Malware Analysis Report

2025-08-05 09:05

Sample ID 241230-v37rgatmcv
Target JaffaCakes118_d8b45a0c6bbd494449eacaf19a4f958ebedd37d4b5f5fef8c2da0177ea025c3c
SHA256 d8b45a0c6bbd494449eacaf19a4f958ebedd37d4b5f5fef8c2da0177ea025c3c
Tags
rat dcrat discovery execution infostealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

d8b45a0c6bbd494449eacaf19a4f958ebedd37d4b5f5fef8c2da0177ea025c3c

Threat Level: Known bad

The file JaffaCakes118_d8b45a0c6bbd494449eacaf19a4f958ebedd37d4b5f5fef8c2da0177ea025c3c was found to be: Known bad.

Malicious Activity Summary

rat dcrat discovery execution infostealer

Process spawned unexpected child process

DCRat payload

DcRat

Dcrat family

DCRat payload

Command and Scripting Interpreter: PowerShell

Loads dropped DLL

Executes dropped EXE

Checks computer location settings

Legitimate hosting services abused for malware hosting/C2

Drops file in Program Files directory

System Location Discovery: System Language Discovery

Unsigned PE

Enumerates physical storage devices

Scheduled Task/Job: Scheduled Task

Suspicious behavior: EnumeratesProcesses

Uses Task Scheduler COM API

Suspicious use of AdjustPrivilegeToken

Modifies registry class

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-12-30 17:31

Signatures

DCRat payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

Dcrat family

dcrat

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-12-30 17:31

Reported

2024-12-30 17:34

Platform

win7-20240903-en

Max time kernel

148s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d8b45a0c6bbd494449eacaf19a4f958ebedd37d4b5f5fef8c2da0177ea025c3c.exe"

Signatures

DcRat

rat infostealer dcrat

Dcrat family

dcrat

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe

DCRat payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Java\services.exe C:\providercommon\DllCommonsvc.exe N/A
File created C:\Program Files\Java\c5b4cb5e9653cc C:\providercommon\DllCommonsvc.exe N/A
File created C:\Program Files\Windows Photo Viewer\ja-JP\smss.exe C:\providercommon\DllCommonsvc.exe N/A
File created C:\Program Files\Windows Photo Viewer\ja-JP\69ddcba757bf72 C:\providercommon\DllCommonsvc.exe N/A
File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\explorer.exe C:\providercommon\DllCommonsvc.exe N/A
File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\7a0fd90576e088 C:\providercommon\DllCommonsvc.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d8b45a0c6bbd494449eacaf19a4f958ebedd37d4b5f5fef8c2da0177ea025c3c.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WScript.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\providercommon\DllCommonsvc.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\DllCommonsvc.exe N/A
N/A N/A C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\DllCommonsvc.exe N/A
N/A N/A C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\DllCommonsvc.exe N/A
N/A N/A C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\DllCommonsvc.exe N/A
N/A N/A C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\DllCommonsvc.exe N/A
N/A N/A C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\DllCommonsvc.exe N/A
N/A N/A C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\DllCommonsvc.exe N/A
N/A N/A C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\DllCommonsvc.exe N/A
N/A N/A C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\DllCommonsvc.exe N/A
N/A N/A C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\DllCommonsvc.exe N/A
N/A N/A C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\DllCommonsvc.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\providercommon\DllCommonsvc.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\DllCommonsvc.exe N/A
Token: SeDebugPrivilege N/A C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\DllCommonsvc.exe N/A
Token: SeDebugPrivilege N/A C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\DllCommonsvc.exe N/A
Token: SeDebugPrivilege N/A C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\DllCommonsvc.exe N/A
Token: SeDebugPrivilege N/A C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\DllCommonsvc.exe N/A
Token: SeDebugPrivilege N/A C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\DllCommonsvc.exe N/A
Token: SeDebugPrivilege N/A C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\DllCommonsvc.exe N/A
Token: SeDebugPrivilege N/A C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\DllCommonsvc.exe N/A
Token: SeDebugPrivilege N/A C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\DllCommonsvc.exe N/A
Token: SeDebugPrivilege N/A C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\DllCommonsvc.exe N/A
Token: SeDebugPrivilege N/A C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\DllCommonsvc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2236 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d8b45a0c6bbd494449eacaf19a4f958ebedd37d4b5f5fef8c2da0177ea025c3c.exe C:\Windows\SysWOW64\WScript.exe
PID 2236 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d8b45a0c6bbd494449eacaf19a4f958ebedd37d4b5f5fef8c2da0177ea025c3c.exe C:\Windows\SysWOW64\WScript.exe
PID 2236 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d8b45a0c6bbd494449eacaf19a4f958ebedd37d4b5f5fef8c2da0177ea025c3c.exe C:\Windows\SysWOW64\WScript.exe
PID 2236 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d8b45a0c6bbd494449eacaf19a4f958ebedd37d4b5f5fef8c2da0177ea025c3c.exe C:\Windows\SysWOW64\WScript.exe
PID 2760 wrote to memory of 2792 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2760 wrote to memory of 2792 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2760 wrote to memory of 2792 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2760 wrote to memory of 2792 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2792 wrote to memory of 2852 N/A C:\Windows\SysWOW64\cmd.exe C:\providercommon\DllCommonsvc.exe
PID 2792 wrote to memory of 2852 N/A C:\Windows\SysWOW64\cmd.exe C:\providercommon\DllCommonsvc.exe
PID 2792 wrote to memory of 2852 N/A C:\Windows\SysWOW64\cmd.exe C:\providercommon\DllCommonsvc.exe
PID 2792 wrote to memory of 2852 N/A C:\Windows\SysWOW64\cmd.exe C:\providercommon\DllCommonsvc.exe
PID 2852 wrote to memory of 1276 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2852 wrote to memory of 1276 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2852 wrote to memory of 1276 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2852 wrote to memory of 2120 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2852 wrote to memory of 2120 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2852 wrote to memory of 2120 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2852 wrote to memory of 408 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2852 wrote to memory of 408 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2852 wrote to memory of 408 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2852 wrote to memory of 1112 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2852 wrote to memory of 1112 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2852 wrote to memory of 1112 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2852 wrote to memory of 2260 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2852 wrote to memory of 2260 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2852 wrote to memory of 2260 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2852 wrote to memory of 3052 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2852 wrote to memory of 3052 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2852 wrote to memory of 3052 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2852 wrote to memory of 3016 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2852 wrote to memory of 3016 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2852 wrote to memory of 3016 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2852 wrote to memory of 2264 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2852 wrote to memory of 2264 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2852 wrote to memory of 2264 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2852 wrote to memory of 2272 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2852 wrote to memory of 2272 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2852 wrote to memory of 2272 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2852 wrote to memory of 1832 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2852 wrote to memory of 1832 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2852 wrote to memory of 1832 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2852 wrote to memory of 1544 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2852 wrote to memory of 1544 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2852 wrote to memory of 1544 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2852 wrote to memory of 2020 N/A C:\providercommon\DllCommonsvc.exe C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\DllCommonsvc.exe
PID 2852 wrote to memory of 2020 N/A C:\providercommon\DllCommonsvc.exe C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\DllCommonsvc.exe
PID 2852 wrote to memory of 2020 N/A C:\providercommon\DllCommonsvc.exe C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\DllCommonsvc.exe
PID 2020 wrote to memory of 2692 N/A C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\DllCommonsvc.exe C:\Windows\System32\cmd.exe
PID 2020 wrote to memory of 2692 N/A C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\DllCommonsvc.exe C:\Windows\System32\cmd.exe
PID 2020 wrote to memory of 2692 N/A C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\DllCommonsvc.exe C:\Windows\System32\cmd.exe
PID 2692 wrote to memory of 2528 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 2692 wrote to memory of 2528 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 2692 wrote to memory of 2528 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 2692 wrote to memory of 1696 N/A C:\Windows\System32\cmd.exe C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\DllCommonsvc.exe
PID 2692 wrote to memory of 1696 N/A C:\Windows\System32\cmd.exe C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\DllCommonsvc.exe
PID 2692 wrote to memory of 1696 N/A C:\Windows\System32\cmd.exe C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\DllCommonsvc.exe
PID 1696 wrote to memory of 1100 N/A C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\DllCommonsvc.exe C:\Windows\System32\cmd.exe
PID 1696 wrote to memory of 1100 N/A C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\DllCommonsvc.exe C:\Windows\System32\cmd.exe
PID 1696 wrote to memory of 1100 N/A C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\DllCommonsvc.exe C:\Windows\System32\cmd.exe
PID 1100 wrote to memory of 2472 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 1100 wrote to memory of 2472 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 1100 wrote to memory of 2472 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 1100 wrote to memory of 1612 N/A C:\Windows\System32\cmd.exe C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\DllCommonsvc.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d8b45a0c6bbd494449eacaf19a4f958ebedd37d4b5f5fef8c2da0177ea025c3c.exe

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d8b45a0c6bbd494449eacaf19a4f958ebedd37d4b5f5fef8c2da0177ea025c3c.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\providercommon\1zu9dW.bat" "

C:\providercommon\DllCommonsvc.exe

"C:\providercommon\DllCommonsvc.exe"

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 6 /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\System.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\System.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\System.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 7 /tr "'C:\providercommon\sppsvc.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\providercommon\sppsvc.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 11 /tr "'C:\providercommon\sppsvc.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "servicess" /sc MINUTE /mo 8 /tr "'C:\Program Files\Java\services.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files\Java\services.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "servicess" /sc MINUTE /mo 10 /tr "'C:\Program Files\Java\services.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\Documents\WmiPrvSE.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Users\All Users\Documents\WmiPrvSE.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\Documents\WmiPrvSE.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "smsss" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Photo Viewer\ja-JP\smss.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\ja-JP\smss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "smsss" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Photo Viewer\ja-JP\smss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\Idle.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\Idle.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\Idle.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 5 /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\DllCommonsvc.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\DllCommonsvc.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 5 /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\DllCommonsvc.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\cmd.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\cmd.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\cmd.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\explorer.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\explorer.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "explorere" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\explorer.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe'" /rl HIGHEST /f

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\System.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\sppsvc.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Java\services.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Documents\WmiPrvSE.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Photo Viewer\ja-JP\smss.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\Idle.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\DllCommonsvc.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\cmd.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\explorer.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe'

C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\DllCommonsvc.exe

"C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\DllCommonsvc.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\svzewrKVsp.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\DllCommonsvc.exe

"C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\DllCommonsvc.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\InhrPXXuGB.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\DllCommonsvc.exe

"C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\DllCommonsvc.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Lg3y2yDdyq.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\DllCommonsvc.exe

"C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\DllCommonsvc.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\EqBdbgL5Ji.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\DllCommonsvc.exe

"C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\DllCommonsvc.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\cV1vwDPsky.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\DllCommonsvc.exe

"C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\DllCommonsvc.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\k2jNhBdkgg.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\DllCommonsvc.exe

"C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\DllCommonsvc.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\V9nTU0UPEK.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\DllCommonsvc.exe

"C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\DllCommonsvc.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\CTHuJZ10YE.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\DllCommonsvc.exe

"C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\DllCommonsvc.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\DXR1U0Y5m3.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\DllCommonsvc.exe

"C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\DllCommonsvc.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\DXR1U0Y5m3.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\DllCommonsvc.exe

"C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\DllCommonsvc.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 raw.githubusercontent.com udp
US 185.199.110.133:443 raw.githubusercontent.com tcp
US 185.199.110.133:443 raw.githubusercontent.com tcp
US 185.199.110.133:443 raw.githubusercontent.com tcp
US 185.199.110.133:443 raw.githubusercontent.com tcp
US 185.199.110.133:443 raw.githubusercontent.com tcp
US 185.199.110.133:443 raw.githubusercontent.com tcp
US 185.199.110.133:443 raw.githubusercontent.com tcp
US 185.199.110.133:443 raw.githubusercontent.com tcp
US 185.199.110.133:443 raw.githubusercontent.com tcp
US 185.199.110.133:443 raw.githubusercontent.com tcp

Files

C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

MD5 8088241160261560a02c84025d107592
SHA1 083121f7027557570994c9fc211df61730455bb5
SHA256 2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1
SHA512 20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

C:\providercommon\1zu9dW.bat

MD5 6783c3ee07c7d151ceac57f1f9c8bed7
SHA1 17468f98f95bf504cc1f83c49e49a78526b3ea03
SHA256 8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322
SHA512 c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

C:\providercommon\DllCommonsvc.exe

MD5 bd31e94b4143c4ce49c17d3af46bcad0
SHA1 f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256 b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512 f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

memory/2852-13-0x0000000000CF0000-0x0000000000E00000-memory.dmp

memory/2852-14-0x00000000001C0000-0x00000000001D2000-memory.dmp

memory/2852-15-0x00000000001E0000-0x00000000001EC000-memory.dmp

memory/2852-16-0x00000000001D0000-0x00000000001DC000-memory.dmp

memory/2852-17-0x0000000000370000-0x000000000037C000-memory.dmp

memory/2020-44-0x0000000001330000-0x0000000001440000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5BHT4U34GQ1WS0QUPUMW.temp

MD5 9dac7d46707068806e69f760ef8ddb13
SHA1 c4d4c3c476ad2380cce57d259d214c562f7d813b
SHA256 538e10af1afab0d8483b59cd034d645f279c1c8fc071c7e7e1e05ebd4051f212
SHA512 59f33c42a566f2d14e4119ee892e4dac7918273460c7c612a34656eca7e6f1346c417740224e37d7aae026b0ff103734e54fd685e1bddff2f3b1768994aa4f70

memory/1276-68-0x000000001B5A0000-0x000000001B882000-memory.dmp

memory/1276-85-0x0000000001F00000-0x0000000001F08000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Cab7CEF.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\Tar7D02.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\Local\Temp\svzewrKVsp.bat

MD5 e19cd53954ebdb3b904742940408ba34
SHA1 c7364288c69a8e9a929af6fcb090f11b2246fabf
SHA256 f8e3d893a5e5cd88ebb981b53fe55e8f345b469fea9210ab21d49f1066617395
SHA512 091646cd2c23d746f066cd602f722660588ef3ed67dfffb3e49d481a8ad958e27fe64782a62af0e387306a55d65f6ac4241fb0c1ff5c226871bdffb49b6cd26a

memory/1696-159-0x0000000000180000-0x0000000000192000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 355372563624e5935b68136d11b945c3
SHA1 a7ba500d2fb8bf1ec66ab806b242ee1ba42e3aae
SHA256 b442dabce3b3bc25b7ef68af92612b67ddade9769388f9d58c18c87e344c0c12
SHA512 94c707bb27b1138e6972d925115ccffecc17857fbe9eee2517b45d2b6a4b296bff0b32d67391a18ee02e2c609b172027bbf647a5414e545678c57eb5b64bfdce

C:\Users\Admin\AppData\Local\Temp\InhrPXXuGB.bat

MD5 043e05d2f8b823bf2ce075e619a30e23
SHA1 b19033663308eb4559d2f5261eb4e0bba17e00b1
SHA256 f4c021732470f517fe162e05a61b300af916bf94a7018a72c1934ba48022af83
SHA512 8f5af1c6fba4bc3c5cbb88b65779204a7a39acbfbfc820bb0b3ed670b122c2dd2caee078aff74c4d5fd3a7bd0996af2b39190cc71225cae40721e33c71bd60de

memory/1612-219-0x0000000000060000-0x0000000000170000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 796b9eab030b7e4c74af01de75c44e37
SHA1 645e3fc91cfe513796ab55e1215afb93289fd422
SHA256 9d04d9eab50489e0eb6ed8ad0d2abaef10f71213bb34798ed18a5eaca4014955
SHA512 e1def66cc7ebd2d8e6dbb038d2844679f491b13f8ca8c4062d4b6072b6df869dc75fe1f737f795879d01869fefd7e4d10aed91e864cee12c8c03e5a94f264261

C:\Users\Admin\AppData\Local\Temp\Lg3y2yDdyq.bat

MD5 5f4687d557fc2ea992d676e4fb55c46b
SHA1 ace30c6debd9f757494e7c677c0416c211b55c9c
SHA256 0d90bfb327277f5cd7380bdd7b2795819e9e7f4c5dcda82a0a5df22f0c69b757
SHA512 9a6ad306dbc83d2f1680938ccda7e2cd1da099f3539993cda61f56bf2653f6cbe97dafee8f1997fb14b9bd3113fd5eceb8ac5daaf1007cec0d0c0ea2f0ea40c8

memory/2436-279-0x00000000008A0000-0x00000000009B0000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e375507704762c8d99dbe82f4857268f
SHA1 d44f11a43f75ce07c656858e33e0bf5ab8c62ce4
SHA256 a8ac21b2ff7468b609ef1dbb584b6acd9043c75eb635b6d19bea4527835a1694
SHA512 a411a93e98df3107ce59cca89ac76e617bcdd7c1792e31ddb27d203b9f435a4f5a70be659c7a98189dd98803a945b6451bf142ba4539e7fbb3e6d191430e05fd

C:\Users\Admin\AppData\Local\Temp\EqBdbgL5Ji.bat

MD5 fcfa0fd725046879e35acb070c7c9273
SHA1 609a8d04147b00e29742d8c8af9ab046eb1783f0
SHA256 3db7442595a05a154c853fc58249cc1d98b981e5ddd1eb29c7dd524958205ce6
SHA512 96bcb5d34f33615aaa332acf20b837179143531d6f8f5d165437829372c8b7b84d4935f76988d260f7392b0619bf6c309bf6a24994fc7c8f11096ac2127f03e3

memory/2668-339-0x0000000000B00000-0x0000000000C10000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 77f8ee1ecd8bca1ce502550e769393a3
SHA1 3c5542401d8745f493b2207209f7e72dc3976e11
SHA256 1091e5da60a68d125413e99572b98b2f8ee148c05381d5a92c3bc448a35c98ef
SHA512 18abdf8c744674d4ca01258c38b5538842949bdf2943ccec04b3571bf5d8c296e5aae6a11da6d0bb877abbc94650287fdc9fbb13e15da0ee47546f1478fad28d

C:\Users\Admin\AppData\Local\Temp\cV1vwDPsky.bat

MD5 3934d87f04dd90c97d13a9114ca74c38
SHA1 f4c21805502456ae845af1024c9528b3190bb86f
SHA256 d30b7ccd565ee9cd26949b7195d4f0c5fbdeef4fb160448938c48516a31d155a
SHA512 cab342c9f7c6e8db865ac1de4d4db6f3905ee382d5ee0735650d9cad273aab2c3ecb614c84b70d174a502a5cad1788470ed75ee1078494cc7b1a315d14154d8a

memory/984-399-0x0000000000E30000-0x0000000000F40000-memory.dmp

memory/984-400-0x0000000000340000-0x0000000000352000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c65a31a9d15b4ae1397d39010fb3b3d2
SHA1 c49d6e1ecc0294c5833b7ab9e58a8188ccd209c1
SHA256 2825400c1ddc1dbe4a4557d6c24817abd3e5ff38f9636022b35d872db1ab170d
SHA512 6bf505c8c43f82d10e68e055b5aaae644689b7505cb92a5d88f032c1f469297e69b0f8d13c1e5f62127f3ce6a52f13ac39a26bae7db24f140d13b7ed45b997a1

C:\Users\Admin\AppData\Local\Temp\k2jNhBdkgg.bat

MD5 d1746b74f606af0e5209e3206f5a7471
SHA1 7bb92917e177ee03391232df97a5bcc49d576684
SHA256 b70a174839148190540adde05a77b4e1178ff7fa63e7044d4cc0f1e750e97f11
SHA512 8709ddd43d8ae8eb2249288c7c30104f8afab6a0576d270f7accc86fd1fdecb5f4f9d000b0d09828291b7eb2a1e461a83bb5b434ec04b711271c6536dc66b163

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 05b1ced15ff1047bfa8c67563d97a549
SHA1 54eb8a8ceca0721da33637bb8f63f0f222a66557
SHA256 cb90b21cc93fd2687aeb49883b3080f4e60172c21d290d7e6341375501752009
SHA512 7fa595e16d43002a3d9783128bf9410d8dad4ff0b2a70155f2bf1b4bfd539d433f20250761f1bd10544a1b76a4def4c25d7e4dd2c490f3af19f597d6b8e20d86

C:\Users\Admin\AppData\Local\Temp\V9nTU0UPEK.bat

MD5 bd19c323dd5aa1dc0a7a4aae55a2e8dc
SHA1 8e0236039b29fd6d6026b17be1437392a67412eb
SHA256 668595a9e1edbb4542ac0e32bf28d1fd2c6939407dd0196392d279dee20ba742
SHA512 0bf3449e004c596305be54da0534e154814875f83855271d24fd50bcb3b42211312b2569c820b06706e6cc9c227c7797283098225f2b187a700bf708c5f3ded4

memory/2436-519-0x0000000000EC0000-0x0000000000FD0000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 be9e9cef00fa18fb4c5f7bf7d7593560
SHA1 f7a5bd4e86215c81ff09d43bbc8ec142311bfe62
SHA256 6ee896260aadfc4e7b840302c580f4ff4f77aee9f16dcf5f37b1555e4f61a489
SHA512 727aa7ccbca4f476c29b1eb02d6bbaf757d68eaf86e085e5dfed522c94de3e5f762169f32ed018328ba31bbe208d652e4a61987d4694bc37537c32b78d1df2b4

C:\Users\Admin\AppData\Local\Temp\CTHuJZ10YE.bat

MD5 5ef55f77658f025c538a566fe3a9015a
SHA1 a504e5975cd7318dfce234c710235a72085452e4
SHA256 190d70652a3e59721617be16b7c9e0b46a471516ee6fce83fc33a94ccc2263d7
SHA512 2d98f27c9d2caee67aad7671ba56422b0cdbc390d39180327c111078f772c1bd96da2c0d240316cf8af3ce6fb71730d8f8334d225ffc5e20505a46135d889cb9

memory/2736-579-0x0000000001120000-0x0000000001230000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4d702894028b49d2c8766bbf41b71c4c
SHA1 bf926ed878e07383392fcc97998da9f7ce152f31
SHA256 b91d317eef60089b97e9640e3d4726e23a740b5b54ffbbee2913543017908d87
SHA512 5b8f2e0b314a5bbc043d00b283027e8aa9af3ea82a2373a9c714667426c965827a1ca5db8c53d6b66b1c941b9caf93c7d2a6d1c1b7c3dbc58636470c51c61fbe

C:\Users\Admin\AppData\Local\Temp\DXR1U0Y5m3.bat

MD5 dee48fbcfdd714076fa5aacc88f6aaf5
SHA1 f2c0c695a9631e66b8ec9f8b6d992d2686c5f3cd
SHA256 556ec725c176b15b0593526080e4dc1fee7e485a4205cf5999fc533d0978ef87
SHA512 90463c36f5e87e7f40f9f699bb4669b6fb3a7cbd3911ecc865daa38f68eb4f04d2b99078c63f52824d6dc5409b8aff10ab62eb70359b321f87dc79cbaa26a469

memory/2880-639-0x0000000000240000-0x0000000000252000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7edb34e5b41ddddc00b05fda8cdf4163
SHA1 c25d461a020f5d9a273ae94d4c4ad3cdb9561c97
SHA256 5083421bb39d32aac2f0d1fcdf56afac74ff2f79071db2b938b12004330ed0d8
SHA512 4ea7d063fe9a04bf15df63ea799adbf9da18d3b41acadc016f5f5426f27cdd60b71c3ae0a0fd167b2f1a4f91af2b0d8fe97e641fb987d079be92b29dd98cf4fa

memory/928-699-0x00000000000D0000-0x00000000001E0000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-12-30 17:31

Reported

2024-12-30 17:34

Platform

win10v2004-20241007-en

Max time kernel

146s

Max time network

146s

Command Line

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d8b45a0c6bbd494449eacaf19a4f958ebedd37d4b5f5fef8c2da0177ea025c3c.exe"

Signatures

DcRat

rat infostealer dcrat

Dcrat family

dcrat

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe

DCRat payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\WScript.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation C:\Recovery\WindowsRE\smss.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation C:\Recovery\WindowsRE\smss.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation C:\Recovery\WindowsRE\smss.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation C:\Recovery\WindowsRE\smss.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation C:\Recovery\WindowsRE\smss.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation C:\Recovery\WindowsRE\smss.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation C:\Recovery\WindowsRE\smss.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation C:\providercommon\DllCommonsvc.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation C:\Recovery\WindowsRE\smss.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation C:\Recovery\WindowsRE\smss.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation C:\Recovery\WindowsRE\smss.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation C:\Recovery\WindowsRE\smss.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d8b45a0c6bbd494449eacaf19a4f958ebedd37d4b5f5fef8c2da0177ea025c3c.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation C:\Recovery\WindowsRE\smss.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\38384e6a620884 C:\providercommon\DllCommonsvc.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\SearchApp.exe C:\providercommon\DllCommonsvc.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d8b45a0c6bbd494449eacaf19a4f958ebedd37d4b5f5fef8c2da0177ea025c3c.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WScript.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings C:\Recovery\WindowsRE\smss.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings C:\Recovery\WindowsRE\smss.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings C:\Recovery\WindowsRE\smss.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings C:\Recovery\WindowsRE\smss.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings C:\Recovery\WindowsRE\smss.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings C:\Recovery\WindowsRE\smss.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings C:\Recovery\WindowsRE\smss.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings C:\Recovery\WindowsRE\smss.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings C:\Recovery\WindowsRE\smss.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d8b45a0c6bbd494449eacaf19a4f958ebedd37d4b5f5fef8c2da0177ea025c3c.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings C:\Recovery\WindowsRE\smss.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings C:\Recovery\WindowsRE\smss.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings C:\providercommon\DllCommonsvc.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings C:\Recovery\WindowsRE\smss.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\providercommon\DllCommonsvc.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Recovery\WindowsRE\smss.exe N/A
Token: SeDebugPrivilege N/A C:\Recovery\WindowsRE\smss.exe N/A
Token: SeDebugPrivilege N/A C:\Recovery\WindowsRE\smss.exe N/A
Token: SeDebugPrivilege N/A C:\Recovery\WindowsRE\smss.exe N/A
Token: SeDebugPrivilege N/A C:\Recovery\WindowsRE\smss.exe N/A
Token: SeDebugPrivilege N/A C:\Recovery\WindowsRE\smss.exe N/A
Token: SeDebugPrivilege N/A C:\Recovery\WindowsRE\smss.exe N/A
Token: SeDebugPrivilege N/A C:\Recovery\WindowsRE\smss.exe N/A
Token: SeDebugPrivilege N/A C:\Recovery\WindowsRE\smss.exe N/A
Token: SeDebugPrivilege N/A C:\Recovery\WindowsRE\smss.exe N/A
Token: SeDebugPrivilege N/A C:\Recovery\WindowsRE\smss.exe N/A
Token: SeDebugPrivilege N/A C:\Recovery\WindowsRE\smss.exe N/A
Token: SeDebugPrivilege N/A C:\Recovery\WindowsRE\smss.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3268 wrote to memory of 1652 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d8b45a0c6bbd494449eacaf19a4f958ebedd37d4b5f5fef8c2da0177ea025c3c.exe C:\Windows\SysWOW64\WScript.exe
PID 3268 wrote to memory of 1652 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d8b45a0c6bbd494449eacaf19a4f958ebedd37d4b5f5fef8c2da0177ea025c3c.exe C:\Windows\SysWOW64\WScript.exe
PID 3268 wrote to memory of 1652 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d8b45a0c6bbd494449eacaf19a4f958ebedd37d4b5f5fef8c2da0177ea025c3c.exe C:\Windows\SysWOW64\WScript.exe
PID 1652 wrote to memory of 4824 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 1652 wrote to memory of 4824 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 1652 wrote to memory of 4824 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 4824 wrote to memory of 544 N/A C:\Windows\SysWOW64\cmd.exe C:\providercommon\DllCommonsvc.exe
PID 4824 wrote to memory of 544 N/A C:\Windows\SysWOW64\cmd.exe C:\providercommon\DllCommonsvc.exe
PID 544 wrote to memory of 3156 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 544 wrote to memory of 3156 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 544 wrote to memory of 4792 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 544 wrote to memory of 4792 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 544 wrote to memory of 2120 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 544 wrote to memory of 2120 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 544 wrote to memory of 3520 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\cmd.exe
PID 544 wrote to memory of 3520 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\cmd.exe
PID 3520 wrote to memory of 4692 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 3520 wrote to memory of 4692 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 3520 wrote to memory of 5088 N/A C:\Windows\System32\cmd.exe C:\Recovery\WindowsRE\smss.exe
PID 3520 wrote to memory of 5088 N/A C:\Windows\System32\cmd.exe C:\Recovery\WindowsRE\smss.exe
PID 5088 wrote to memory of 3140 N/A C:\Recovery\WindowsRE\smss.exe C:\Windows\System32\cmd.exe
PID 5088 wrote to memory of 3140 N/A C:\Recovery\WindowsRE\smss.exe C:\Windows\System32\cmd.exe
PID 3140 wrote to memory of 3444 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 3140 wrote to memory of 3444 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 3140 wrote to memory of 2456 N/A C:\Windows\System32\cmd.exe C:\Recovery\WindowsRE\smss.exe
PID 3140 wrote to memory of 2456 N/A C:\Windows\System32\cmd.exe C:\Recovery\WindowsRE\smss.exe
PID 2456 wrote to memory of 3488 N/A C:\Recovery\WindowsRE\smss.exe C:\Windows\System32\cmd.exe
PID 2456 wrote to memory of 3488 N/A C:\Recovery\WindowsRE\smss.exe C:\Windows\System32\cmd.exe
PID 3488 wrote to memory of 3204 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 3488 wrote to memory of 3204 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 3488 wrote to memory of 464 N/A C:\Windows\System32\cmd.exe C:\Recovery\WindowsRE\smss.exe
PID 3488 wrote to memory of 464 N/A C:\Windows\System32\cmd.exe C:\Recovery\WindowsRE\smss.exe
PID 464 wrote to memory of 2308 N/A C:\Recovery\WindowsRE\smss.exe C:\Windows\System32\cmd.exe
PID 464 wrote to memory of 2308 N/A C:\Recovery\WindowsRE\smss.exe C:\Windows\System32\cmd.exe
PID 2308 wrote to memory of 4796 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 2308 wrote to memory of 4796 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 2308 wrote to memory of 3040 N/A C:\Windows\System32\cmd.exe C:\Recovery\WindowsRE\smss.exe
PID 2308 wrote to memory of 3040 N/A C:\Windows\System32\cmd.exe C:\Recovery\WindowsRE\smss.exe
PID 3040 wrote to memory of 2116 N/A C:\Recovery\WindowsRE\smss.exe C:\Windows\System32\cmd.exe
PID 3040 wrote to memory of 2116 N/A C:\Recovery\WindowsRE\smss.exe C:\Windows\System32\cmd.exe
PID 2116 wrote to memory of 624 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 2116 wrote to memory of 624 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 2116 wrote to memory of 512 N/A C:\Windows\System32\cmd.exe C:\Recovery\WindowsRE\smss.exe
PID 2116 wrote to memory of 512 N/A C:\Windows\System32\cmd.exe C:\Recovery\WindowsRE\smss.exe
PID 512 wrote to memory of 1196 N/A C:\Recovery\WindowsRE\smss.exe C:\Windows\System32\cmd.exe
PID 512 wrote to memory of 1196 N/A C:\Recovery\WindowsRE\smss.exe C:\Windows\System32\cmd.exe
PID 1196 wrote to memory of 2904 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 1196 wrote to memory of 2904 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 1196 wrote to memory of 2084 N/A C:\Windows\System32\cmd.exe C:\Recovery\WindowsRE\smss.exe
PID 1196 wrote to memory of 2084 N/A C:\Windows\System32\cmd.exe C:\Recovery\WindowsRE\smss.exe
PID 2084 wrote to memory of 2728 N/A C:\Recovery\WindowsRE\smss.exe C:\Windows\System32\cmd.exe
PID 2084 wrote to memory of 2728 N/A C:\Recovery\WindowsRE\smss.exe C:\Windows\System32\cmd.exe
PID 2728 wrote to memory of 3520 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 2728 wrote to memory of 3520 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 2728 wrote to memory of 4552 N/A C:\Windows\System32\cmd.exe C:\Recovery\WindowsRE\smss.exe
PID 2728 wrote to memory of 4552 N/A C:\Windows\System32\cmd.exe C:\Recovery\WindowsRE\smss.exe
PID 4552 wrote to memory of 2136 N/A C:\Recovery\WindowsRE\smss.exe C:\Windows\System32\cmd.exe
PID 4552 wrote to memory of 2136 N/A C:\Recovery\WindowsRE\smss.exe C:\Windows\System32\cmd.exe
PID 2136 wrote to memory of 1576 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 2136 wrote to memory of 1576 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 2136 wrote to memory of 5036 N/A C:\Windows\System32\cmd.exe C:\Recovery\WindowsRE\smss.exe
PID 2136 wrote to memory of 5036 N/A C:\Windows\System32\cmd.exe C:\Recovery\WindowsRE\smss.exe
PID 5036 wrote to memory of 4524 N/A C:\Recovery\WindowsRE\smss.exe C:\Windows\System32\cmd.exe
PID 5036 wrote to memory of 4524 N/A C:\Recovery\WindowsRE\smss.exe C:\Windows\System32\cmd.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d8b45a0c6bbd494449eacaf19a4f958ebedd37d4b5f5fef8c2da0177ea025c3c.exe

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d8b45a0c6bbd494449eacaf19a4f958ebedd37d4b5f5fef8c2da0177ea025c3c.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "

C:\providercommon\DllCommonsvc.exe

"C:\providercommon\DllCommonsvc.exe"

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "smsss" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\smss.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\smss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\smss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\SearchApp.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\SearchApp.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\SearchApp.exe'" /rl HIGHEST /f

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\smss.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\SearchApp.exe'

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\LMwQffnTI8.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Recovery\WindowsRE\smss.exe

"C:\Recovery\WindowsRE\smss.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\WtQmBjXbDh.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Recovery\WindowsRE\smss.exe

"C:\Recovery\WindowsRE\smss.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\5G5G1KH0qy.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Recovery\WindowsRE\smss.exe

"C:\Recovery\WindowsRE\smss.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\pdW26R6SPG.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Recovery\WindowsRE\smss.exe

"C:\Recovery\WindowsRE\smss.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\TdlfhXh7Yo.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Recovery\WindowsRE\smss.exe

"C:\Recovery\WindowsRE\smss.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\mNrvcGFykN.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Recovery\WindowsRE\smss.exe

"C:\Recovery\WindowsRE\smss.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\mWzz7cjAeP.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Recovery\WindowsRE\smss.exe

"C:\Recovery\WindowsRE\smss.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\WtQmBjXbDh.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Recovery\WindowsRE\smss.exe

"C:\Recovery\WindowsRE\smss.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\PliZKNaLvF.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Recovery\WindowsRE\smss.exe

"C:\Recovery\WindowsRE\smss.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Rhkc0SdEF2.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Recovery\WindowsRE\smss.exe

"C:\Recovery\WindowsRE\smss.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\mNrvcGFykN.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Recovery\WindowsRE\smss.exe

"C:\Recovery\WindowsRE\smss.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\H7kUlUtrsw.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Recovery\WindowsRE\smss.exe

"C:\Recovery\WindowsRE\smss.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\J2mXRZwkCj.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Recovery\WindowsRE\smss.exe

"C:\Recovery\WindowsRE\smss.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 69.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 raw.githubusercontent.com udp
US 185.199.110.133:443 raw.githubusercontent.com tcp
US 8.8.8.8:53 133.110.199.185.in-addr.arpa udp
US 185.199.110.133:443 raw.githubusercontent.com tcp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 185.199.110.133:443 raw.githubusercontent.com tcp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 185.199.110.133:443 raw.githubusercontent.com tcp
US 185.199.110.133:443 raw.githubusercontent.com tcp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 185.199.110.133:443 raw.githubusercontent.com tcp
US 185.199.110.133:443 raw.githubusercontent.com tcp
US 8.8.8.8:53 134.130.81.91.in-addr.arpa udp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
US 185.199.110.133:443 raw.githubusercontent.com tcp
US 185.199.110.133:443 raw.githubusercontent.com tcp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 185.199.110.133:443 raw.githubusercontent.com tcp
US 185.199.110.133:443 raw.githubusercontent.com tcp
US 185.199.110.133:443 raw.githubusercontent.com tcp

Files

C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

MD5 8088241160261560a02c84025d107592
SHA1 083121f7027557570994c9fc211df61730455bb5
SHA256 2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1
SHA512 20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

C:\providercommon\1zu9dW.bat

MD5 6783c3ee07c7d151ceac57f1f9c8bed7
SHA1 17468f98f95bf504cc1f83c49e49a78526b3ea03
SHA256 8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322
SHA512 c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

C:\providercommon\DllCommonsvc.exe

MD5 bd31e94b4143c4ce49c17d3af46bcad0
SHA1 f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256 b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512 f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

memory/544-12-0x00007FFFFDBF3000-0x00007FFFFDBF5000-memory.dmp

memory/544-13-0x00000000002F0000-0x0000000000400000-memory.dmp

memory/544-14-0x00000000024D0000-0x00000000024E2000-memory.dmp

memory/544-15-0x00000000024E0000-0x00000000024EC000-memory.dmp

memory/544-16-0x000000001AFD0000-0x000000001AFDC000-memory.dmp

memory/544-17-0x000000001B0F0000-0x000000001B0FC000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_aiop4v4r.pcw.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/2120-26-0x00000217F50D0000-0x00000217F50F2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\LMwQffnTI8.bat

MD5 b908d78cec6d850a0893bff54f3ea53e
SHA1 053217d6e693c3fba31e5e3184cef8f060da0528
SHA256 6ff35d53a1cf6ac300c82bf4fff877b5f5d1d648dbf25281be3900d52a527384
SHA512 87255553e4caf5a2f970f91ae007645b52db65f1db4afb8b742a7c5a0244355e8da4af97e5a374641ca878b9285b088463b7a3f9c647d7053ac38fecd3376a7c

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 d28a889fd956d5cb3accfbaf1143eb6f
SHA1 157ba54b365341f8ff06707d996b3635da8446f7
SHA256 21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45
SHA512 0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/5088-66-0x000000001C7F0000-0x000000001C802000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\WtQmBjXbDh.bat

MD5 6dac6e1b044f84d8ba6c23c0b7e6b58b
SHA1 7d4e1e6ed89317c764a942e29e0e2335e504634b
SHA256 a5b1557a0adb0d742314a2a649b0f7c4719f7e46308c117abd140f31720eef48
SHA512 b5ce20c45bfd7e04d156d8e3604ece4e1f3e5f255aeb09bf30ed16777e19f9b60f21e7208ad1798e068818bfb4b92866ecd81cb2e90a9e393b58458372a5971d

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\smss.exe.log

MD5 baf55b95da4a601229647f25dad12878
SHA1 abc16954ebfd213733c4493fc1910164d825cac8
SHA256 ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
SHA512 24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

C:\Users\Admin\AppData\Local\Temp\5G5G1KH0qy.bat

MD5 d02306d4f1bcd6401a234e3625134351
SHA1 1d0df5990a0768b5f31938d35119cbb602a17d36
SHA256 dc1cbd15e208ca6a09b03219eda4b954434987e0c440fe3667d8e9d3ee08f2d7
SHA512 adb9ff7b04d9922beda3ab8d8a3129cf3ea88b9ab3c0f317114b33a1887f0ecc8832955f943b32e1d0bf366efb977fffb88e845a7eff41a394ba5a453a9cbd19

memory/464-81-0x000000001B5F0000-0x000000001B602000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\pdW26R6SPG.bat

MD5 e174f8842222cbe014e945b93c1be9d8
SHA1 938945e0c94df7915b5b7d57a7ed7cf476b71a2d
SHA256 243ca7847f344e315b3446cc5c6c771fef4d1f27147e3cf677774b67bbf6725c
SHA512 c7fd0229d3a88eadf345cdbfb9842f9194123d1c590979d2b1776039b11205e6061294cf31dcba6530b631c459e5f00e21a56cca4d7ae24591f8f60c1e903ae2

C:\Users\Admin\AppData\Local\Temp\TdlfhXh7Yo.bat

MD5 cec7b0297c746e6cb4b43c8050e6b4e6
SHA1 e7c9f7da4e62e625673078d464fcd54d208cc152
SHA256 a33b2bb92f1437c76628af9cf459a3ec5315e84fcc1aa30c8e30eb2c8e3f8f7a
SHA512 441ab1f269673f7ad4a805c3e7ad73adb01cd53a645286a032e9a4cf58df22b2ffc04a5ef141dd9844d1be124bf1c2643bc847a62980751f073bb3bf389956b4

C:\Users\Admin\AppData\Local\Temp\mNrvcGFykN.bat

MD5 95ffb247497c48899c4ac31a84c96b4b
SHA1 e7a4ed68cebd5665cd26c4c6a32dc4a6f63619f9
SHA256 79385564e642cb89f7027e8d6c7408d43a862ac58445375f5449c124453184ad
SHA512 f80b096af9ab840d888e1f893bfe2d4625e63e125dd4a36966a137cb062e5b76efa28194d2540ae0f876596970a85f87e7a1daed49e7a9663e2450e2775e72f5

C:\Users\Admin\AppData\Local\Temp\mWzz7cjAeP.bat

MD5 87141d0618ebd2bd9ae2e998774d1ecb
SHA1 ef053e30876db0fc998e9b13c47b8443afaac24c
SHA256 1c101050b1c504430165de836faa5a22a55d68b4844933df5e6edcc38a60216a
SHA512 afb3af0d7b5ae7b5de33e408cbee5a7c3ca11d63d8758cb51916fc10395bb01ec2f3dca1326a44faa8b33139843c601b220b8f54acf30a418c39283a7f0cd332

C:\Users\Admin\AppData\Local\Temp\PliZKNaLvF.bat

MD5 624f580271132466a038b78084bf50e8
SHA1 5def39528d2d79ac9383003d439a4079483876a3
SHA256 0a415f1129a28f4b27ad2f5397d71f6c4060791a50ff8ee68db44d287376bb2f
SHA512 8d6148df8a05974e5c6ba017865bb41ea1c2ca4c37103b601af55e70909cfef002d1f5a859c82b58ccb8d6ace6eaea56ec9521d4dc31f7bff160f3e992a0a128

C:\Users\Admin\AppData\Local\Temp\H7kUlUtrsw.bat

MD5 959c3432d98c57a76696865b35dcc58e
SHA1 ac724f40b832d0074fc6f9ccc553a4e1117d3543
SHA256 edb38ed3f6dba9524dfcb6f9b7e493d486eba299e7d63a6900b7994807b78bf0
SHA512 0f2dc66efaf21d9c25324d300594667314555ea020092c812e198e641848db4fc749ecee866c6945039592d4fa40dd9afe0dba6a85e6661e127c1b89d9814eb9

C:\Users\Admin\AppData\Local\Temp\J2mXRZwkCj.bat

MD5 5bc8535a90df1e43cfff798f7a9ca99f
SHA1 9942cdfe3ef2c0eb6018f375695587d6d87f9764
SHA256 164afb959084a005121f6936865e1a1c0061ce4007f68952ec19905f4500f9b1
SHA512 94667aacb616ad634396977d6434cb18b75ec959ac575fb226ba525fcf9a585060c6184a106b83c31681c715bd1ef128bbd6cea681403588973df4a253b06c26