Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2024, 02:01
Behavioral task
behavioral1
Sample
JaffaCakes118_b9fe092e0d15cefd3f03fda32ef261466b6c2aaf424462718468439bf50ff09a.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_b9fe092e0d15cefd3f03fda32ef261466b6c2aaf424462718468439bf50ff09a.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_b9fe092e0d15cefd3f03fda32ef261466b6c2aaf424462718468439bf50ff09a.exe
-
Size
1.3MB
-
MD5
92452d3cad4b0b6f9b05999e91f26014
-
SHA1
94eb891634ae49a17bf9c08eca44c3b57e6dfa82
-
SHA256
b9fe092e0d15cefd3f03fda32ef261466b6c2aaf424462718468439bf50ff09a
-
SHA512
2fcd37960b45a2022ccaaff5ddb2043cad8965f8a200105a2f5e439f11cfbb8517db2b7420ffecde65bdc1ecd0ce745d3dd0be290016f9b7ed8ffa9b90871e7e
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Process spawned unexpected child process 12 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3488 1460 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4416 1460 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4184 1460 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3840 1460 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2488 1460 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3048 1460 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3752 1460 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2956 1460 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3364 1460 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1852 1460 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 748 1460 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2352 1460 schtasks.exe 90 -
resource yara_rule behavioral2/files/0x0007000000023c98-10.dat dcrat behavioral2/memory/872-13-0x0000000000600000-0x0000000000710000-memory.dmp dcrat -
Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 1700 powershell.exe 1420 powershell.exe 1532 powershell.exe 4992 powershell.exe 4956 powershell.exe -
Checks computer location settings 2 TTPs 15 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation DllCommonsvc.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation JaffaCakes118_b9fe092e0d15cefd3f03fda32ef261466b6c2aaf424462718468439bf50ff09a.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation DllCommonsvc.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation DllCommonsvc.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation DllCommonsvc.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation DllCommonsvc.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation DllCommonsvc.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation DllCommonsvc.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation DllCommonsvc.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation DllCommonsvc.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation DllCommonsvc.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation DllCommonsvc.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation DllCommonsvc.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation DllCommonsvc.exe -
Executes dropped EXE 13 IoCs
pid Process 872 DllCommonsvc.exe 4780 DllCommonsvc.exe 4928 DllCommonsvc.exe 1976 DllCommonsvc.exe 732 DllCommonsvc.exe 1548 DllCommonsvc.exe 3484 DllCommonsvc.exe 4220 DllCommonsvc.exe 1544 DllCommonsvc.exe 4752 DllCommonsvc.exe 4784 DllCommonsvc.exe 4988 DllCommonsvc.exe 1980 DllCommonsvc.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 13 IoCs
flow ioc 55 raw.githubusercontent.com 57 raw.githubusercontent.com 15 raw.githubusercontent.com 20 raw.githubusercontent.com 45 raw.githubusercontent.com 46 raw.githubusercontent.com 50 raw.githubusercontent.com 54 raw.githubusercontent.com 16 raw.githubusercontent.com 39 raw.githubusercontent.com 42 raw.githubusercontent.com 56 raw.githubusercontent.com 62 raw.githubusercontent.com -
Drops file in Program Files directory 5 IoCs
description ioc Process File created C:\Program Files (x86)\Google\csrss.exe DllCommonsvc.exe File opened for modification C:\Program Files (x86)\Google\csrss.exe DllCommonsvc.exe File created C:\Program Files (x86)\Google\886983d96e3d3e DllCommonsvc.exe File created C:\Program Files\Windows Photo Viewer\DllCommonsvc.exe DllCommonsvc.exe File created C:\Program Files\Windows Photo Viewer\a76d7bf15d8370 DllCommonsvc.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\ServiceState\EventLog\Data\sihost.exe DllCommonsvc.exe File created C:\Windows\WaaS\services\taskhostw.exe DllCommonsvc.exe File created C:\Windows\SoftwareDistribution\Download\RuntimeBroker.exe DllCommonsvc.exe File created C:\Windows\SoftwareDistribution\Download\9e8d7a4ca61bd9 DllCommonsvc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_b9fe092e0d15cefd3f03fda32ef261466b6c2aaf424462718468439bf50ff09a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies registry class 14 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings DllCommonsvc.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings DllCommonsvc.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings DllCommonsvc.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings DllCommonsvc.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings DllCommonsvc.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings DllCommonsvc.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings JaffaCakes118_b9fe092e0d15cefd3f03fda32ef261466b6c2aaf424462718468439bf50ff09a.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings DllCommonsvc.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings DllCommonsvc.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings DllCommonsvc.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings DllCommonsvc.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings DllCommonsvc.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings DllCommonsvc.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings DllCommonsvc.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 12 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1852 schtasks.exe 748 schtasks.exe 2352 schtasks.exe 3488 schtasks.exe 3840 schtasks.exe 3752 schtasks.exe 3048 schtasks.exe 2956 schtasks.exe 3364 schtasks.exe 4416 schtasks.exe 4184 schtasks.exe 2488 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 36 IoCs
pid Process 872 DllCommonsvc.exe 872 DllCommonsvc.exe 872 DllCommonsvc.exe 872 DllCommonsvc.exe 872 DllCommonsvc.exe 872 DllCommonsvc.exe 872 DllCommonsvc.exe 872 DllCommonsvc.exe 872 DllCommonsvc.exe 872 DllCommonsvc.exe 872 DllCommonsvc.exe 1700 powershell.exe 4956 powershell.exe 1420 powershell.exe 1420 powershell.exe 4992 powershell.exe 4992 powershell.exe 1700 powershell.exe 4956 powershell.exe 1532 powershell.exe 1532 powershell.exe 4992 powershell.exe 1420 powershell.exe 1532 powershell.exe 4780 DllCommonsvc.exe 4928 DllCommonsvc.exe 1976 DllCommonsvc.exe 732 DllCommonsvc.exe 1548 DllCommonsvc.exe 3484 DllCommonsvc.exe 4220 DllCommonsvc.exe 1544 DllCommonsvc.exe 4752 DllCommonsvc.exe 4784 DllCommonsvc.exe 4988 DllCommonsvc.exe 1980 DllCommonsvc.exe -
Suspicious use of AdjustPrivilegeToken 18 IoCs
description pid Process Token: SeDebugPrivilege 872 DllCommonsvc.exe Token: SeDebugPrivilege 1700 powershell.exe Token: SeDebugPrivilege 4956 powershell.exe Token: SeDebugPrivilege 1420 powershell.exe Token: SeDebugPrivilege 4992 powershell.exe Token: SeDebugPrivilege 1532 powershell.exe Token: SeDebugPrivilege 4780 DllCommonsvc.exe Token: SeDebugPrivilege 4928 DllCommonsvc.exe Token: SeDebugPrivilege 1976 DllCommonsvc.exe Token: SeDebugPrivilege 732 DllCommonsvc.exe Token: SeDebugPrivilege 1548 DllCommonsvc.exe Token: SeDebugPrivilege 3484 DllCommonsvc.exe Token: SeDebugPrivilege 4220 DllCommonsvc.exe Token: SeDebugPrivilege 1544 DllCommonsvc.exe Token: SeDebugPrivilege 4752 DllCommonsvc.exe Token: SeDebugPrivilege 4784 DllCommonsvc.exe Token: SeDebugPrivilege 4988 DllCommonsvc.exe Token: SeDebugPrivilege 1980 DllCommonsvc.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2768 wrote to memory of 5080 2768 JaffaCakes118_b9fe092e0d15cefd3f03fda32ef261466b6c2aaf424462718468439bf50ff09a.exe 85 PID 2768 wrote to memory of 5080 2768 JaffaCakes118_b9fe092e0d15cefd3f03fda32ef261466b6c2aaf424462718468439bf50ff09a.exe 85 PID 2768 wrote to memory of 5080 2768 JaffaCakes118_b9fe092e0d15cefd3f03fda32ef261466b6c2aaf424462718468439bf50ff09a.exe 85 PID 5080 wrote to memory of 4920 5080 WScript.exe 87 PID 5080 wrote to memory of 4920 5080 WScript.exe 87 PID 5080 wrote to memory of 4920 5080 WScript.exe 87 PID 4920 wrote to memory of 872 4920 cmd.exe 89 PID 4920 wrote to memory of 872 4920 cmd.exe 89 PID 872 wrote to memory of 1700 872 DllCommonsvc.exe 104 PID 872 wrote to memory of 1700 872 DllCommonsvc.exe 104 PID 872 wrote to memory of 1420 872 DllCommonsvc.exe 105 PID 872 wrote to memory of 1420 872 DllCommonsvc.exe 105 PID 872 wrote to memory of 1532 872 DllCommonsvc.exe 106 PID 872 wrote to memory of 1532 872 DllCommonsvc.exe 106 PID 872 wrote to memory of 4992 872 DllCommonsvc.exe 107 PID 872 wrote to memory of 4992 872 DllCommonsvc.exe 107 PID 872 wrote to memory of 4956 872 DllCommonsvc.exe 108 PID 872 wrote to memory of 4956 872 DllCommonsvc.exe 108 PID 872 wrote to memory of 816 872 DllCommonsvc.exe 114 PID 872 wrote to memory of 816 872 DllCommonsvc.exe 114 PID 816 wrote to memory of 4468 816 cmd.exe 116 PID 816 wrote to memory of 4468 816 cmd.exe 116 PID 816 wrote to memory of 4780 816 cmd.exe 118 PID 816 wrote to memory of 4780 816 cmd.exe 118 PID 4780 wrote to memory of 4736 4780 DllCommonsvc.exe 120 PID 4780 wrote to memory of 4736 4780 DllCommonsvc.exe 120 PID 4736 wrote to memory of 3388 4736 cmd.exe 122 PID 4736 wrote to memory of 3388 4736 cmd.exe 122 PID 4736 wrote to memory of 4928 4736 cmd.exe 124 PID 4736 wrote to memory of 4928 4736 cmd.exe 124 PID 4928 wrote to memory of 3364 4928 DllCommonsvc.exe 128 PID 4928 wrote to memory of 3364 4928 DllCommonsvc.exe 128 PID 3364 wrote to memory of 3004 3364 cmd.exe 130 PID 3364 wrote to memory of 3004 3364 cmd.exe 130 PID 3364 wrote to memory of 1976 3364 cmd.exe 139 PID 3364 wrote to memory of 1976 3364 cmd.exe 139 PID 1976 wrote to memory of 4204 1976 DllCommonsvc.exe 146 PID 1976 wrote to memory of 4204 1976 DllCommonsvc.exe 146 PID 4204 wrote to memory of 2736 4204 cmd.exe 148 PID 4204 wrote to memory of 2736 4204 cmd.exe 148 PID 4204 wrote to memory of 732 4204 cmd.exe 150 PID 4204 wrote to memory of 732 4204 cmd.exe 150 PID 732 wrote to memory of 4360 732 DllCommonsvc.exe 152 PID 732 wrote to memory of 4360 732 DllCommonsvc.exe 152 PID 4360 wrote to memory of 4780 4360 cmd.exe 154 PID 4360 wrote to memory of 4780 4360 cmd.exe 154 PID 4360 wrote to memory of 1548 4360 cmd.exe 156 PID 4360 wrote to memory of 1548 4360 cmd.exe 156 PID 1548 wrote to memory of 2588 1548 DllCommonsvc.exe 159 PID 1548 wrote to memory of 2588 1548 DllCommonsvc.exe 159 PID 2588 wrote to memory of 808 2588 cmd.exe 161 PID 2588 wrote to memory of 808 2588 cmd.exe 161 PID 2588 wrote to memory of 3484 2588 cmd.exe 163 PID 2588 wrote to memory of 3484 2588 cmd.exe 163 PID 3484 wrote to memory of 3196 3484 DllCommonsvc.exe 165 PID 3484 wrote to memory of 3196 3484 DllCommonsvc.exe 165 PID 3196 wrote to memory of 3964 3196 cmd.exe 167 PID 3196 wrote to memory of 3964 3196 cmd.exe 167 PID 3196 wrote to memory of 4220 3196 cmd.exe 169 PID 3196 wrote to memory of 4220 3196 cmd.exe 169 PID 4220 wrote to memory of 2864 4220 DllCommonsvc.exe 171 PID 4220 wrote to memory of 2864 4220 DllCommonsvc.exe 171 PID 2864 wrote to memory of 3824 2864 cmd.exe 173 PID 2864 wrote to memory of 3824 2864 cmd.exe 173 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b9fe092e0d15cefd3f03fda32ef261466b6c2aaf424462718468439bf50ff09a.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b9fe092e0d15cefd3f03fda32ef261466b6c2aaf424462718468439bf50ff09a.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\providercommon\DllCommonsvc.exe"C:\providercommon\DllCommonsvc.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:872 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1700
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Google\csrss.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1420
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Photo Viewer\DllCommonsvc.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1532
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\Registry.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4992
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\SoftwareDistribution\Download\RuntimeBroker.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4956
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\PoxOxlpmGs.bat"5⤵
- Suspicious use of WriteProcessMemory
PID:816 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:26⤵PID:4468
-
-
C:\Program Files\Windows Photo Viewer\DllCommonsvc.exe"C:\Program Files\Windows Photo Viewer\DllCommonsvc.exe"6⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\PJw82jcrZC.bat"7⤵
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:28⤵PID:3388
-
-
C:\Program Files\Windows Photo Viewer\DllCommonsvc.exe"C:\Program Files\Windows Photo Viewer\DllCommonsvc.exe"8⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ewVMycoP0v.bat"9⤵
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:210⤵PID:3004
-
-
C:\Program Files\Windows Photo Viewer\DllCommonsvc.exe"C:\Program Files\Windows Photo Viewer\DllCommonsvc.exe"10⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\1hmmkqxEk5.bat"11⤵
- Suspicious use of WriteProcessMemory
PID:4204 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:212⤵PID:2736
-
-
C:\Program Files\Windows Photo Viewer\DllCommonsvc.exe"C:\Program Files\Windows Photo Viewer\DllCommonsvc.exe"12⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:732 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\unLkZH0FaU.bat"13⤵
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:214⤵PID:4780
-
-
C:\Program Files\Windows Photo Viewer\DllCommonsvc.exe"C:\Program Files\Windows Photo Viewer\DllCommonsvc.exe"14⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\IPU7rAfrPc.bat"15⤵
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:216⤵PID:808
-
-
C:\Program Files\Windows Photo Viewer\DllCommonsvc.exe"C:\Program Files\Windows Photo Viewer\DllCommonsvc.exe"16⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3484 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\b9aNmsEibB.bat"17⤵
- Suspicious use of WriteProcessMemory
PID:3196 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:218⤵PID:3964
-
-
C:\Program Files\Windows Photo Viewer\DllCommonsvc.exe"C:\Program Files\Windows Photo Viewer\DllCommonsvc.exe"18⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\xjNnGM38uG.bat"19⤵
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:220⤵PID:3824
-
-
C:\Program Files\Windows Photo Viewer\DllCommonsvc.exe"C:\Program Files\Windows Photo Viewer\DllCommonsvc.exe"20⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1544 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\cu7QADyCUt.bat"21⤵PID:3772
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:222⤵PID:1500
-
-
C:\Program Files\Windows Photo Viewer\DllCommonsvc.exe"C:\Program Files\Windows Photo Viewer\DllCommonsvc.exe"22⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4752 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\CMv1BFFgLz.bat"23⤵PID:1280
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:224⤵PID:1208
-
-
C:\Program Files\Windows Photo Viewer\DllCommonsvc.exe"C:\Program Files\Windows Photo Viewer\DllCommonsvc.exe"24⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4784 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\srJhtCwLGi.bat"25⤵PID:2572
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:226⤵PID:864
-
-
C:\Program Files\Windows Photo Viewer\DllCommonsvc.exe"C:\Program Files\Windows Photo Viewer\DllCommonsvc.exe"26⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4988 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\VF9LbKHiRa.bat"27⤵PID:3344
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:228⤵PID:3048
-
-
C:\Program Files\Windows Photo Viewer\DllCommonsvc.exe"C:\Program Files\Windows Photo Viewer\DllCommonsvc.exe"28⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1980 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\LW19r029AS.bat"29⤵PID:3088
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:230⤵PID:1740
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Google\csrss.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3488
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4416
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Google\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4184
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Photo Viewer\DllCommonsvc.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3840
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\DllCommonsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2488
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Photo Viewer\DllCommonsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3048
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\Registry.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3752
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2956
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3364
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Windows\SoftwareDistribution\Download\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1852
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\SoftwareDistribution\Download\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:748
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Windows\SoftwareDistribution\Download\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2352
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD57f3c0ae41f0d9ae10a8985a2c327b8fb
SHA1d58622bf6b5071beacf3b35bb505bde2000983e3
SHA256519fceae4d0dd4d09edd1b81bcdfa8aeab4b59eee77a4cd4b6295ce8e591a900
SHA5128a8fd17eef071f86e672cba0d8fc2cfed6118aff816100b9d7c06eb96443c04c04bc5692259c8d7ecb1563e877921939c61726605af4f969e3f586f0913ed125
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD54d7e609eb8e2f1d595c8202f1ec6eb23
SHA19331edf68376270c2b034bc3f0ece25d96090c51
SHA25652605303f5748e2d9d7d3d9ecff34bb221af254800d28db8d06fe486fb14b29b
SHA512a1d7a745cc7b043d1d84248d7d3473244bc3c2681a288a7b7a877536ac973ea86246ae82da80b461a6442c0d6f60c731b2e6e0955f1ffe0a34edb008f13d226c
-
Filesize
944B
MD577d622bb1a5b250869a3238b9bc1402b
SHA1d47f4003c2554b9dfc4c16f22460b331886b191b
SHA256f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb
SHA512d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9
-
Filesize
219B
MD52f039541a41418d80700c7262c0e5e24
SHA1ecc122048a8492136186778556aa10d7899fd8dd
SHA256c778c8efbaf8be6ce4a38614ed7bd87e5fd7018a9487369ba199aeb0bf96ed45
SHA512c74dd60fd7a30c2c41518483200eafb2c04485a1e55f4c4973eb42901545014720e94d8477c478b8165a13d56ae633026f285576f35540b86eff7f9a425c055b
-
Filesize
219B
MD58b0e46c2e7ea8ac5ad500b4c426b7545
SHA151a64cf20e73c679d08b2d71b9f0f10d6113ca63
SHA2568930d75c52563fa25b699d3291db7b97bd3859efca0932835d0957f87d756fdd
SHA5128a12036e00c0678c161600c203171aa28bf7a188175ab56bcb2196c8c0543f3df6d85b7117704e23718303881d47f148e0afce669f19cf85edc943dc67ff234d
-
Filesize
219B
MD5e7317b80a2dedbc168a8243bda9e5d42
SHA1c90deb4ab0d17081690d3c9eedf69b69a5d5ef2c
SHA25615136d73c8aa8b655bd31f276d4794efeed5d2f7a2f876ef7a557eac6b69ad24
SHA5128a18216e8973585bc1a0f739b732d4253f054a6fe8504ff0842e347f98d7a5223cbc72e256f3477690f022774f80aeecfaf0746bb401a85ec7df2104c27c270b
-
Filesize
219B
MD58990e6afcb099c800ac4a084f1869500
SHA1a880b4873e46f8c1a5804adb3fca5a1ae167d16f
SHA256b8ecaf076b2f817554045ee11460210dd47d3fd16e1b9e5f6fa06cf9def4f0e9
SHA512abbf3c17d155869c55e4bf15cb3076a60389646e598bbe058464829fba1b15173b326308418796900614487e67e9507adccd796627d704ad3492630ef676de9e
-
Filesize
219B
MD5d3f4eb4b2a764090f9f1dd3587183d15
SHA13156518b124411f5a8747955e9eca5b78ccc9bca
SHA256c39d64bbdd4bf6cd3654fc25e95db744068772e9d2e41f30f7cac7406f9c2844
SHA512c11f12c5a804331f05c11fc6beab0d4dc068246dc1eb78e1734b61bc469afac2d03d60597d19a081fe502172f268aea0f00e4552621ebd9dd9c520836fac1331
-
Filesize
219B
MD547ad534dd987e6181d674af227db8a4c
SHA1574b80093deaa58258d78ff6e57e8640660a0113
SHA2560f9c50572ba5031d475059a879748d039675c9e41e0488cc546b4668db2e417c
SHA5120a1f36b0f0d8818b41ceec438c613f2d0da572eb7483ee4d535c25f1ef100f8d765b49e735184d3fe7669ac2366b4de46d54a583e7830cec60bb931a658ddfbd
-
Filesize
219B
MD54acf1f3c2b78b76bccfacccea49edca4
SHA1684497969639ca6ee2ef0c3f50c049cad749d24b
SHA256ac284dc4c4cb3a5c99af213f8a0ff43ebc77022972611b1ce7e8032b8e568a20
SHA5123a213be97927447756a12aa16e62498095ebb7aaab9803d4ddae9597c436870abcac5b12b5724f3ce00c7f05b70969a15213764199ba72f1e24b9637ccc9deb5
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
219B
MD5606f9a52900a4b1334743c41d3f40d1e
SHA1226ab80a9111a019a217c1bd13e438db52c0bb82
SHA256f3905e33262669b500fd5a3d3a6c984fb089d5a180762883c7695cafe36e03fb
SHA512468e749c57034be388f9a4f8726f026d70f851293b535f5e73fff5f1cd197cdb8a0b2f4a3b3d70d9b4655c3b79103dc0df61c3a16939bc0ae120c877ebd88bba
-
Filesize
219B
MD54a3659e6b9df8abc3b98beb0d8db2fb9
SHA1a27b18d20e5289d16a3c7e9fee7c8ab8ef6bf18b
SHA256f1dbdc5d8f2121ceada9a561545088a582c0457b22a65e827c50387175e61324
SHA5122e45656057c44e436cad2a8ecd8ef4971f55b0ce7c105e38dd8c8c4b01be0c3f165e122217a87814edd2b9f534821e1f5b20e20c3171ba18511d11bad7f77f24
-
Filesize
219B
MD59140e0b99a5d8817f3b7e3b55c72a2f1
SHA19dd9cab2da2340887d54bde605cb6a0bc77842e3
SHA25629ac0dc9d4f412b0c5648f4e1d010a77db548f5f5aefd58e81059e7b26cb291a
SHA5120427228997384c5bb9141ee0270f29d5519a8a2dfee743e26ee1f3bbd305be33daf02a04c0f53835682ee863b47b87114366f695324a46f53b49d856f838c84d
-
Filesize
219B
MD5f92de639a97170c3689120d7f70b7ce2
SHA1b110b2f1129f1f2bc01ff8cf7b8d8e6852bdb7af
SHA25660a082715bfe9c2f68d16cfab27dd11ffff69f4dd62e05b80ae96c452c2ea8fa
SHA5124067632d8b2292b6aa5e2c32fbe89ef76f5dbfea32d200ff34632d576de4cd9b905727477986ed7b0cc7e9931eee9c7b6584b5c22517c4bd2ba307c7fe819b1f
-
Filesize
219B
MD5fbb6a20eec95c129ac19f70eb802bb7f
SHA11cd47aa23fac8671b992686e95cfea3bf9dfd209
SHA256df19680965d9c32ffa9e2a35aadc9b5429a0e8e3061d110b4c05370ee7726c08
SHA512f4a28706756c36b253fe27fa85f538f0470a53166cf18df28703fa5838a6482b02f2f00ea03d582c780ab4553435a66620d0d1a699a007a9c8a8a63ae051696f
-
Filesize
219B
MD5e21556717472069726cee581f62cf5a1
SHA1235c888a35688706d2c218d29a292f368c6789d2
SHA2564e447f41c65c5aae4825fdd4552764a7dde919dc65c8aaa5bf1d797b80082972
SHA512d673146011fc1b14c658561eb543e0769b09cdb0e9780d0319a5295b9d1e9575f646206ada1b94dfe08174759ed423753d283e87b27b0e09ac8192340a7962ac
-
Filesize
36B
MD56783c3ee07c7d151ceac57f1f9c8bed7
SHA117468f98f95bf504cc1f83c49e49a78526b3ea03
SHA2568ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322
SHA512c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8
-
Filesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
Filesize
197B
MD58088241160261560a02c84025d107592
SHA1083121f7027557570994c9fc211df61730455bb5
SHA2562072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1
SHA51220d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478