ff0c22aa1654fe537f

SHA1
adc366b70ca95075fef8709b86959f9277d1f957

SHA256
fc0d341bba14a8a21953f97377b021842e6a63b84768043d805c9998ac0746da

SHA512
a41981bc4ce0fad365f01545f30e2e443d3e1e78e033ed054b8e6bcd993dc357cc6bf1edc9b8ab54ff32eed522f47a8357f25a406a5fd87d38053f91ad48a716

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3cb9d22b423653d0344418ad5f74f42a

SHA1
4c0f705271c0bdc4f7f8f20ea6bae90a2c3a1c7d

SHA256
673a7a1be0736a53d8e19af0bfcca055da27ffc38c3973b91d3e071d1aa6e334

SHA512
e30866529bdc6416eb2368e115e28a3d804e207d7af9f5e19ce34325c137830d1f3f7b2eb168afc3cf5800e681f08f9dd58d2674e836553756e2419796a3df66

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
86269cb5c4aaf9d7563412f2d27ddec2

SHA1
347e5f0161e1d5c3459ba2da7adb8737f5c5d419

SHA256
7b8f6d421b3fe4df1270593eafeb1d214122ad9ad8cfdc4c8a61d228f36ea7c9

SHA512
a41269b177c32c87a15f5000b22f290e7fbec21645e5945d43a5aa932ffd3df5cbc8dfd16fc537abe2cb7c50b6ddab82784e4b1a13785e718e24f387f7fd6476

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f56499211567d1dfa6e7c8391793ad89

SHA1
b6922d6caac749de7da4a1f4aa52c53a3c7bb4ca

SHA256
4ab0eeea07c55de16fdb9b07422742213e5628ac8b8b8b6bbf87b838fc911932

SHA512
a6c22425131015d6af3de9b6866e5dbc8f9a739615359c0d4f4ffc84d28cd0be6b38ee93632e342c3cfe20ac7eab9c89875935a2a59304a0c226154d3942bf56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2b37b15d52f007d6bd90a0766f28231b

SHA1
01d3c9f16549df6ecfe5255f566b299b1e8fda5f

SHA256
c18fbd022d7757f562fa743784525b4009218a07aa3c8d431810cf4759600f98

SHA512
4fd9cbf901f049317a1b7fc66610f54bc7a356ef8d183801f5b098bffcb3073b3bc5b7fd3fe5a2f14fa907ca3b3f8b925d09b0416b741a509a6d5e1c6f97c8d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\04VLARgLyy.bat

Filesize
242B

MD5
f1b1aaebc3cce6d58d6a9a613c4baddd

SHA1
b24cc7c525545b52b80900646d2ff3fb394af03f

SHA256
b51634aa00e8d95bdede586cdcbc8456a7576760f12584ff6b5e562a72106170

SHA512
e2c3d9af4a2e518037634783829234440793556a73e61d36927b2e5a4e9b579257e92be38b910877ef3f6989ddf83b4340b7f57c2b729e7965a2ffe6dadefa04

Download Submit
C:\Users\Admin\AppData\Local\Temp\1e6qhBZ49x.bat

Filesize
242B

MD5
692747d530ee0e7012bdca0965003b7b

SHA1
fd7e4a21ac978a415e3d030b4944c053ca63df6d

SHA256
c22b327e627c2847f113430b7be0e1990c24fe97c4f3245aa4c576beeb78d0e6

SHA512
608e130914b5327466b921a1ff6f89650040e53d11401c7fd793d508b3c3664e292cc5713b394fe8ee0c8b043e029b5683d81ee217ec83e6a0d84cb4746b20eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\3HNGHapxv4.bat

Filesize
242B

MD5
614d2db79c21453ba203f993f01cdec5

SHA1
b29b988804b9b5af5c9f1eacf1b3a8adbadfdc8e

SHA256
720ef3eec6fe8092f3804f52dea35cf2c0fbd8106d2bcce50cdf7b3f341a73e5

SHA512
dce0427febac033cf0403f0f8eba00ee3f0adf5b75ec501be9eb580c66167030175b6974cc6e4a82eefdafad26fec6ac03556124d1825d87c13f2bcafa02faf6

Download Submit
C:\Users\Admin\AppData\Local\Temp\5sJNb3zpI1.bat

Filesize
242B

MD5
e255fb4259046d71e9caced8a3be0d1b

SHA1
654015f1df3c50c8ac05f1c1cac7c41a1d51a0ce

SHA256
5691c95ffc766da8541f7f9d00637c83dab98c1eec672b405c03477dca9d9150

SHA512
ed8982130a18aafa301be33f201c4df2cc1998c4dcc4045b64ddbe614dcf4cdde7ff55e7c62fef43b5bafb89b669ba1d36c91b5b8990f2b6ba73ed4ee971046c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab256D.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\PeSwWR6joe.bat

Filesize
242B

MD5
55eef1844774007338017fbce5b366f4

SHA1
898ee246e084e1cea6ca917f67eb70141a77f369

SHA256
5419bf34f47d498604f49e25e3ad582b8f789761b3d0400bd4cc722219f35487

SHA512
85facd7dc1b3867644d6c4b73af95a698eef543a16490a720cc7a8e1cf8d30de3d9cfe3f4d02f045c74c653e8b60c0b6659b71b2f065055a4535c8588105c5bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2580.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\XIXHPi7vyc.bat

Filesize
242B

MD5
157f84be4c5cdee4b2ffd586101a0161

SHA1
9473835b0b5dabfa998970d79b16e90fb39de9f8

SHA256
65694726c1382896e9a31c61dd59160d5974ded2967771117d461fea4d8856a9

SHA512
31982fcda812301c4cf310bdc27b2fafa11d9f25e8572fa95b35aab9e2d1973146a685d9aec78be8017adffb1a4db39549d485be4888abe83d7d55cb6a488002

Download Submit
C:\Users\Admin\AppData\Local\Temp\b3FUfZROOv.bat

Filesize
242B

MD5
03520b1d9216314061deadd7fabea41b

SHA1
f39fecd5804456f4e66f4d0b9b6df57845cd74c4

SHA256
20d6767557c6df6c151c7c3b2befd123a2cef8e262cb700f76acb621fad4feb7

SHA512
856fb6c90795e33210dc3529453b76c487ae529b1a1f82fe91e65221e81de8ca6b0578747554291a8af86a902091fe10a552481f39818a19a4b4a22d92f024e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\cu7QADyCUt.bat

Filesize
242B

MD5
3407a412ddbf79e154492154d76224e3

SHA1
cb2aea809222fd6463cc29bf9555b6ac02034b9f

SHA256
71f1d126252fa2b38fe351041723a9b4c8f1b5aa0b14b2122aac18b86e710510

SHA512
be2c8dcc99961eef2d302204e22005cdae0e469206402aa475a647deb071db76859fe22881f74efb4f7b8e9681937ff35c550fd6d3804c0bb359dbff52927aec

Download Submit
C:\Users\Admin\AppData\Local\Temp\n6bUdMbtqP.bat

Filesize
242B

MD5
46bd487df8650a148bcd6f05467d6bea

SHA1
b625947f3117b06480b8296d469916d1e707e423

SHA256
4483073812c93c36327c9f3464405a4747292d5def8dc3d852f590860ae75a00

SHA512
86ca32f9dedbc4c889b75d6db83f987572a8c05046a9953724f0860ce7bab6ed1571797afa76785e29172615e0a2b627dba3040d5806a47e3b19d9fcc00f06ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\pCY6B1XXru.bat

Filesize
242B

MD5
3a3b34aa1bd2284e51054b516cc9fd0f

SHA1
51a70fac0c9092f71d4e6487bcc385dd3ff15a4f

SHA256
84e48a6b35da761d60d013a0d21555b52a8185ee675b9e842582ff045121ea01

SHA512
3bf87795427f36c7cfaf375404de0a2de338ffd2ed5bc0d2d0b08d4f032df06e728e44fe087e60a2cf1d700d784d77235bc43ebcdb9911cb923ffeef37752f97

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
a4f385c97d7d73c41013f98912788736

SHA1
4557087ba8b7759d31c72c0c9b1cb943d78a36ac

SHA256
69b0073d607049d8b8101ff4cd1b1d8dc579dc857469fcb93851c37e1495b1a8

SHA512
aac0a311cc812a4a574f17b12584943148a425cb7a5f3dace5e649ab925d0c50c8efbd63e3c888cfda5c04357e31fd80cf2818a33c644a2ed15cad0165f7583e

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
memory/584-53-0x000000001B770000-0x000000001BA52000-memory.dmp

Filesize
2.9MB

Download
memory/584-90-0x00000000027E0000-0x00000000027E8000-memory.dmp

Filesize
32KB

Download
memory/860-538-0x00000000001B0000-0x00000000002C0000-memory.dmp

Filesize
1.1MB

Download
memory/1256-122-0x00000000012B0000-0x00000000013C0000-memory.dmp

Filesize
1.1MB

Download
memory/1940-478-0x00000000002B0000-0x00000000002C2000-memory.dmp

Filesize
72KB

Download
memory/1944-358-0x0000000000390000-0x00000000004A0000-memory.dmp

Filesize
1.1MB

Download
memory/2060-598-0x00000000008F0000-0x0000000000A00000-memory.dmp

Filesize
1.1MB

Download
memory/2520-418-0x0000000000DD0000-0x0000000000EE0000-memory.dmp

Filesize
1.1MB

Download
memory/2648-658-0x0000000001230000-0x0000000001340000-memory.dmp

Filesize
1.1MB

Download
memory/2852-16-0x0000000000260000-0x000000000026C000-memory.dmp

Filesize
48KB

Download
memory/2852-13-0x0000000001390000-0x00000000014A0000-memory.dmp

Filesize
1.1MB

Download
memory/2852-14-0x0000000000240000-0x0000000000252000-memory.dmp

Filesize
72KB

Download
memory/2852-15-0x0000000000250000-0x000000000025C000-memory.dmp

Filesize
48KB

Download
memory/2852-17-0x00000000003D0000-0x00000000003DC000-memory.dmp

Filesize
48KB

Download