Analysis
-
max time kernel
146s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2024, 17:31
Behavioral task
behavioral1
Sample
JaffaCakes118_d8b45a0c6bbd494449eacaf19a4f958ebedd37d4b5f5fef8c2da0177ea025c3c.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_d8b45a0c6bbd494449eacaf19a4f958ebedd37d4b5f5fef8c2da0177ea025c3c.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_d8b45a0c6bbd494449eacaf19a4f958ebedd37d4b5f5fef8c2da0177ea025c3c.exe
-
Size
1.3MB
-
MD5
54de6db97b6c682feee9765103b272c9
-
SHA1
a0cb252a6323f97663cd3b1eec75db2c3ab8d319
-
SHA256
d8b45a0c6bbd494449eacaf19a4f958ebedd37d4b5f5fef8c2da0177ea025c3c
-
SHA512
c71dd8e04faf10ffdce681f970529e47551e31eb29d639a275f4654e7bb4f0fe29f9a6a402ca9a2e18e957ad1fe4b467b7e13af38ae32cec52f83efdcdb1fe02
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Process spawned unexpected child process 6 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1204 1296 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1884 1296 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4056 1296 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4796 1296 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1496 1296 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2756 1296 schtasks.exe 86 -
resource yara_rule behavioral2/files/0x0007000000023c88-10.dat dcrat behavioral2/memory/544-13-0x00000000002F0000-0x0000000000400000-memory.dmp dcrat -
Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 3156 powershell.exe 4792 powershell.exe 2120 powershell.exe -
Checks computer location settings 2 TTPs 15 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation smss.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation smss.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation smss.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation smss.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation smss.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation smss.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation smss.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation DllCommonsvc.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation smss.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation smss.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation smss.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation smss.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation JaffaCakes118_d8b45a0c6bbd494449eacaf19a4f958ebedd37d4b5f5fef8c2da0177ea025c3c.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation smss.exe -
Executes dropped EXE 14 IoCs
pid Process 544 DllCommonsvc.exe 5088 smss.exe 2456 smss.exe 464 smss.exe 3040 smss.exe 512 smss.exe 2084 smss.exe 4552 smss.exe 5036 smss.exe 400 smss.exe 1184 smss.exe 644 smss.exe 3500 smss.exe 4884 smss.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 13 IoCs
flow ioc 22 raw.githubusercontent.com 27 raw.githubusercontent.com 30 raw.githubusercontent.com 52 raw.githubusercontent.com 53 raw.githubusercontent.com 11 raw.githubusercontent.com 14 raw.githubusercontent.com 33 raw.githubusercontent.com 40 raw.githubusercontent.com 41 raw.githubusercontent.com 51 raw.githubusercontent.com 12 raw.githubusercontent.com 32 raw.githubusercontent.com -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\38384e6a620884 DllCommonsvc.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\SearchApp.exe DllCommonsvc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_d8b45a0c6bbd494449eacaf19a4f958ebedd37d4b5f5fef8c2da0177ea025c3c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies registry class 14 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings smss.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings smss.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings smss.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings smss.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings smss.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings smss.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings smss.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings smss.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings smss.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings JaffaCakes118_d8b45a0c6bbd494449eacaf19a4f958ebedd37d4b5f5fef8c2da0177ea025c3c.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings smss.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings smss.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings DllCommonsvc.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings smss.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4056 schtasks.exe 4796 schtasks.exe 1496 schtasks.exe 2756 schtasks.exe 1204 schtasks.exe 1884 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 544 DllCommonsvc.exe 2120 powershell.exe 3156 powershell.exe 4792 powershell.exe 2120 powershell.exe 3156 powershell.exe 4792 powershell.exe 5088 smss.exe 2456 smss.exe 464 smss.exe 3040 smss.exe 512 smss.exe 2084 smss.exe 4552 smss.exe 5036 smss.exe 400 smss.exe 1184 smss.exe 644 smss.exe 3500 smss.exe 4884 smss.exe -
Suspicious use of AdjustPrivilegeToken 17 IoCs
description pid Process Token: SeDebugPrivilege 544 DllCommonsvc.exe Token: SeDebugPrivilege 2120 powershell.exe Token: SeDebugPrivilege 3156 powershell.exe Token: SeDebugPrivilege 4792 powershell.exe Token: SeDebugPrivilege 5088 smss.exe Token: SeDebugPrivilege 2456 smss.exe Token: SeDebugPrivilege 464 smss.exe Token: SeDebugPrivilege 3040 smss.exe Token: SeDebugPrivilege 512 smss.exe Token: SeDebugPrivilege 2084 smss.exe Token: SeDebugPrivilege 4552 smss.exe Token: SeDebugPrivilege 5036 smss.exe Token: SeDebugPrivilege 400 smss.exe Token: SeDebugPrivilege 1184 smss.exe Token: SeDebugPrivilege 644 smss.exe Token: SeDebugPrivilege 3500 smss.exe Token: SeDebugPrivilege 4884 smss.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3268 wrote to memory of 1652 3268 JaffaCakes118_d8b45a0c6bbd494449eacaf19a4f958ebedd37d4b5f5fef8c2da0177ea025c3c.exe 82 PID 3268 wrote to memory of 1652 3268 JaffaCakes118_d8b45a0c6bbd494449eacaf19a4f958ebedd37d4b5f5fef8c2da0177ea025c3c.exe 82 PID 3268 wrote to memory of 1652 3268 JaffaCakes118_d8b45a0c6bbd494449eacaf19a4f958ebedd37d4b5f5fef8c2da0177ea025c3c.exe 82 PID 1652 wrote to memory of 4824 1652 WScript.exe 83 PID 1652 wrote to memory of 4824 1652 WScript.exe 83 PID 1652 wrote to memory of 4824 1652 WScript.exe 83 PID 4824 wrote to memory of 544 4824 cmd.exe 85 PID 4824 wrote to memory of 544 4824 cmd.exe 85 PID 544 wrote to memory of 3156 544 DllCommonsvc.exe 93 PID 544 wrote to memory of 3156 544 DllCommonsvc.exe 93 PID 544 wrote to memory of 4792 544 DllCommonsvc.exe 94 PID 544 wrote to memory of 4792 544 DllCommonsvc.exe 94 PID 544 wrote to memory of 2120 544 DllCommonsvc.exe 95 PID 544 wrote to memory of 2120 544 DllCommonsvc.exe 95 PID 544 wrote to memory of 3520 544 DllCommonsvc.exe 99 PID 544 wrote to memory of 3520 544 DllCommonsvc.exe 99 PID 3520 wrote to memory of 4692 3520 cmd.exe 101 PID 3520 wrote to memory of 4692 3520 cmd.exe 101 PID 3520 wrote to memory of 5088 3520 cmd.exe 102 PID 3520 wrote to memory of 5088 3520 cmd.exe 102 PID 5088 wrote to memory of 3140 5088 smss.exe 103 PID 5088 wrote to memory of 3140 5088 smss.exe 103 PID 3140 wrote to memory of 3444 3140 cmd.exe 105 PID 3140 wrote to memory of 3444 3140 cmd.exe 105 PID 3140 wrote to memory of 2456 3140 cmd.exe 106 PID 3140 wrote to memory of 2456 3140 cmd.exe 106 PID 2456 wrote to memory of 3488 2456 smss.exe 111 PID 2456 wrote to memory of 3488 2456 smss.exe 111 PID 3488 wrote to memory of 3204 3488 cmd.exe 113 PID 3488 wrote to memory of 3204 3488 cmd.exe 113 PID 3488 wrote to memory of 464 3488 cmd.exe 117 PID 3488 wrote to memory of 464 3488 cmd.exe 117 PID 464 wrote to memory of 2308 464 smss.exe 118 PID 464 wrote to memory of 2308 464 smss.exe 118 PID 2308 wrote to memory of 4796 2308 cmd.exe 120 PID 2308 wrote to memory of 4796 2308 cmd.exe 120 PID 2308 wrote to memory of 3040 2308 cmd.exe 121 PID 2308 wrote to memory of 3040 2308 cmd.exe 121 PID 3040 wrote to memory of 2116 3040 smss.exe 122 PID 3040 wrote to memory of 2116 3040 smss.exe 122 PID 2116 wrote to memory of 624 2116 cmd.exe 124 PID 2116 wrote to memory of 624 2116 cmd.exe 124 PID 2116 wrote to memory of 512 2116 cmd.exe 125 PID 2116 wrote to memory of 512 2116 cmd.exe 125 PID 512 wrote to memory of 1196 512 smss.exe 126 PID 512 wrote to memory of 1196 512 smss.exe 126 PID 1196 wrote to memory of 2904 1196 cmd.exe 128 PID 1196 wrote to memory of 2904 1196 cmd.exe 128 PID 1196 wrote to memory of 2084 1196 cmd.exe 129 PID 1196 wrote to memory of 2084 1196 cmd.exe 129 PID 2084 wrote to memory of 2728 2084 smss.exe 130 PID 2084 wrote to memory of 2728 2084 smss.exe 130 PID 2728 wrote to memory of 3520 2728 cmd.exe 132 PID 2728 wrote to memory of 3520 2728 cmd.exe 132 PID 2728 wrote to memory of 4552 2728 cmd.exe 133 PID 2728 wrote to memory of 4552 2728 cmd.exe 133 PID 4552 wrote to memory of 2136 4552 smss.exe 134 PID 4552 wrote to memory of 2136 4552 smss.exe 134 PID 2136 wrote to memory of 1576 2136 cmd.exe 136 PID 2136 wrote to memory of 1576 2136 cmd.exe 136 PID 2136 wrote to memory of 5036 2136 cmd.exe 137 PID 2136 wrote to memory of 5036 2136 cmd.exe 137 PID 5036 wrote to memory of 4524 5036 smss.exe 138 PID 5036 wrote to memory of 4524 5036 smss.exe 138 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d8b45a0c6bbd494449eacaf19a4f958ebedd37d4b5f5fef8c2da0177ea025c3c.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d8b45a0c6bbd494449eacaf19a4f958ebedd37d4b5f5fef8c2da0177ea025c3c.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3268 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\providercommon\DllCommonsvc.exe"C:\providercommon\DllCommonsvc.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:544 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3156
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\smss.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4792
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\SearchApp.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2120
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\LMwQffnTI8.bat"5⤵
- Suspicious use of WriteProcessMemory
PID:3520 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:26⤵PID:4692
-
-
C:\Recovery\WindowsRE\smss.exe"C:\Recovery\WindowsRE\smss.exe"6⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\WtQmBjXbDh.bat"7⤵
- Suspicious use of WriteProcessMemory
PID:3140 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:28⤵PID:3444
-
-
C:\Recovery\WindowsRE\smss.exe"C:\Recovery\WindowsRE\smss.exe"8⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\5G5G1KH0qy.bat"9⤵
- Suspicious use of WriteProcessMemory
PID:3488 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:210⤵PID:3204
-
-
C:\Recovery\WindowsRE\smss.exe"C:\Recovery\WindowsRE\smss.exe"10⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:464 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\pdW26R6SPG.bat"11⤵
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:212⤵PID:4796
-
-
C:\Recovery\WindowsRE\smss.exe"C:\Recovery\WindowsRE\smss.exe"12⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\TdlfhXh7Yo.bat"13⤵
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:214⤵PID:624
-
-
C:\Recovery\WindowsRE\smss.exe"C:\Recovery\WindowsRE\smss.exe"14⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:512 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\mNrvcGFykN.bat"15⤵
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:216⤵PID:2904
-
-
C:\Recovery\WindowsRE\smss.exe"C:\Recovery\WindowsRE\smss.exe"16⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\mWzz7cjAeP.bat"17⤵
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:218⤵PID:3520
-
-
C:\Recovery\WindowsRE\smss.exe"C:\Recovery\WindowsRE\smss.exe"18⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\WtQmBjXbDh.bat"19⤵
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:220⤵PID:1576
-
-
C:\Recovery\WindowsRE\smss.exe"C:\Recovery\WindowsRE\smss.exe"20⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\PliZKNaLvF.bat"21⤵PID:4524
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:222⤵PID:1572
-
-
C:\Recovery\WindowsRE\smss.exe"C:\Recovery\WindowsRE\smss.exe"22⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:400 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Rhkc0SdEF2.bat"23⤵PID:1888
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:224⤵PID:4192
-
-
C:\Recovery\WindowsRE\smss.exe"C:\Recovery\WindowsRE\smss.exe"24⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1184 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\mNrvcGFykN.bat"25⤵PID:1136
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:226⤵PID:2884
-
-
C:\Recovery\WindowsRE\smss.exe"C:\Recovery\WindowsRE\smss.exe"26⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:644 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\H7kUlUtrsw.bat"27⤵PID:4020
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:228⤵PID:1192
-
-
C:\Recovery\WindowsRE\smss.exe"C:\Recovery\WindowsRE\smss.exe"28⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3500 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\J2mXRZwkCj.bat"29⤵PID:4868
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:230⤵PID:2340
-
-
C:\Recovery\WindowsRE\smss.exe"C:\Recovery\WindowsRE\smss.exe"30⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4884
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\smss.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1204
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1884
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4056
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\SearchApp.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4796
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\SearchApp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1496
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\SearchApp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2756
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
1KB
MD5baf55b95da4a601229647f25dad12878
SHA1abc16954ebfd213733c4493fc1910164d825cac8
SHA256ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
SHA51224f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545
-
Filesize
944B
MD5d28a889fd956d5cb3accfbaf1143eb6f
SHA1157ba54b365341f8ff06707d996b3635da8446f7
SHA25621e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45
SHA5120b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c
-
Filesize
195B
MD5d02306d4f1bcd6401a234e3625134351
SHA11d0df5990a0768b5f31938d35119cbb602a17d36
SHA256dc1cbd15e208ca6a09b03219eda4b954434987e0c440fe3667d8e9d3ee08f2d7
SHA512adb9ff7b04d9922beda3ab8d8a3129cf3ea88b9ab3c0f317114b33a1887f0ecc8832955f943b32e1d0bf366efb977fffb88e845a7eff41a394ba5a453a9cbd19
-
Filesize
195B
MD5959c3432d98c57a76696865b35dcc58e
SHA1ac724f40b832d0074fc6f9ccc553a4e1117d3543
SHA256edb38ed3f6dba9524dfcb6f9b7e493d486eba299e7d63a6900b7994807b78bf0
SHA5120f2dc66efaf21d9c25324d300594667314555ea020092c812e198e641848db4fc749ecee866c6945039592d4fa40dd9afe0dba6a85e6661e127c1b89d9814eb9
-
Filesize
195B
MD55bc8535a90df1e43cfff798f7a9ca99f
SHA19942cdfe3ef2c0eb6018f375695587d6d87f9764
SHA256164afb959084a005121f6936865e1a1c0061ce4007f68952ec19905f4500f9b1
SHA51294667aacb616ad634396977d6434cb18b75ec959ac575fb226ba525fcf9a585060c6184a106b83c31681c715bd1ef128bbd6cea681403588973df4a253b06c26
-
Filesize
195B
MD5b908d78cec6d850a0893bff54f3ea53e
SHA1053217d6e693c3fba31e5e3184cef8f060da0528
SHA2566ff35d53a1cf6ac300c82bf4fff877b5f5d1d648dbf25281be3900d52a527384
SHA51287255553e4caf5a2f970f91ae007645b52db65f1db4afb8b742a7c5a0244355e8da4af97e5a374641ca878b9285b088463b7a3f9c647d7053ac38fecd3376a7c
-
Filesize
195B
MD5624f580271132466a038b78084bf50e8
SHA15def39528d2d79ac9383003d439a4079483876a3
SHA2560a415f1129a28f4b27ad2f5397d71f6c4060791a50ff8ee68db44d287376bb2f
SHA5128d6148df8a05974e5c6ba017865bb41ea1c2ca4c37103b601af55e70909cfef002d1f5a859c82b58ccb8d6ace6eaea56ec9521d4dc31f7bff160f3e992a0a128
-
Filesize
195B
MD5cec7b0297c746e6cb4b43c8050e6b4e6
SHA1e7c9f7da4e62e625673078d464fcd54d208cc152
SHA256a33b2bb92f1437c76628af9cf459a3ec5315e84fcc1aa30c8e30eb2c8e3f8f7a
SHA512441ab1f269673f7ad4a805c3e7ad73adb01cd53a645286a032e9a4cf58df22b2ffc04a5ef141dd9844d1be124bf1c2643bc847a62980751f073bb3bf389956b4
-
Filesize
195B
MD56dac6e1b044f84d8ba6c23c0b7e6b58b
SHA17d4e1e6ed89317c764a942e29e0e2335e504634b
SHA256a5b1557a0adb0d742314a2a649b0f7c4719f7e46308c117abd140f31720eef48
SHA512b5ce20c45bfd7e04d156d8e3604ece4e1f3e5f255aeb09bf30ed16777e19f9b60f21e7208ad1798e068818bfb4b92866ecd81cb2e90a9e393b58458372a5971d
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
195B
MD595ffb247497c48899c4ac31a84c96b4b
SHA1e7a4ed68cebd5665cd26c4c6a32dc4a6f63619f9
SHA25679385564e642cb89f7027e8d6c7408d43a862ac58445375f5449c124453184ad
SHA512f80b096af9ab840d888e1f893bfe2d4625e63e125dd4a36966a137cb062e5b76efa28194d2540ae0f876596970a85f87e7a1daed49e7a9663e2450e2775e72f5
-
Filesize
195B
MD587141d0618ebd2bd9ae2e998774d1ecb
SHA1ef053e30876db0fc998e9b13c47b8443afaac24c
SHA2561c101050b1c504430165de836faa5a22a55d68b4844933df5e6edcc38a60216a
SHA512afb3af0d7b5ae7b5de33e408cbee5a7c3ca11d63d8758cb51916fc10395bb01ec2f3dca1326a44faa8b33139843c601b220b8f54acf30a418c39283a7f0cd332
-
Filesize
195B
MD5e174f8842222cbe014e945b93c1be9d8
SHA1938945e0c94df7915b5b7d57a7ed7cf476b71a2d
SHA256243ca7847f344e315b3446cc5c6c771fef4d1f27147e3cf677774b67bbf6725c
SHA512c7fd0229d3a88eadf345cdbfb9842f9194123d1c590979d2b1776039b11205e6061294cf31dcba6530b631c459e5f00e21a56cca4d7ae24591f8f60c1e903ae2
-
Filesize
36B
MD56783c3ee07c7d151ceac57f1f9c8bed7
SHA117468f98f95bf504cc1f83c49e49a78526b3ea03
SHA2568ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322
SHA512c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8
-
Filesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
Filesize
197B
MD58088241160261560a02c84025d107592
SHA1083121f7027557570994c9fc211df61730455bb5
SHA2562072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1
SHA51220d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478