Analysis
-
max time kernel
148s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2024, 17:35
Behavioral task
behavioral1
Sample
JaffaCakes118_8bd5385c30b54b4890ccd384447c3532fc22fb975c00731cf134cb4e3c6677db.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
JaffaCakes118_8bd5385c30b54b4890ccd384447c3532fc22fb975c00731cf134cb4e3c6677db.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_8bd5385c30b54b4890ccd384447c3532fc22fb975c00731cf134cb4e3c6677db.exe
-
Size
1.3MB
-
MD5
ef9929a8179ccfcb8742812486534e53
-
SHA1
7b04591c689e7ab85edb495b7f6c26f08bfef9b6
-
SHA256
8bd5385c30b54b4890ccd384447c3532fc22fb975c00731cf134cb4e3c6677db
-
SHA512
e13619e405603a72c9ac0bd370c058c7d2feb1325a07316beecc7c9a48c763140071454ef6465d77ad4d0dd372d61b9b3bd05546583864a82d5a486068ba53b2
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Process spawned unexpected child process 12 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4980 208 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2256 208 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3400 208 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 952 208 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 656 208 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2516 208 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5108 208 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1048 208 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4480 208 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2720 208 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 920 208 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1928 208 schtasks.exe 88 -
resource yara_rule behavioral2/files/0x0007000000023c94-10.dat dcrat behavioral2/memory/3852-13-0x0000000000430000-0x0000000000540000-memory.dmp dcrat -
Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2668 powershell.exe 1944 powershell.exe 5060 powershell.exe 4504 powershell.exe 1120 powershell.exe -
Checks computer location settings 2 TTPs 15 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation SearchApp.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation DllCommonsvc.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation SearchApp.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation SearchApp.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation SearchApp.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation SearchApp.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation SearchApp.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation SearchApp.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation SearchApp.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation SearchApp.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation JaffaCakes118_8bd5385c30b54b4890ccd384447c3532fc22fb975c00731cf134cb4e3c6677db.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation SearchApp.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation SearchApp.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation SearchApp.exe -
Executes dropped EXE 14 IoCs
pid Process 3852 DllCommonsvc.exe 680 SearchApp.exe 2364 SearchApp.exe 2448 SearchApp.exe 1796 SearchApp.exe 3076 SearchApp.exe 4380 SearchApp.exe 2444 SearchApp.exe 2692 SearchApp.exe 780 SearchApp.exe 3424 SearchApp.exe 2768 SearchApp.exe 3128 SearchApp.exe 1704 SearchApp.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 13 IoCs
flow ioc 43 raw.githubusercontent.com 44 raw.githubusercontent.com 54 raw.githubusercontent.com 15 raw.githubusercontent.com 16 raw.githubusercontent.com 21 raw.githubusercontent.com 45 raw.githubusercontent.com 51 raw.githubusercontent.com 52 raw.githubusercontent.com 53 raw.githubusercontent.com 37 raw.githubusercontent.com 38 raw.githubusercontent.com 39 raw.githubusercontent.com -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\Windows NT\TableTextService\en-US\SearchApp.exe DllCommonsvc.exe File created C:\Program Files (x86)\Windows NT\TableTextService\en-US\38384e6a620884 DllCommonsvc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_8bd5385c30b54b4890ccd384447c3532fc22fb975c00731cf134cb4e3c6677db.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies registry class 14 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings JaffaCakes118_8bd5385c30b54b4890ccd384447c3532fc22fb975c00731cf134cb4e3c6677db.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings DllCommonsvc.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings SearchApp.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 12 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2256 schtasks.exe 3400 schtasks.exe 2516 schtasks.exe 5108 schtasks.exe 4480 schtasks.exe 1928 schtasks.exe 4980 schtasks.exe 952 schtasks.exe 656 schtasks.exe 1048 schtasks.exe 2720 schtasks.exe 920 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 3852 DllCommonsvc.exe 1120 powershell.exe 2668 powershell.exe 4504 powershell.exe 1944 powershell.exe 2668 powershell.exe 5060 powershell.exe 1944 powershell.exe 1120 powershell.exe 4504 powershell.exe 5060 powershell.exe 680 SearchApp.exe 2364 SearchApp.exe 2448 SearchApp.exe 1796 SearchApp.exe 3076 SearchApp.exe 4380 SearchApp.exe 2444 SearchApp.exe 2692 SearchApp.exe 780 SearchApp.exe 3424 SearchApp.exe 2768 SearchApp.exe 3128 SearchApp.exe 1704 SearchApp.exe -
Suspicious use of AdjustPrivilegeToken 19 IoCs
description pid Process Token: SeDebugPrivilege 3852 DllCommonsvc.exe Token: SeDebugPrivilege 1120 powershell.exe Token: SeDebugPrivilege 2668 powershell.exe Token: SeDebugPrivilege 4504 powershell.exe Token: SeDebugPrivilege 1944 powershell.exe Token: SeDebugPrivilege 5060 powershell.exe Token: SeDebugPrivilege 680 SearchApp.exe Token: SeDebugPrivilege 2364 SearchApp.exe Token: SeDebugPrivilege 2448 SearchApp.exe Token: SeDebugPrivilege 1796 SearchApp.exe Token: SeDebugPrivilege 3076 SearchApp.exe Token: SeDebugPrivilege 4380 SearchApp.exe Token: SeDebugPrivilege 2444 SearchApp.exe Token: SeDebugPrivilege 2692 SearchApp.exe Token: SeDebugPrivilege 780 SearchApp.exe Token: SeDebugPrivilege 3424 SearchApp.exe Token: SeDebugPrivilege 2768 SearchApp.exe Token: SeDebugPrivilege 3128 SearchApp.exe Token: SeDebugPrivilege 1704 SearchApp.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 628 wrote to memory of 1648 628 JaffaCakes118_8bd5385c30b54b4890ccd384447c3532fc22fb975c00731cf134cb4e3c6677db.exe 83 PID 628 wrote to memory of 1648 628 JaffaCakes118_8bd5385c30b54b4890ccd384447c3532fc22fb975c00731cf134cb4e3c6677db.exe 83 PID 628 wrote to memory of 1648 628 JaffaCakes118_8bd5385c30b54b4890ccd384447c3532fc22fb975c00731cf134cb4e3c6677db.exe 83 PID 1648 wrote to memory of 1200 1648 WScript.exe 85 PID 1648 wrote to memory of 1200 1648 WScript.exe 85 PID 1648 wrote to memory of 1200 1648 WScript.exe 85 PID 1200 wrote to memory of 3852 1200 cmd.exe 87 PID 1200 wrote to memory of 3852 1200 cmd.exe 87 PID 3852 wrote to memory of 5060 3852 DllCommonsvc.exe 102 PID 3852 wrote to memory of 5060 3852 DllCommonsvc.exe 102 PID 3852 wrote to memory of 4504 3852 DllCommonsvc.exe 103 PID 3852 wrote to memory of 4504 3852 DllCommonsvc.exe 103 PID 3852 wrote to memory of 1944 3852 DllCommonsvc.exe 104 PID 3852 wrote to memory of 1944 3852 DllCommonsvc.exe 104 PID 3852 wrote to memory of 2668 3852 DllCommonsvc.exe 105 PID 3852 wrote to memory of 2668 3852 DllCommonsvc.exe 105 PID 3852 wrote to memory of 1120 3852 DllCommonsvc.exe 106 PID 3852 wrote to memory of 1120 3852 DllCommonsvc.exe 106 PID 3852 wrote to memory of 4768 3852 DllCommonsvc.exe 112 PID 3852 wrote to memory of 4768 3852 DllCommonsvc.exe 112 PID 4768 wrote to memory of 4912 4768 cmd.exe 114 PID 4768 wrote to memory of 4912 4768 cmd.exe 114 PID 4768 wrote to memory of 680 4768 cmd.exe 116 PID 4768 wrote to memory of 680 4768 cmd.exe 116 PID 680 wrote to memory of 2212 680 SearchApp.exe 123 PID 680 wrote to memory of 2212 680 SearchApp.exe 123 PID 2212 wrote to memory of 1884 2212 cmd.exe 125 PID 2212 wrote to memory of 1884 2212 cmd.exe 125 PID 2212 wrote to memory of 2364 2212 cmd.exe 132 PID 2212 wrote to memory of 2364 2212 cmd.exe 132 PID 2364 wrote to memory of 3452 2364 SearchApp.exe 134 PID 2364 wrote to memory of 3452 2364 SearchApp.exe 134 PID 3452 wrote to memory of 1200 3452 cmd.exe 136 PID 3452 wrote to memory of 1200 3452 cmd.exe 136 PID 3452 wrote to memory of 2448 3452 cmd.exe 138 PID 3452 wrote to memory of 2448 3452 cmd.exe 138 PID 2448 wrote to memory of 3012 2448 SearchApp.exe 143 PID 2448 wrote to memory of 3012 2448 SearchApp.exe 143 PID 3012 wrote to memory of 316 3012 cmd.exe 145 PID 3012 wrote to memory of 316 3012 cmd.exe 145 PID 3012 wrote to memory of 1796 3012 cmd.exe 147 PID 3012 wrote to memory of 1796 3012 cmd.exe 147 PID 1796 wrote to memory of 2232 1796 SearchApp.exe 149 PID 1796 wrote to memory of 2232 1796 SearchApp.exe 149 PID 2232 wrote to memory of 1184 2232 cmd.exe 151 PID 2232 wrote to memory of 1184 2232 cmd.exe 151 PID 2232 wrote to memory of 3076 2232 cmd.exe 153 PID 2232 wrote to memory of 3076 2232 cmd.exe 153 PID 3076 wrote to memory of 4356 3076 SearchApp.exe 155 PID 3076 wrote to memory of 4356 3076 SearchApp.exe 155 PID 4356 wrote to memory of 3720 4356 cmd.exe 157 PID 4356 wrote to memory of 3720 4356 cmd.exe 157 PID 4356 wrote to memory of 4380 4356 cmd.exe 159 PID 4356 wrote to memory of 4380 4356 cmd.exe 159 PID 4380 wrote to memory of 472 4380 SearchApp.exe 161 PID 4380 wrote to memory of 472 4380 SearchApp.exe 161 PID 472 wrote to memory of 3620 472 cmd.exe 163 PID 472 wrote to memory of 3620 472 cmd.exe 163 PID 472 wrote to memory of 2444 472 cmd.exe 165 PID 472 wrote to memory of 2444 472 cmd.exe 165 PID 2444 wrote to memory of 4860 2444 SearchApp.exe 167 PID 2444 wrote to memory of 4860 2444 SearchApp.exe 167 PID 4860 wrote to memory of 4252 4860 cmd.exe 169 PID 4860 wrote to memory of 4252 4860 cmd.exe 169 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8bd5385c30b54b4890ccd384447c3532fc22fb975c00731cf134cb4e3c6677db.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8bd5385c30b54b4890ccd384447c3532fc22fb975c00731cf134cb4e3c6677db.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:628 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\providercommon\DllCommonsvc.exe"C:\providercommon\DllCommonsvc.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3852 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5060
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\explorer.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4504
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\Idle.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1944
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows NT\TableTextService\en-US\SearchApp.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2668
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\winlogon.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1120
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\WAmQrpS1zx.bat"5⤵
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:26⤵PID:4912
-
-
C:\Program Files (x86)\Windows NT\TableTextService\en-US\SearchApp.exe"C:\Program Files (x86)\Windows NT\TableTextService\en-US\SearchApp.exe"6⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:680 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\asjVMp8zxr.bat"7⤵
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:28⤵PID:1884
-
-
C:\Program Files (x86)\Windows NT\TableTextService\en-US\SearchApp.exe"C:\Program Files (x86)\Windows NT\TableTextService\en-US\SearchApp.exe"8⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\dnlY2uCtHd.bat"9⤵
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:210⤵PID:1200
-
-
C:\Program Files (x86)\Windows NT\TableTextService\en-US\SearchApp.exe"C:\Program Files (x86)\Windows NT\TableTextService\en-US\SearchApp.exe"10⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\8OW3hmLaVA.bat"11⤵
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:212⤵PID:316
-
-
C:\Program Files (x86)\Windows NT\TableTextService\en-US\SearchApp.exe"C:\Program Files (x86)\Windows NT\TableTextService\en-US\SearchApp.exe"12⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\pkmftNZ3Wr.bat"13⤵
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:214⤵PID:1184
-
-
C:\Program Files (x86)\Windows NT\TableTextService\en-US\SearchApp.exe"C:\Program Files (x86)\Windows NT\TableTextService\en-US\SearchApp.exe"14⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3076 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\cu7QADyCUt.bat"15⤵
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:216⤵PID:3720
-
-
C:\Program Files (x86)\Windows NT\TableTextService\en-US\SearchApp.exe"C:\Program Files (x86)\Windows NT\TableTextService\en-US\SearchApp.exe"16⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\1bQudXBuXp.bat"17⤵
- Suspicious use of WriteProcessMemory
PID:472 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:218⤵PID:3620
-
-
C:\Program Files (x86)\Windows NT\TableTextService\en-US\SearchApp.exe"C:\Program Files (x86)\Windows NT\TableTextService\en-US\SearchApp.exe"18⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\V9nTU0UPEK.bat"19⤵
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:220⤵PID:4252
-
-
C:\Program Files (x86)\Windows NT\TableTextService\en-US\SearchApp.exe"C:\Program Files (x86)\Windows NT\TableTextService\en-US\SearchApp.exe"20⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2692 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\3fa1oyizme.bat"21⤵PID:1748
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:222⤵PID:3140
-
-
C:\Program Files (x86)\Windows NT\TableTextService\en-US\SearchApp.exe"C:\Program Files (x86)\Windows NT\TableTextService\en-US\SearchApp.exe"22⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:780 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\fq9TqI16of.bat"23⤵PID:2832
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:224⤵PID:3572
-
-
C:\Program Files (x86)\Windows NT\TableTextService\en-US\SearchApp.exe"C:\Program Files (x86)\Windows NT\TableTextService\en-US\SearchApp.exe"24⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3424 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\1bQudXBuXp.bat"25⤵PID:1580
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:226⤵PID:2588
-
-
C:\Program Files (x86)\Windows NT\TableTextService\en-US\SearchApp.exe"C:\Program Files (x86)\Windows NT\TableTextService\en-US\SearchApp.exe"26⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2768 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\TDlQnvRVvY.bat"27⤵PID:1500
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:228⤵PID:1100
-
-
C:\Program Files (x86)\Windows NT\TableTextService\en-US\SearchApp.exe"C:\Program Files (x86)\Windows NT\TableTextService\en-US\SearchApp.exe"28⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3128 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\R8cJcUuQgj.bat"29⤵PID:1008
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:230⤵PID:3684
-
-
C:\Program Files (x86)\Windows NT\TableTextService\en-US\SearchApp.exe"C:\Program Files (x86)\Windows NT\TableTextService\en-US\SearchApp.exe"30⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1704
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\explorer.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4980
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2256
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3400
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\Idle.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:952
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:656
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2516
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\SearchApp.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5108
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\SearchApp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1048
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\SearchApp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4480
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2720
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:920
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1928
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5baf55b95da4a601229647f25dad12878
SHA1abc16954ebfd213733c4493fc1910164d825cac8
SHA256ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
SHA51224f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD5d28a889fd956d5cb3accfbaf1143eb6f
SHA1157ba54b365341f8ff06707d996b3635da8446f7
SHA25621e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45
SHA5120b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c
-
Filesize
944B
MD52e907f77659a6601fcc408274894da2e
SHA19f5b72abef1cd7145bf37547cdb1b9254b4efe9d
SHA256385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233
SHA51234fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721
-
Filesize
944B
MD562623d22bd9e037191765d5083ce16a3
SHA14a07da6872672f715a4780513d95ed8ddeefd259
SHA25695d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010
SHA5129a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992
-
Filesize
235B
MD5bba5bdab40958a0b7e0b1a61a81913a8
SHA1549cb6f1275cbcd0b0f442290b547453c50e0817
SHA256271855e5d13daeeb486a2229ea5ab86f052f8f090f9077eaeba8f606a54cc9fa
SHA512e00c4b738ca23672a4a2aac6a1d44f8db9ba728fe96f1cf772d107ce7588e719134e291b4d67ee789b18c7e9f202518ea97c4ab284f6061afac9b0ef4e1bbc4c
-
Filesize
235B
MD5dca3b16aaaff401e2d4ac425d85911b3
SHA16fc79db30659a6e9ddc7e6b69b002a7e5f8862bf
SHA256c559934932e0d2aca7d0322447d5e177da4da1e0fb2e5ceede94b600f0a972cb
SHA512bd1f56839d71745f0f37c4f4eeae2a70cf8b41af760e14c271d2a79704fdf59c33a6b83c6dd0c861b5dfa4eef44a712ba38f4e27acf63fe4b2cfaa49623b9b52
-
Filesize
235B
MD50cc6cf81fc624cb425cb93fd164004f1
SHA10f15e774422e8c15fa82918cc65d927c0e774c62
SHA25623b269d97b4f7bf8a7d23b6b371e6278732ef3a1cb10929b6928cc791fdc9aae
SHA5126742612ae36fbcc5af112141bf4c4ab410b1bbba2c326a7cc36bd882f6857a0a2f18a9852f55edca0df8b11fcdbe755ef15cfc97d916453b6d99dfbfa74e7332
-
Filesize
235B
MD5bb51943a181eae8cfdaf31615eda39e6
SHA158e593709bed47b00a857f56825adfeb30862fd6
SHA25644a35e9af6e5c1eb1b0b0025369792fc9d20d871a8b816bed47f337f9e825e5c
SHA512fe11de2f63d1cbcdfb912c9f183a598df15d68eeb01ca9ee3d703cb6b02cf4e77c885510fce82f2d2316c8336c47cf0797ebfba1144830d24c25c7859c09a08a
-
Filesize
235B
MD5562e33379b871367f7a2a5f05a5b341e
SHA1c7b10ec0b1287d91dd648678cd6268dd1f2df3b2
SHA256bea468714264c6f3b54d5871615a9de1c9b12041204a0228e12526e7cfe5a29a
SHA512515cb4fa76db4849f5018a6cee6fcfeeb1d00aa4e70800043395d023e8a39fe0b4866395aec7596e885bfaea26996ca4e4eb89d6c6d4464a0c8d5a745a1f8af4
-
Filesize
235B
MD59453a4583850733ebd821ad26196cf40
SHA16e8dc264e6057427df2fc1cf1c321799888b5293
SHA256ec43c3c8c6ab6f19037c248ef2132baa26029d425fa3c3a61e827357c899533d
SHA51226deb2ecde81a21bd78c4234c71d58ca965e74793b00790c73c6b448253041e34d2210bef99159cd93b93065332f8b10c2dd8b09b47fc2f29a86ad5377048061
-
Filesize
235B
MD5582909e7366d2c2e4a8fda69a2d8b9a8
SHA1c2ab77573e6c4c5c0b0353b9ea575e78bff7f5e4
SHA2562fbfdf359ecced7518f7f177ce63647312cbf5d795e129947ab33add08aee20c
SHA5120b85127b68fd2491af4cb2d24abfa42cd024e46c3e6d578d442b1e8d1e5082f8cdf592c7a875fcd1f37cf47229e976722a71aa8deb491a76c6c5b3e7571dc743
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
235B
MD5fbd3aebd6b19e07bc64ae6168a364786
SHA1760e812b66cd89c44d4c62f558be0a3cb6f66672
SHA2564fb619c3dd937d65c362b3ebd67341dae851bed52f37b9218dca4e7ab4256b63
SHA512a52f40c62df3ab4d2980a63c30f2816dc1639fc0196d6447a3ac9c3824dcc97fc98f588e20d9ca65a766bbc5850e484794d9844b90169fd1676ab819f4860751
-
Filesize
235B
MD5204fe320d7e1e30b83ad54eb3b6cea39
SHA107bfb89e7978b2d594c04380a3a1fd19b7b0425d
SHA2569b0b544b416305f73395a6374c376fb8244fed3e7d1408d6652de3baf695e832
SHA512d65cdf417c92e498e31309690e00eaf91699aa10d9c6720d427f9c9f7106652e29cbfdaec68ec4a42f90df2fffbd471f88dda695a4f6c8bccb0cb5de36b97634
-
Filesize
235B
MD56b6fa310e6f21f43b3ff8721b325e40f
SHA1e1bf32a5daa269663ea0df12e52d6a687fd08f20
SHA256388881d28efa2c3440b50883716c4b4cd65371f34f9fe9cab68984c38357ccc0
SHA5129704634f7e56b78388a89fda72312105c65fb5fc9f14309eaf8fe42a8624bfa6a542a202f11560e1f24ce6832df2b4626644d960b8c95f197bfa3a07db2d22a4
-
Filesize
235B
MD5d80de1924a1d03d8a69bdff3e4a2ccc3
SHA1392fd8fbe02a6288c4e3251cd3cc41da738f9386
SHA25679e67405d09024dfbbe92f58c67502cd902d4bbd729d77f70bbac47a56da1ace
SHA5126198d0b6343e6e705742b9c8ef9c2ed24ed22642e80972e0c6c0b7ac29faca4ae33327d3032767329f7d41c3e98afd49f81428a64ecaa30702c072ae8d50813d
-
Filesize
235B
MD5e08bc543015c5bd1219d9dc49c8ca097
SHA146617e1c1c45bbe20444316d7aff96e112dea36a
SHA2566c0a436de5a721283ce1f19c79aac91e31305067ce096ffe860aee7e9672b5db
SHA5129ab9094a5d18f1bebd7aa43825ec100bcc27d4d64761ff4538749e8fef1fcb05668009f9e3795ea000d3308570babb68007c058f8f7bd5aefb841e956be502d2
-
Filesize
36B
MD56783c3ee07c7d151ceac57f1f9c8bed7
SHA117468f98f95bf504cc1f83c49e49a78526b3ea03
SHA2568ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322
SHA512c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8
-
Filesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
Filesize
197B
MD58088241160261560a02c84025d107592
SHA1083121f7027557570994c9fc211df61730455bb5
SHA2562072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1
SHA51220d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478