Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2024, 02:21
Behavioral task
behavioral1
Sample
JaffaCakes118_7c1c6e0abfdbf0fd7abf694a77b34c85be16b5b40f6a65565a52495e5caf509f.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_7c1c6e0abfdbf0fd7abf694a77b34c85be16b5b40f6a65565a52495e5caf509f.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_7c1c6e0abfdbf0fd7abf694a77b34c85be16b5b40f6a65565a52495e5caf509f.exe
-
Size
1.3MB
-
MD5
2c4c3cdc40410affea03f25de402097f
-
SHA1
a505e1cc748e0982a2fefc449f7b7efe5c6aa21e
-
SHA256
7c1c6e0abfdbf0fd7abf694a77b34c85be16b5b40f6a65565a52495e5caf509f
-
SHA512
dbefb6079721c043aa3c26414ee8769fb1544a66e8961b40230c334891d7fa9e1eacad97e8ce0e2cfe28a88b80f6c5a1e97c576aceb513e2706f357ca490856d
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Process spawned unexpected child process 6 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1860 4220 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 436 4220 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 724 4220 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1876 4220 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3980 4220 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3048 4220 schtasks.exe 89 -
resource yara_rule behavioral2/files/0x0007000000023c67-10.dat dcrat behavioral2/memory/1056-13-0x0000000000A40000-0x0000000000B50000-memory.dmp dcrat -
Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 1772 powershell.exe 3052 powershell.exe 2060 powershell.exe -
Checks computer location settings 2 TTPs 16 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation dllhost.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation dllhost.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation dllhost.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation dllhost.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation dllhost.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation JaffaCakes118_7c1c6e0abfdbf0fd7abf694a77b34c85be16b5b40f6a65565a52495e5caf509f.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation dllhost.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation dllhost.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation dllhost.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation dllhost.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation dllhost.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation dllhost.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation dllhost.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation DllCommonsvc.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation dllhost.exe -
Executes dropped EXE 14 IoCs
pid Process 1056 DllCommonsvc.exe 1620 dllhost.exe 4340 dllhost.exe 2412 dllhost.exe 2584 dllhost.exe 1144 dllhost.exe 4292 dllhost.exe 4340 dllhost.exe 2360 dllhost.exe 404 dllhost.exe 2112 dllhost.exe 3304 dllhost.exe 1600 dllhost.exe 3704 dllhost.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 14 IoCs
flow ioc 33 raw.githubusercontent.com 47 raw.githubusercontent.com 55 raw.githubusercontent.com 16 raw.githubusercontent.com 46 raw.githubusercontent.com 53 raw.githubusercontent.com 54 raw.githubusercontent.com 15 raw.githubusercontent.com 41 raw.githubusercontent.com 45 raw.githubusercontent.com 52 raw.githubusercontent.com 56 raw.githubusercontent.com 26 raw.githubusercontent.com 42 raw.githubusercontent.com -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\schemas\CodeIntegrity\ExamplePolicies\SearchApp.exe DllCommonsvc.exe File created C:\Windows\schemas\CodeIntegrity\ExamplePolicies\38384e6a620884 DllCommonsvc.exe File created C:\Windows\schemas\CodeIntegrity\ExamplePolicies\SearchApp.exe DllCommonsvc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_7c1c6e0abfdbf0fd7abf694a77b34c85be16b5b40f6a65565a52495e5caf509f.exe -
Modifies registry class 14 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings dllhost.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings dllhost.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings dllhost.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings JaffaCakes118_7c1c6e0abfdbf0fd7abf694a77b34c85be16b5b40f6a65565a52495e5caf509f.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings dllhost.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings dllhost.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings dllhost.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings dllhost.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings dllhost.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings dllhost.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings dllhost.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings dllhost.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings dllhost.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings dllhost.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 436 schtasks.exe 724 schtasks.exe 1876 schtasks.exe 3980 schtasks.exe 3048 schtasks.exe 1860 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 1056 DllCommonsvc.exe 1056 DllCommonsvc.exe 1056 DllCommonsvc.exe 1056 DllCommonsvc.exe 1056 DllCommonsvc.exe 3052 powershell.exe 1772 powershell.exe 3052 powershell.exe 2060 powershell.exe 2060 powershell.exe 1772 powershell.exe 1620 dllhost.exe 4340 dllhost.exe 2412 dllhost.exe 2584 dllhost.exe 1144 dllhost.exe 4292 dllhost.exe 4340 dllhost.exe 2360 dllhost.exe 404 dllhost.exe 2112 dllhost.exe 3304 dllhost.exe 1600 dllhost.exe 3704 dllhost.exe -
Suspicious use of AdjustPrivilegeToken 17 IoCs
description pid Process Token: SeDebugPrivilege 1056 DllCommonsvc.exe Token: SeDebugPrivilege 3052 powershell.exe Token: SeDebugPrivilege 1772 powershell.exe Token: SeDebugPrivilege 2060 powershell.exe Token: SeDebugPrivilege 1620 dllhost.exe Token: SeDebugPrivilege 4340 dllhost.exe Token: SeDebugPrivilege 2412 dllhost.exe Token: SeDebugPrivilege 2584 dllhost.exe Token: SeDebugPrivilege 1144 dllhost.exe Token: SeDebugPrivilege 4292 dllhost.exe Token: SeDebugPrivilege 4340 dllhost.exe Token: SeDebugPrivilege 2360 dllhost.exe Token: SeDebugPrivilege 404 dllhost.exe Token: SeDebugPrivilege 2112 dllhost.exe Token: SeDebugPrivilege 3304 dllhost.exe Token: SeDebugPrivilege 1600 dllhost.exe Token: SeDebugPrivilege 3704 dllhost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1716 wrote to memory of 2996 1716 JaffaCakes118_7c1c6e0abfdbf0fd7abf694a77b34c85be16b5b40f6a65565a52495e5caf509f.exe 84 PID 1716 wrote to memory of 2996 1716 JaffaCakes118_7c1c6e0abfdbf0fd7abf694a77b34c85be16b5b40f6a65565a52495e5caf509f.exe 84 PID 1716 wrote to memory of 2996 1716 JaffaCakes118_7c1c6e0abfdbf0fd7abf694a77b34c85be16b5b40f6a65565a52495e5caf509f.exe 84 PID 2996 wrote to memory of 2192 2996 WScript.exe 86 PID 2996 wrote to memory of 2192 2996 WScript.exe 86 PID 2996 wrote to memory of 2192 2996 WScript.exe 86 PID 2192 wrote to memory of 1056 2192 cmd.exe 88 PID 2192 wrote to memory of 1056 2192 cmd.exe 88 PID 1056 wrote to memory of 2060 1056 DllCommonsvc.exe 97 PID 1056 wrote to memory of 2060 1056 DllCommonsvc.exe 97 PID 1056 wrote to memory of 3052 1056 DllCommonsvc.exe 98 PID 1056 wrote to memory of 3052 1056 DllCommonsvc.exe 98 PID 1056 wrote to memory of 1772 1056 DllCommonsvc.exe 99 PID 1056 wrote to memory of 1772 1056 DllCommonsvc.exe 99 PID 1056 wrote to memory of 1620 1056 DllCommonsvc.exe 102 PID 1056 wrote to memory of 1620 1056 DllCommonsvc.exe 102 PID 1620 wrote to memory of 4948 1620 dllhost.exe 105 PID 1620 wrote to memory of 4948 1620 dllhost.exe 105 PID 4948 wrote to memory of 2920 4948 cmd.exe 107 PID 4948 wrote to memory of 2920 4948 cmd.exe 107 PID 4948 wrote to memory of 4340 4948 cmd.exe 116 PID 4948 wrote to memory of 4340 4948 cmd.exe 116 PID 4340 wrote to memory of 3980 4340 dllhost.exe 122 PID 4340 wrote to memory of 3980 4340 dllhost.exe 122 PID 3980 wrote to memory of 3416 3980 cmd.exe 124 PID 3980 wrote to memory of 3416 3980 cmd.exe 124 PID 3980 wrote to memory of 2412 3980 cmd.exe 126 PID 3980 wrote to memory of 2412 3980 cmd.exe 126 PID 2412 wrote to memory of 1004 2412 dllhost.exe 130 PID 2412 wrote to memory of 1004 2412 dllhost.exe 130 PID 1004 wrote to memory of 4236 1004 cmd.exe 132 PID 1004 wrote to memory of 4236 1004 cmd.exe 132 PID 1004 wrote to memory of 2584 1004 cmd.exe 135 PID 1004 wrote to memory of 2584 1004 cmd.exe 135 PID 2584 wrote to memory of 4168 2584 dllhost.exe 137 PID 2584 wrote to memory of 4168 2584 dllhost.exe 137 PID 4168 wrote to memory of 1624 4168 cmd.exe 139 PID 4168 wrote to memory of 1624 4168 cmd.exe 139 PID 4168 wrote to memory of 1144 4168 cmd.exe 141 PID 4168 wrote to memory of 1144 4168 cmd.exe 141 PID 1144 wrote to memory of 4644 1144 dllhost.exe 143 PID 1144 wrote to memory of 4644 1144 dllhost.exe 143 PID 4644 wrote to memory of 1944 4644 cmd.exe 145 PID 4644 wrote to memory of 1944 4644 cmd.exe 145 PID 4644 wrote to memory of 4292 4644 cmd.exe 147 PID 4644 wrote to memory of 4292 4644 cmd.exe 147 PID 4292 wrote to memory of 2556 4292 dllhost.exe 150 PID 4292 wrote to memory of 2556 4292 dllhost.exe 150 PID 2556 wrote to memory of 3636 2556 cmd.exe 152 PID 2556 wrote to memory of 3636 2556 cmd.exe 152 PID 2556 wrote to memory of 4340 2556 cmd.exe 154 PID 2556 wrote to memory of 4340 2556 cmd.exe 154 PID 4340 wrote to memory of 2752 4340 dllhost.exe 156 PID 4340 wrote to memory of 2752 4340 dllhost.exe 156 PID 2752 wrote to memory of 1784 2752 cmd.exe 158 PID 2752 wrote to memory of 1784 2752 cmd.exe 158 PID 2752 wrote to memory of 2360 2752 cmd.exe 160 PID 2752 wrote to memory of 2360 2752 cmd.exe 160 PID 2360 wrote to memory of 4856 2360 dllhost.exe 162 PID 2360 wrote to memory of 4856 2360 dllhost.exe 162 PID 4856 wrote to memory of 5072 4856 cmd.exe 164 PID 4856 wrote to memory of 5072 4856 cmd.exe 164 PID 4856 wrote to memory of 404 4856 cmd.exe 166 PID 4856 wrote to memory of 404 4856 cmd.exe 166 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7c1c6e0abfdbf0fd7abf694a77b34c85be16b5b40f6a65565a52495e5caf509f.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7c1c6e0abfdbf0fd7abf694a77b34c85be16b5b40f6a65565a52495e5caf509f.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\providercommon\DllCommonsvc.exe"C:\providercommon\DllCommonsvc.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2060
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\schemas\CodeIntegrity\ExamplePolicies\SearchApp.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3052
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\dllhost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1772
-
-
C:\providercommon\dllhost.exe"C:\providercommon\dllhost.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\tcplHXgq9Q.bat"6⤵
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:27⤵PID:2920
-
-
C:\providercommon\dllhost.exe"C:\providercommon\dllhost.exe"7⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\3fa1oyizme.bat"8⤵
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:29⤵PID:3416
-
-
C:\providercommon\dllhost.exe"C:\providercommon\dllhost.exe"9⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\qpvm5o68kg.bat"10⤵
- Suspicious use of WriteProcessMemory
PID:1004 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:211⤵PID:4236
-
-
C:\providercommon\dllhost.exe"C:\providercommon\dllhost.exe"11⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\0PvuKmrV6l.bat"12⤵
- Suspicious use of WriteProcessMemory
PID:4168 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:213⤵PID:1624
-
-
C:\providercommon\dllhost.exe"C:\providercommon\dllhost.exe"13⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\NADK710Kqv.bat"14⤵
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:215⤵PID:1944
-
-
C:\providercommon\dllhost.exe"C:\providercommon\dllhost.exe"15⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\wYroxckjTC.bat"16⤵
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:217⤵PID:3636
-
-
C:\providercommon\dllhost.exe"C:\providercommon\dllhost.exe"17⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\fjnbjzFmbP.bat"18⤵
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:219⤵PID:1784
-
-
C:\providercommon\dllhost.exe"C:\providercommon\dllhost.exe"19⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\kbrh69MYEy.bat"20⤵
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:221⤵PID:5072
-
-
C:\providercommon\dllhost.exe"C:\providercommon\dllhost.exe"21⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:404 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\xc1v93Hoh1.bat"22⤵PID:2720
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:223⤵PID:2460
-
-
C:\providercommon\dllhost.exe"C:\providercommon\dllhost.exe"23⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2112 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\QHkN6qNcbm.bat"24⤵PID:964
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:225⤵PID:4400
-
-
C:\providercommon\dllhost.exe"C:\providercommon\dllhost.exe"25⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3304 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\uVUt9EuWwA.bat"26⤵PID:2860
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:227⤵PID:2176
-
-
C:\providercommon\dllhost.exe"C:\providercommon\dllhost.exe"27⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1600 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\GN7B3lpeta.bat"28⤵PID:3944
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:229⤵PID:3172
-
-
C:\providercommon\dllhost.exe"C:\providercommon\dllhost.exe"29⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3704 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\RBOUzXbIOW.bat"30⤵PID:3948
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:231⤵PID:2664
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 11 /tr "'C:\Windows\schemas\CodeIntegrity\ExamplePolicies\SearchApp.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1860
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Windows\schemas\CodeIntegrity\ExamplePolicies\SearchApp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:436
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 12 /tr "'C:\Windows\schemas\CodeIntegrity\ExamplePolicies\SearchApp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:724
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\providercommon\dllhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3980
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\providercommon\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1876
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\providercommon\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3048
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5baf55b95da4a601229647f25dad12878
SHA1abc16954ebfd213733c4493fc1910164d825cac8
SHA256ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
SHA51224f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD577d622bb1a5b250869a3238b9bc1402b
SHA1d47f4003c2554b9dfc4c16f22460b331886b191b
SHA256f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb
SHA512d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9
-
Filesize
944B
MD56d3e9c29fe44e90aae6ed30ccf799ca8
SHA1c7974ef72264bbdf13a2793ccf1aed11bc565dce
SHA2562360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d
SHA51260c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a
-
Filesize
194B
MD5cde009c98223ca14992400e3a83af4a6
SHA1b5f337922134873a9c96b0356f55e1833c548d2a
SHA2564620e6a48ebfe209d90a4b0a845e834fb8989ee182b856586e5a3673bf7d34d7
SHA512efc4f26a42c55e04efd3865104dd1ccc4dac12495a52168706adb93c4d1c7b98fcbdbe9806a80a232230c8e15c4e341953f325aa4fcdaa468977906bbf5b7fa2
-
Filesize
194B
MD5e8051efe42984321f50f520c0a7e192e
SHA1baab5176350441c956f40a6149d66a71c95ccf67
SHA25670ec59f8fbb203cc8cbe2ac036c7883586fba8507ec6b0b6750d12c6ca8b45d1
SHA512dc67211bae7b3c583b343116220667d2f9e824abd54cf96a44e59230a3d82a7aa0e9bfa44ea7ca2d8d6da4207341ef0a8a37dde48834106dab1be4972f4418a0
-
Filesize
194B
MD579ecf85eb6166ff4686ac008f88269da
SHA1945fbe59aa056e745c3d040790f334b51afc54db
SHA25628cc0f1d36e333bbfd3566acdab0ae00c580df949c0326d209717baca9545969
SHA5124f743b4afbe7bb60c21b8ee24fcc569110c14ee8b618c57226488d8b591145a7f9e57db6df15a93346ddf7f751b0e96b45f19bd65401628e88875286d2f1d320
-
Filesize
194B
MD59b8b75788421ea79c13c845d95f8c2d9
SHA1fb0c6f4916acc95e960b62f2b12c0e0be5131754
SHA2560948343fe4429ecab5cd5d82c943416398a21e99063862c8fe930e91754ea963
SHA512cb1d5eab45ae45a0f2642f3be7d55b3eafa4bfa35a5cb152be1ac944ef7bb7c325778469fca538692653cd038709239feefd9e86ba622fb90f798fbb38f924a4
-
Filesize
194B
MD5921eb09689ddad27942e560e008237d7
SHA1fd62665c78204d8ae55cd27a10b7b87e0c1ba8c2
SHA2562aface0421f4ea6ba80526bb7bf9b8854d6c31109ce524c38a3927d33bb1e85b
SHA512b1f431ef038d9c48e9142dd06620512327267f1b0c41eff29643a04ace32607d4ea9694a522caccebe32e347baec98ffe8c3439d80477d3a9918b3de884b2450
-
Filesize
194B
MD596df8905e447a24e286a1beeed5a826a
SHA1b73163466dc8d9eaef12f27ce1c4668b2e949ae8
SHA256728206dfcbe91a82ca89545dde0fab694ee8d20e7a84d08afc5026daa52ee42b
SHA512b92948d0c42d901dd8a2630bbcdaf47275550befc437315ff1cc8d64b5d31607708c69f2cdc0277e71126e0cec114157641e2570f53ef084a5c365dffa43cc66
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
194B
MD516797dd5923988899c51d193f840c209
SHA15a26cad62a707570b56c26bb68973f46b65e1147
SHA25680a506bbb3daa88fffdd021f2136b543a2dc58c1e64dd50278ad4e8393dfd452
SHA512075f1189e81cb35bcbd3fea02d8611f49500aa92d76b2442a8dfb1a32732e198e7a12ac46fed19bcb69e688b1d4abfbe4c4049842bd2c0247d893d9d73f76982
-
Filesize
194B
MD5bef3799d77800687a817eafcf78f9047
SHA10fcdbf417df1490ee8681ce79f31e3c474630daf
SHA256ec6015dc4c0addf74af4a3028301ebd032fd91459c30cbb24441075cf42038fd
SHA512cf683de0c9e4df90b6d5c9c88924c76b3f6ecec7362ec863b6f18544cf273c442c5998d66fdef0b42dcef773fda28db47b848356524bb7956e0b91326869c07b
-
Filesize
194B
MD5f2b028788b1dbdd99b21e4ca1dea82bb
SHA107677434733c14b261dd2e95b627882616f62d34
SHA2569521a0e2e8e72c37286cfa8e8956270f88f454ccc124eb31d108d25de3f3c965
SHA512d60458a0603037c97490580ca76f64f6ced15ea37a3c98bfdf30708e8b7173fbf9761dae8a385e3553c49b5fdd34b9769799f3f6b7b8000948f6e64ba2cd147a
-
Filesize
194B
MD534763d5ca7494863d4fc228e1ea049a5
SHA168ba83d0d5220b627a944dff9a8661368398d321
SHA256a41abff7f4e401e59be74704e269d561cae82c8a8d3dd10435e3dc6f2e2529ce
SHA512656bde42b0cd5ac57e926767b0e4764934f6def221b78a882ff90d15cbcc837e031ad2acc1c1223c09fd64a49a897c7c6afc89bb706df17fe3ea48bc9318731c
-
Filesize
194B
MD503c01eb1908beee2d26773dde58d34c3
SHA1c28be3877d8f1eda4a6fb61204c871f6c431d629
SHA2564c66b0fb76dfb9df60917715b646a209ebe46a681b48b48ac5780f72d075fa03
SHA512cf5d2c6b722f89e7566b6b5d37405411b0d9db833db832ff9f38504e08a2ea23ffebbe964d1d5d4d21b0fcf3d31e7fcd97f65ae264eba6974aa009dcb17afba5
-
Filesize
194B
MD529d1d67ae328e7aa296f8474a39e8f3d
SHA109e5054c2bd02d9ca9dab2f6949ba142e8391c9a
SHA256d6ea6b73990b67fbc3d4bd46e1bfa5f2f306a287d50b7f7e0d2c3c56d13dba2e
SHA512ab511ab76b043f10c3ccf0e5145963b82b7dce8720e5341629e8ffca39061731ba9376dad5be0ca491b9bdefc7ebc78050d80bec677f132d1fc26cbc3c47ed79
-
Filesize
194B
MD5363cfdb3747f13a74ab6b4e542e37c87
SHA147fae0b84e21f33cc10ef65341764c942714470f
SHA256d290c43f0d80dda7468c0d91deb623d86c01bc84afa0f8a227e1dda89260c068
SHA5122e71b7b46934edfedc4b9932c897fd3af0b5a52c48bbdfe461a3125f2579c41a75860729f2ba3104389599d91ef197d1ee5e0776240cdf4bbeba8b4c23979c3f
-
Filesize
36B
MD56783c3ee07c7d151ceac57f1f9c8bed7
SHA117468f98f95bf504cc1f83c49e49a78526b3ea03
SHA2568ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322
SHA512c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8
-
Filesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
Filesize
197B
MD58088241160261560a02c84025d107592
SHA1083121f7027557570994c9fc211df61730455bb5
SHA2562072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1
SHA51220d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478