Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2024, 17:29
Behavioral task
behavioral1
Sample
JaffaCakes118_adf79dfd7aa3ca6c8b128933eb74bb16317bb0c9143005dca57907a9a112acd6.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
JaffaCakes118_adf79dfd7aa3ca6c8b128933eb74bb16317bb0c9143005dca57907a9a112acd6.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_adf79dfd7aa3ca6c8b128933eb74bb16317bb0c9143005dca57907a9a112acd6.exe
-
Size
1.3MB
-
MD5
ce93576e0a5b44f4aeb32124bd140460
-
SHA1
99c15083ece325958a02c176abb6a74935c00960
-
SHA256
adf79dfd7aa3ca6c8b128933eb74bb16317bb0c9143005dca57907a9a112acd6
-
SHA512
6046d3a6eafce983bfe67f1eb6eb20f34155a4d427847e1a8c984ab67299c01db422a4d328ab796c290fc7bde3f061d727d5133850b7640d2eb8b7b76f693fff
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Process spawned unexpected child process 6 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 264 1208 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3424 1208 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3700 1208 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1936 1208 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4920 1208 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4684 1208 schtasks.exe 90 -
resource yara_rule behavioral2/files/0x0007000000023c87-10.dat dcrat behavioral2/memory/4676-13-0x0000000000200000-0x0000000000310000-memory.dmp dcrat -
Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 4464 powershell.exe 4556 powershell.exe 1704 powershell.exe -
Checks computer location settings 2 TTPs 14 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation sysmon.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation sysmon.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation JaffaCakes118_adf79dfd7aa3ca6c8b128933eb74bb16317bb0c9143005dca57907a9a112acd6.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation sysmon.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation sysmon.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation sysmon.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation sysmon.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation sysmon.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation sysmon.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation DllCommonsvc.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation sysmon.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation sysmon.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation sysmon.exe -
Executes dropped EXE 13 IoCs
pid Process 4676 DllCommonsvc.exe 3988 sysmon.exe 4788 sysmon.exe 388 sysmon.exe 4464 sysmon.exe 2720 sysmon.exe 1808 sysmon.exe 4976 sysmon.exe 2884 sysmon.exe 4328 sysmon.exe 2324 sysmon.exe 3580 sysmon.exe 1848 sysmon.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 12 IoCs
flow ioc 18 raw.githubusercontent.com 42 raw.githubusercontent.com 43 raw.githubusercontent.com 50 raw.githubusercontent.com 51 raw.githubusercontent.com 48 raw.githubusercontent.com 49 raw.githubusercontent.com 13 raw.githubusercontent.com 14 raw.githubusercontent.com 37 raw.githubusercontent.com 39 raw.githubusercontent.com 44 raw.githubusercontent.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_adf79dfd7aa3ca6c8b128933eb74bb16317bb0c9143005dca57907a9a112acd6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies registry class 13 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings sysmon.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings sysmon.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings sysmon.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings sysmon.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings sysmon.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings sysmon.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings sysmon.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings DllCommonsvc.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings sysmon.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings sysmon.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings sysmon.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings sysmon.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings JaffaCakes118_adf79dfd7aa3ca6c8b128933eb74bb16317bb0c9143005dca57907a9a112acd6.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 264 schtasks.exe 3424 schtasks.exe 3700 schtasks.exe 1936 schtasks.exe 4920 schtasks.exe 4684 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 19 IoCs
pid Process 4676 DllCommonsvc.exe 4556 powershell.exe 1704 powershell.exe 1704 powershell.exe 4464 powershell.exe 4556 powershell.exe 4464 powershell.exe 3988 sysmon.exe 4788 sysmon.exe 388 sysmon.exe 4464 sysmon.exe 2720 sysmon.exe 1808 sysmon.exe 4976 sysmon.exe 2884 sysmon.exe 4328 sysmon.exe 2324 sysmon.exe 3580 sysmon.exe 1848 sysmon.exe -
Suspicious use of AdjustPrivilegeToken 16 IoCs
description pid Process Token: SeDebugPrivilege 4676 DllCommonsvc.exe Token: SeDebugPrivilege 4556 powershell.exe Token: SeDebugPrivilege 1704 powershell.exe Token: SeDebugPrivilege 4464 powershell.exe Token: SeDebugPrivilege 3988 sysmon.exe Token: SeDebugPrivilege 4788 sysmon.exe Token: SeDebugPrivilege 388 sysmon.exe Token: SeDebugPrivilege 4464 sysmon.exe Token: SeDebugPrivilege 2720 sysmon.exe Token: SeDebugPrivilege 1808 sysmon.exe Token: SeDebugPrivilege 4976 sysmon.exe Token: SeDebugPrivilege 2884 sysmon.exe Token: SeDebugPrivilege 4328 sysmon.exe Token: SeDebugPrivilege 2324 sysmon.exe Token: SeDebugPrivilege 3580 sysmon.exe Token: SeDebugPrivilege 1848 sysmon.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1224 wrote to memory of 548 1224 JaffaCakes118_adf79dfd7aa3ca6c8b128933eb74bb16317bb0c9143005dca57907a9a112acd6.exe 85 PID 1224 wrote to memory of 548 1224 JaffaCakes118_adf79dfd7aa3ca6c8b128933eb74bb16317bb0c9143005dca57907a9a112acd6.exe 85 PID 1224 wrote to memory of 548 1224 JaffaCakes118_adf79dfd7aa3ca6c8b128933eb74bb16317bb0c9143005dca57907a9a112acd6.exe 85 PID 548 wrote to memory of 2480 548 WScript.exe 87 PID 548 wrote to memory of 2480 548 WScript.exe 87 PID 548 wrote to memory of 2480 548 WScript.exe 87 PID 2480 wrote to memory of 4676 2480 cmd.exe 89 PID 2480 wrote to memory of 4676 2480 cmd.exe 89 PID 4676 wrote to memory of 4464 4676 DllCommonsvc.exe 98 PID 4676 wrote to memory of 4464 4676 DllCommonsvc.exe 98 PID 4676 wrote to memory of 4556 4676 DllCommonsvc.exe 99 PID 4676 wrote to memory of 4556 4676 DllCommonsvc.exe 99 PID 4676 wrote to memory of 1704 4676 DllCommonsvc.exe 100 PID 4676 wrote to memory of 1704 4676 DllCommonsvc.exe 100 PID 4676 wrote to memory of 1968 4676 DllCommonsvc.exe 104 PID 4676 wrote to memory of 1968 4676 DllCommonsvc.exe 104 PID 1968 wrote to memory of 4420 1968 cmd.exe 106 PID 1968 wrote to memory of 4420 1968 cmd.exe 106 PID 1968 wrote to memory of 3988 1968 cmd.exe 108 PID 1968 wrote to memory of 3988 1968 cmd.exe 108 PID 3988 wrote to memory of 3808 3988 sysmon.exe 110 PID 3988 wrote to memory of 3808 3988 sysmon.exe 110 PID 3808 wrote to memory of 3088 3808 cmd.exe 112 PID 3808 wrote to memory of 3088 3808 cmd.exe 112 PID 3808 wrote to memory of 4788 3808 cmd.exe 114 PID 3808 wrote to memory of 4788 3808 cmd.exe 114 PID 4788 wrote to memory of 1216 4788 sysmon.exe 118 PID 4788 wrote to memory of 1216 4788 sysmon.exe 118 PID 1216 wrote to memory of 4592 1216 cmd.exe 120 PID 1216 wrote to memory of 4592 1216 cmd.exe 120 PID 1216 wrote to memory of 388 1216 cmd.exe 130 PID 1216 wrote to memory of 388 1216 cmd.exe 130 PID 388 wrote to memory of 4568 388 sysmon.exe 136 PID 388 wrote to memory of 4568 388 sysmon.exe 136 PID 4568 wrote to memory of 432 4568 cmd.exe 138 PID 4568 wrote to memory of 432 4568 cmd.exe 138 PID 4568 wrote to memory of 4464 4568 cmd.exe 140 PID 4568 wrote to memory of 4464 4568 cmd.exe 140 PID 4464 wrote to memory of 396 4464 sysmon.exe 142 PID 4464 wrote to memory of 396 4464 sysmon.exe 142 PID 396 wrote to memory of 2364 396 cmd.exe 144 PID 396 wrote to memory of 2364 396 cmd.exe 144 PID 396 wrote to memory of 2720 396 cmd.exe 146 PID 396 wrote to memory of 2720 396 cmd.exe 146 PID 2720 wrote to memory of 5068 2720 sysmon.exe 148 PID 2720 wrote to memory of 5068 2720 sysmon.exe 148 PID 5068 wrote to memory of 2960 5068 cmd.exe 150 PID 5068 wrote to memory of 2960 5068 cmd.exe 150 PID 5068 wrote to memory of 1808 5068 cmd.exe 152 PID 5068 wrote to memory of 1808 5068 cmd.exe 152 PID 1808 wrote to memory of 1772 1808 sysmon.exe 154 PID 1808 wrote to memory of 1772 1808 sysmon.exe 154 PID 1772 wrote to memory of 1188 1772 cmd.exe 156 PID 1772 wrote to memory of 1188 1772 cmd.exe 156 PID 1772 wrote to memory of 4976 1772 cmd.exe 158 PID 1772 wrote to memory of 4976 1772 cmd.exe 158 PID 4976 wrote to memory of 2336 4976 sysmon.exe 160 PID 4976 wrote to memory of 2336 4976 sysmon.exe 160 PID 2336 wrote to memory of 2464 2336 cmd.exe 162 PID 2336 wrote to memory of 2464 2336 cmd.exe 162 PID 2336 wrote to memory of 2884 2336 cmd.exe 164 PID 2336 wrote to memory of 2884 2336 cmd.exe 164 PID 2884 wrote to memory of 4656 2884 sysmon.exe 166 PID 2884 wrote to memory of 4656 2884 sysmon.exe 166 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_adf79dfd7aa3ca6c8b128933eb74bb16317bb0c9143005dca57907a9a112acd6.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_adf79dfd7aa3ca6c8b128933eb74bb16317bb0c9143005dca57907a9a112acd6.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:548 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\providercommon\DllCommonsvc.exe"C:\providercommon\DllCommonsvc.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4464
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\sysmon.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4556
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\Idle.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1704
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\O0sfLhFaf1.bat"5⤵
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:26⤵PID:4420
-
-
C:\Recovery\WindowsRE\sysmon.exe"C:\Recovery\WindowsRE\sysmon.exe"6⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3988 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\7lFc7N4hi3.bat"7⤵
- Suspicious use of WriteProcessMemory
PID:3808 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:28⤵PID:3088
-
-
C:\Recovery\WindowsRE\sysmon.exe"C:\Recovery\WindowsRE\sysmon.exe"8⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\12JaEZR6zX.bat"9⤵
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:210⤵PID:4592
-
-
C:\Recovery\WindowsRE\sysmon.exe"C:\Recovery\WindowsRE\sysmon.exe"10⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:388 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\fH1ASKIIFN.bat"11⤵
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:212⤵PID:432
-
-
C:\Recovery\WindowsRE\sysmon.exe"C:\Recovery\WindowsRE\sysmon.exe"12⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\syYKg8QxNI.bat"13⤵
- Suspicious use of WriteProcessMemory
PID:396 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:214⤵PID:2364
-
-
C:\Recovery\WindowsRE\sysmon.exe"C:\Recovery\WindowsRE\sysmon.exe"14⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\QOz0umrEhM.bat"15⤵
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:216⤵PID:2960
-
-
C:\Recovery\WindowsRE\sysmon.exe"C:\Recovery\WindowsRE\sysmon.exe"16⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\HfroAScfQF.bat"17⤵
- Suspicious use of WriteProcessMemory
PID:1772 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:218⤵PID:1188
-
-
C:\Recovery\WindowsRE\sysmon.exe"C:\Recovery\WindowsRE\sysmon.exe"18⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\q3WH03M43W.bat"19⤵
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:220⤵PID:2464
-
-
C:\Recovery\WindowsRE\sysmon.exe"C:\Recovery\WindowsRE\sysmon.exe"20⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\yvlYFj4oEg.bat"21⤵PID:4656
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:222⤵PID:1656
-
-
C:\Recovery\WindowsRE\sysmon.exe"C:\Recovery\WindowsRE\sysmon.exe"22⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4328 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\8pOjIocmws.bat"23⤵PID:1624
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:224⤵PID:3112
-
-
C:\Recovery\WindowsRE\sysmon.exe"C:\Recovery\WindowsRE\sysmon.exe"24⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2324 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\syYKg8QxNI.bat"25⤵PID:2656
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:226⤵PID:3208
-
-
C:\Recovery\WindowsRE\sysmon.exe"C:\Recovery\WindowsRE\sysmon.exe"26⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3580 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\FjqlTNZm6T.bat"27⤵PID:1512
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:228⤵PID:4308
-
-
C:\Recovery\WindowsRE\sysmon.exe"C:\Recovery\WindowsRE\sysmon.exe"28⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1848
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmons" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\sysmon.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:264
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sysmon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3424
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmons" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\sysmon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3700
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\providercommon\Idle.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1936
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\providercommon\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4920
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\providercommon\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4684
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
1KB
MD5baf55b95da4a601229647f25dad12878
SHA1abc16954ebfd213733c4493fc1910164d825cac8
SHA256ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
SHA51224f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545
-
Filesize
944B
MD577d622bb1a5b250869a3238b9bc1402b
SHA1d47f4003c2554b9dfc4c16f22460b331886b191b
SHA256f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb
SHA512d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9
-
Filesize
197B
MD5c3e50624450172fd4a4ad80bbc62bbf4
SHA10517fed4fde68f20bdb4fb420dfc3dd8042283fe
SHA256031548244c02de15f54087e8a9ca06858c41d657a7b3956aaf97d4bf7dad1ac7
SHA512b83c6e4cac411e017e793ca74fb6ff128bb4666ba7f027c4ae5c108705c5d5375a35e1fb98814de80635d43054cd7b7a2d2e93d0f8f604f3ddf61a9c1102beab
-
Filesize
197B
MD53c710f3d338a11700f91b03eac8fbeb6
SHA1e3b2ea73bad835648f8f40d5823ff2a7ca27437a
SHA256d36ee1b9871f28f755a7b281aa2a5d1e95a83f70b6fcbd0d1f4c50445f35516f
SHA512cb5cc52c790f52b80cfccf2070cfb5259c4a25dbe176c9c45ee0096c9e25b6f6ad353c235b2ca0297d6c537dec72ce3b898b3772ba10b666a59a1b98174de426
-
Filesize
197B
MD5e83c5ebb7dfcd8d962fcf30f340dcaf3
SHA1ee6688247b2bb278d45048d3d8b3d2e8e54cdbb1
SHA2567979f22e71a86a6e8a0df50a63c0760804710cdc6e75aa4703a56c11d86e6c5c
SHA512f218b16a9cb5e8bf5cbc66b8c45b7cf34d8212b9992a3c38d78d689e6a4a22bff6801ac4408de041f6fa80b501607452c242e3da6cfb48f2c5aa8ce16deea9df
-
Filesize
197B
MD550813804bce18d6ff964ce02a171e555
SHA1749a2e4c5a29cc7742fed2a53e8fd30573c46fa9
SHA256931a510a7681beb1cb20298c57af94b4a53efe7ed070bcf55ea3998874788df6
SHA512d830dd33bbed9b0a2724826191e24321c46d8fdaa562c49a21cff4ba3ed5bec7e41bd8b8694c1a8a8de5da722da58e09537e87a00053de7482eeedf15e97fc91
-
Filesize
197B
MD5889ea6a55c2ba2008d9b17cc1d100990
SHA157316fba743eb0681088399b0c6879e1e40fd96d
SHA2569522a6014ddd691af4b252e6d0b61d2619603dc6e1ee5c05063f0ba1cec447f7
SHA5120eae4757cd3f4151c11a2f42404cae5e86f2466bdcc4ba3a1202e3c29f9e08465013db439211c0d0c12d12cd429c97563532905fe6e232bc96ce3dd529d9b69e
-
Filesize
197B
MD5f8e931742c9cf6fada8bd0d79cec4b20
SHA1a6062ff5f105faff82e0a375563c96b05792dd7b
SHA25666f1a0168aee5efd4f038088d2995f212b5144568fb756d62af243d96df685fb
SHA51233b337e50666fb3f0446cf1b2c0637435061a78c62f46d7f67f61f64c807cf424405a368ba8b48e60294b6b77990c4ffd0fe9cc0ff0cf6d8852e0feb0c1e6645
-
Filesize
197B
MD5b0955d2160fb31fc3c0a15ac508172d9
SHA112211b6e58a34d302082b3f50b6e958ddae494d4
SHA256b60a454051f17e5d66df3d4f0664e225c3e7f5e2e61b6f559a8ce0dc1d1d04e7
SHA512691e66ca267ea8aa24c357ad378bb4138589ba7f3438c059f342715142ccbd9e9a041d6c6ce47db90b27392beef91d6469582324721b6b2a73df8e145defea67
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
197B
MD52748e9be4803c2660cb4832a8f503354
SHA17b0d111c341b60db51c5cd15eed23e91242881d2
SHA2568e03661009c829c56983a1545588fd17905baaa4f89839def2dbaf8d4d8ea62e
SHA512a1d6787a08ee5b47d0a1c5a3961d0fcba48a7d5874d62a4980e3821c2bdc070a1d1d5a831e5bb0f397cdd6d2ec6b7da54c9abce3b672bebf6f6d410c2bdd8a4d
-
Filesize
197B
MD50ba31e82182d8ee583eafaf7636c5a95
SHA1358fbff30987e2d762b3f56f18a63e20afcdad47
SHA2560c5f42e609b8db5d4bce148cbb3b4b725ce1fc62e98e96e9a3528f4a92a929aa
SHA51259f385a3ac85ffe33d2c74c5c56cb4302c235bd34e9c5ffcc14d485d9fa5c90918e813deb3e408c87be541490cff194f7b1602059ba50a6f28f19d6aeb196fd5
-
Filesize
197B
MD5b5bd5816e7cac0abb3c09267cc7e0651
SHA113c9e6f8174d0b7e4e86a5e79e18ecc691bde629
SHA2566412aa913f17ac87051d8d46faed0558f51e5064a5d89bfac19e0143859bb8f1
SHA5123beb70c42af4d8f28d72f8284d1c7c92f784ca4a8faf594a2da51d2da3346bd689218d65cca7af732a403095e77b2304a742a0b16d4341008efc087dee7d6f03
-
Filesize
197B
MD5d455b176314a46f94308fb0e18987898
SHA1e93998adfc25aec4cdafb10c6fbee9d88ecfb7e7
SHA25649eb57dfc69851ab405f807592bac05191b0c3ca4c79eed56884d263329813c7
SHA51221bde938adf41b086bc851f30ff3e1cc1e32458f53c4a0e8f34d55df0dd943a7494de85edae78eecd03d331b988e2a35eaa0310b80526ca9619e350966ff8cf1
-
Filesize
36B
MD56783c3ee07c7d151ceac57f1f9c8bed7
SHA117468f98f95bf504cc1f83c49e49a78526b3ea03
SHA2568ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322
SHA512c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8
-
Filesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
Filesize
197B
MD58088241160261560a02c84025d107592
SHA1083121f7027557570994c9fc211df61730455bb5
SHA2562072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1
SHA51220d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478