Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2024, 17:39
Behavioral task
behavioral1
Sample
JaffaCakes118_c0b48f072b3da8928af26a9cfad54918744f9a1f109a29d57d80156ec5816b23.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
JaffaCakes118_c0b48f072b3da8928af26a9cfad54918744f9a1f109a29d57d80156ec5816b23.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_c0b48f072b3da8928af26a9cfad54918744f9a1f109a29d57d80156ec5816b23.exe
-
Size
1.3MB
-
MD5
f0204b2ae05cf8c9a03a948357d10472
-
SHA1
5d3ef52a49b1eac17f9a4019733d0988b4e90b74
-
SHA256
c0b48f072b3da8928af26a9cfad54918744f9a1f109a29d57d80156ec5816b23
-
SHA512
169acd36e74a82c7d4a7ef71dcd01648498b6449fc9e058999a3b84776c941834567feea06b5d00854806b966fef13eadce502eda15f61814288c5c7526428af
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Process spawned unexpected child process 9 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2728 852 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3008 852 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2680 852 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 816 852 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4108 852 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2736 852 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3380 852 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4268 852 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4848 852 schtasks.exe 86 -
resource yara_rule behavioral2/files/0x000e000000023bd7-10.dat dcrat behavioral2/memory/2628-13-0x0000000000FD0000-0x00000000010E0000-memory.dmp dcrat -
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2136 powershell.exe 2172 powershell.exe 4148 powershell.exe 4020 powershell.exe -
Checks computer location settings 2 TTPs 14 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation RuntimeBroker.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation RuntimeBroker.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation RuntimeBroker.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation RuntimeBroker.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation RuntimeBroker.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation RuntimeBroker.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation RuntimeBroker.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation RuntimeBroker.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation RuntimeBroker.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation RuntimeBroker.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation JaffaCakes118_c0b48f072b3da8928af26a9cfad54918744f9a1f109a29d57d80156ec5816b23.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation DllCommonsvc.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation RuntimeBroker.exe -
Executes dropped EXE 13 IoCs
pid Process 2628 DllCommonsvc.exe 1804 RuntimeBroker.exe 4896 RuntimeBroker.exe 4244 RuntimeBroker.exe 4696 RuntimeBroker.exe 2996 RuntimeBroker.exe 468 RuntimeBroker.exe 2368 RuntimeBroker.exe 1624 RuntimeBroker.exe 2392 RuntimeBroker.exe 1984 RuntimeBroker.exe 3968 RuntimeBroker.exe 2324 RuntimeBroker.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 12 IoCs
flow ioc 51 raw.githubusercontent.com 18 raw.githubusercontent.com 38 raw.githubusercontent.com 39 raw.githubusercontent.com 40 raw.githubusercontent.com 44 raw.githubusercontent.com 45 raw.githubusercontent.com 50 raw.githubusercontent.com 52 raw.githubusercontent.com 53 raw.githubusercontent.com 17 raw.githubusercontent.com 43 raw.githubusercontent.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_c0b48f072b3da8928af26a9cfad54918744f9a1f109a29d57d80156ec5816b23.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies registry class 13 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings DllCommonsvc.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings JaffaCakes118_c0b48f072b3da8928af26a9cfad54918744f9a1f109a29d57d80156ec5816b23.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings RuntimeBroker.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 9 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3380 schtasks.exe 2728 schtasks.exe 816 schtasks.exe 4108 schtasks.exe 4268 schtasks.exe 4848 schtasks.exe 3008 schtasks.exe 2680 schtasks.exe 2736 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 25 IoCs
pid Process 2628 DllCommonsvc.exe 2628 DllCommonsvc.exe 2628 DllCommonsvc.exe 2628 DllCommonsvc.exe 2628 DllCommonsvc.exe 4148 powershell.exe 2136 powershell.exe 2172 powershell.exe 4148 powershell.exe 2136 powershell.exe 4020 powershell.exe 4020 powershell.exe 2172 powershell.exe 1804 RuntimeBroker.exe 4896 RuntimeBroker.exe 4244 RuntimeBroker.exe 4696 RuntimeBroker.exe 2996 RuntimeBroker.exe 468 RuntimeBroker.exe 2368 RuntimeBroker.exe 1624 RuntimeBroker.exe 2392 RuntimeBroker.exe 1984 RuntimeBroker.exe 3968 RuntimeBroker.exe 2324 RuntimeBroker.exe -
Suspicious use of AdjustPrivilegeToken 17 IoCs
description pid Process Token: SeDebugPrivilege 2628 DllCommonsvc.exe Token: SeDebugPrivilege 4148 powershell.exe Token: SeDebugPrivilege 2136 powershell.exe Token: SeDebugPrivilege 2172 powershell.exe Token: SeDebugPrivilege 4020 powershell.exe Token: SeDebugPrivilege 1804 RuntimeBroker.exe Token: SeDebugPrivilege 4896 RuntimeBroker.exe Token: SeDebugPrivilege 4244 RuntimeBroker.exe Token: SeDebugPrivilege 4696 RuntimeBroker.exe Token: SeDebugPrivilege 2996 RuntimeBroker.exe Token: SeDebugPrivilege 468 RuntimeBroker.exe Token: SeDebugPrivilege 2368 RuntimeBroker.exe Token: SeDebugPrivilege 1624 RuntimeBroker.exe Token: SeDebugPrivilege 2392 RuntimeBroker.exe Token: SeDebugPrivilege 1984 RuntimeBroker.exe Token: SeDebugPrivilege 3968 RuntimeBroker.exe Token: SeDebugPrivilege 2324 RuntimeBroker.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4068 wrote to memory of 3124 4068 JaffaCakes118_c0b48f072b3da8928af26a9cfad54918744f9a1f109a29d57d80156ec5816b23.exe 82 PID 4068 wrote to memory of 3124 4068 JaffaCakes118_c0b48f072b3da8928af26a9cfad54918744f9a1f109a29d57d80156ec5816b23.exe 82 PID 4068 wrote to memory of 3124 4068 JaffaCakes118_c0b48f072b3da8928af26a9cfad54918744f9a1f109a29d57d80156ec5816b23.exe 82 PID 3124 wrote to memory of 1924 3124 WScript.exe 83 PID 3124 wrote to memory of 1924 3124 WScript.exe 83 PID 3124 wrote to memory of 1924 3124 WScript.exe 83 PID 1924 wrote to memory of 2628 1924 cmd.exe 85 PID 1924 wrote to memory of 2628 1924 cmd.exe 85 PID 2628 wrote to memory of 4020 2628 DllCommonsvc.exe 96 PID 2628 wrote to memory of 4020 2628 DllCommonsvc.exe 96 PID 2628 wrote to memory of 2136 2628 DllCommonsvc.exe 97 PID 2628 wrote to memory of 2136 2628 DllCommonsvc.exe 97 PID 2628 wrote to memory of 2172 2628 DllCommonsvc.exe 98 PID 2628 wrote to memory of 2172 2628 DllCommonsvc.exe 98 PID 2628 wrote to memory of 4148 2628 DllCommonsvc.exe 99 PID 2628 wrote to memory of 4148 2628 DllCommonsvc.exe 99 PID 2628 wrote to memory of 2372 2628 DllCommonsvc.exe 104 PID 2628 wrote to memory of 2372 2628 DllCommonsvc.exe 104 PID 2372 wrote to memory of 1556 2372 cmd.exe 106 PID 2372 wrote to memory of 1556 2372 cmd.exe 106 PID 2372 wrote to memory of 1804 2372 cmd.exe 107 PID 2372 wrote to memory of 1804 2372 cmd.exe 107 PID 1804 wrote to memory of 2444 1804 RuntimeBroker.exe 112 PID 1804 wrote to memory of 2444 1804 RuntimeBroker.exe 112 PID 2444 wrote to memory of 3312 2444 cmd.exe 114 PID 2444 wrote to memory of 3312 2444 cmd.exe 114 PID 2444 wrote to memory of 4896 2444 cmd.exe 117 PID 2444 wrote to memory of 4896 2444 cmd.exe 117 PID 4896 wrote to memory of 2112 4896 RuntimeBroker.exe 120 PID 4896 wrote to memory of 2112 4896 RuntimeBroker.exe 120 PID 2112 wrote to memory of 5032 2112 cmd.exe 122 PID 2112 wrote to memory of 5032 2112 cmd.exe 122 PID 2112 wrote to memory of 4244 2112 cmd.exe 123 PID 2112 wrote to memory of 4244 2112 cmd.exe 123 PID 4244 wrote to memory of 636 4244 RuntimeBroker.exe 124 PID 4244 wrote to memory of 636 4244 RuntimeBroker.exe 124 PID 636 wrote to memory of 3996 636 cmd.exe 126 PID 636 wrote to memory of 3996 636 cmd.exe 126 PID 636 wrote to memory of 4696 636 cmd.exe 127 PID 636 wrote to memory of 4696 636 cmd.exe 127 PID 4696 wrote to memory of 4312 4696 RuntimeBroker.exe 128 PID 4696 wrote to memory of 4312 4696 RuntimeBroker.exe 128 PID 4312 wrote to memory of 1064 4312 cmd.exe 130 PID 4312 wrote to memory of 1064 4312 cmd.exe 130 PID 4312 wrote to memory of 2996 4312 cmd.exe 131 PID 4312 wrote to memory of 2996 4312 cmd.exe 131 PID 2996 wrote to memory of 8 2996 RuntimeBroker.exe 132 PID 2996 wrote to memory of 8 2996 RuntimeBroker.exe 132 PID 8 wrote to memory of 5064 8 cmd.exe 134 PID 8 wrote to memory of 5064 8 cmd.exe 134 PID 8 wrote to memory of 468 8 cmd.exe 135 PID 8 wrote to memory of 468 8 cmd.exe 135 PID 468 wrote to memory of 4916 468 RuntimeBroker.exe 136 PID 468 wrote to memory of 4916 468 RuntimeBroker.exe 136 PID 4916 wrote to memory of 1032 4916 cmd.exe 138 PID 4916 wrote to memory of 1032 4916 cmd.exe 138 PID 4916 wrote to memory of 2368 4916 cmd.exe 139 PID 4916 wrote to memory of 2368 4916 cmd.exe 139 PID 2368 wrote to memory of 5104 2368 RuntimeBroker.exe 140 PID 2368 wrote to memory of 5104 2368 RuntimeBroker.exe 140 PID 5104 wrote to memory of 2296 5104 cmd.exe 142 PID 5104 wrote to memory of 2296 5104 cmd.exe 142 PID 5104 wrote to memory of 1624 5104 cmd.exe 143 PID 5104 wrote to memory of 1624 5104 cmd.exe 143 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c0b48f072b3da8928af26a9cfad54918744f9a1f109a29d57d80156ec5816b23.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c0b48f072b3da8928af26a9cfad54918744f9a1f109a29d57d80156ec5816b23.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4068 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3124 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\providercommon\DllCommonsvc.exe"C:\providercommon\DllCommonsvc.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4020
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\sihost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2136
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\upfc.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2172
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\RuntimeBroker.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4148
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\DP6rZPVgxk.bat"5⤵
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:26⤵PID:1556
-
-
C:\providercommon\RuntimeBroker.exe"C:\providercommon\RuntimeBroker.exe"6⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\F5GJdikwFG.bat"7⤵
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:28⤵PID:3312
-
-
C:\providercommon\RuntimeBroker.exe"C:\providercommon\RuntimeBroker.exe"8⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\L8pPJcA7Kt.bat"9⤵
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:210⤵PID:5032
-
-
C:\providercommon\RuntimeBroker.exe"C:\providercommon\RuntimeBroker.exe"10⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4244 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\YpMZYQImRp.bat"11⤵
- Suspicious use of WriteProcessMemory
PID:636 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:212⤵PID:3996
-
-
C:\providercommon\RuntimeBroker.exe"C:\providercommon\RuntimeBroker.exe"12⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\vad0LeRbBz.bat"13⤵
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:214⤵PID:1064
-
-
C:\providercommon\RuntimeBroker.exe"C:\providercommon\RuntimeBroker.exe"14⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\WtKWrLEt72.bat"15⤵
- Suspicious use of WriteProcessMemory
PID:8 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:216⤵PID:5064
-
-
C:\providercommon\RuntimeBroker.exe"C:\providercommon\RuntimeBroker.exe"16⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:468 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\T7QXgceCiI.bat"17⤵
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:218⤵PID:1032
-
-
C:\providercommon\RuntimeBroker.exe"C:\providercommon\RuntimeBroker.exe"18⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\V3SaMhi525.bat"19⤵
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:220⤵PID:2296
-
-
C:\providercommon\RuntimeBroker.exe"C:\providercommon\RuntimeBroker.exe"20⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1624 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\mrWoaKD2ur.bat"21⤵PID:4280
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:222⤵PID:2564
-
-
C:\providercommon\RuntimeBroker.exe"C:\providercommon\RuntimeBroker.exe"22⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2392 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\WtKWrLEt72.bat"23⤵PID:3916
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:224⤵PID:4348
-
-
C:\providercommon\RuntimeBroker.exe"C:\providercommon\RuntimeBroker.exe"24⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1984 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\vad0LeRbBz.bat"25⤵PID:4324
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:226⤵PID:2544
-
-
C:\providercommon\RuntimeBroker.exe"C:\providercommon\RuntimeBroker.exe"26⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3968 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\uVUt9EuWwA.bat"27⤵PID:3128
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:228⤵PID:4948
-
-
C:\providercommon\RuntimeBroker.exe"C:\providercommon\RuntimeBroker.exe"28⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2324
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihosts" /sc MINUTE /mo 5 /tr "'C:\Users\Public\sihost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2728
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Users\Public\sihost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3008
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihosts" /sc MINUTE /mo 9 /tr "'C:\Users\Public\sihost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2680
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "upfcu" /sc MINUTE /mo 13 /tr "'C:\providercommon\upfc.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:816
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\providercommon\upfc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4108
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "upfcu" /sc MINUTE /mo 11 /tr "'C:\providercommon\upfc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2736
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\providercommon\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3380
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\providercommon\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4268
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\providercommon\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4848
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5baf55b95da4a601229647f25dad12878
SHA1abc16954ebfd213733c4493fc1910164d825cac8
SHA256ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
SHA51224f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD56d3e9c29fe44e90aae6ed30ccf799ca8
SHA1c7974ef72264bbdf13a2793ccf1aed11bc565dce
SHA2562360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d
SHA51260c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a
-
Filesize
944B
MD562623d22bd9e037191765d5083ce16a3
SHA14a07da6872672f715a4780513d95ed8ddeefd259
SHA25695d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010
SHA5129a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992
-
Filesize
200B
MD5db72f4abb3c888b7d5374ccdc2106327
SHA1b4898d7d7b1aaa2848ce6bf8323ae0a0011ede4e
SHA2567b4df5295131fc9ed2864b10b1dfb10d015cb469255360868dba7d9b3b023b06
SHA512fd69ff0a46612c6e6daf86e3aa5809ca5a571144a1dc79ab53d20807ceb776854596d57f3561f460c9fc306f828a005d113de522aa6f1ae313762af6ce0884b8
-
Filesize
200B
MD5904c73b63e40bec4af9123bd917cb735
SHA1f5c8ba200bf4bb50aa95b9e2a76b6c95b3f28e93
SHA256f6f42f0b92d7b1e969f35c3c03e27dbfff6e30bedf55d3f5eb2f05535fea9243
SHA512b6b593d93c8a466bf64d03d052c2c8705b02bdc99bc98dbdfba8a9d35e2ee89dadc3f75bbd5fc7d3ccf535c5994a254822c9617dc87413178bde2fb11f61c535
-
Filesize
200B
MD5b22f94d306b07814a84986e46e651430
SHA1f7a67d286c3344ed70f5dcce19b90ae5f2dc34fe
SHA2568197b8564a78f594763972b0c6c8d5217af9375eda392674ee72f913be84ad00
SHA5127e560bf119d14a58d1818ac0751d7fc6c6b9f29e1ad03acc06ebc1851bd65949bb67b810d0175aeabdd3c0446f40c015fd6457ee8fd636c8c3de28da2af517b6
-
Filesize
200B
MD55bb50a89f814b256033ea6b4dcb4f754
SHA1d7d9754929f73f84d0480fd9c1e04ee7c61694b1
SHA25636ddbd46ab7dee4096e948283c2931c6a5c0f1bfa0565f1917237bb7940e6b11
SHA5120e08f154334b3c7f80dd76f0b206df6adf0714afc22623fc154b66f1767e9f3b5221f085eb7d46318b300abe146e7c387448726620c38761df4bfe5249978a8c
-
Filesize
200B
MD5ec614d35415529e961abe66cb40ada4d
SHA1056d5892574d07c6aa2cc91e78a40e6ee032a748
SHA2568818442c4e1d5e388b2a808e2b2cdf93f07433a573799052a61c072f2a5b00a0
SHA512aa652bf884d3ac05e46bcf4f69079ea31951ea2e196a61822af1d9de8c53812908c073f774029d23c70fa002e2408f882bcb2edf3f8702569cdb9a5d6fc06933
-
Filesize
200B
MD5c2de80e275ff97192b6b6fcc22e5b3c4
SHA1fe2d14ef7874825deac867494c719e8c1af71460
SHA25680776554c788b44be6ab26b34644debadf3836decd2c3db005260b0947d5d98b
SHA512a972e9c836b0342dc45cddd316740eae936254fafcc37ef0ef3f53d84abf5f828883f2ff7064931ee86755332c40bee673a13ad983c88ce341fdf11d6631bd9a
-
Filesize
200B
MD5227e5246c78c9d66bcff090e46ad5792
SHA17b92a30c18090bbb260b28a1bd1babac3340bae9
SHA2563f2fc9f707a2b45ffadd98cb9b312cafbc0d14d468cf01f74d26d71e0f0eee3c
SHA512cd71798655ddd105e20da5c4690282865161b505b584679cc3940ecbf6db67b966cc8936fec9ab676de1cf03b534281a80152b061c8afcd02c96f687f40f7b26
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
200B
MD52268387d6ff6d0525090099c47a54ad4
SHA1376a6da73eb12f400ce0ebb19305480cbdb8f944
SHA256281184213ade2cecf1c860827a14f642db15be60d51f03897bab705bb364ab42
SHA5121ba99bea969a4fb589032def3ab4c9c37a951cc25ffb129da44f269f4a8ef861fd11d89c32d775c94f2215392fac99b1f9edcba5a93a31590afca2153e31ce0f
-
Filesize
200B
MD5b8dfaa7f3c36d0d88dca44bc82133074
SHA1284be9d09049fb0af8380cdae19906a698579bbe
SHA2562ba82f7282216f5e3327806c37150c5cb0083d79fb18f8aae383d3aac40dad03
SHA512cd2bbf70517163cf84c9748a6598c59f001ee3de6d8106db332fc5097f8b9a014ecd3d047bc8fad4cdf1abe35897c9611288a4931b31f1962016a2cbdc3b2ec3
-
Filesize
200B
MD5ccf440851d8b314fbb27112a5c4f1a2f
SHA1ff9adaa252495bf17b2a66fef57d2bb108d0a0fe
SHA2566db501233037c315bfa30ba4137ee83e52f662ac6d14f23b8faf29587bf8f869
SHA512ab548c04c08d86dfcaf9b4f6ee1ac4e39c5f28c12acb1295e0b0200af99359f231638814fd10678aae755bc4a49dbc99a87911d799cc4af49a7c5912d3b4f784
-
Filesize
36B
MD56783c3ee07c7d151ceac57f1f9c8bed7
SHA117468f98f95bf504cc1f83c49e49a78526b3ea03
SHA2568ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322
SHA512c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8
-
Filesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
Filesize
197B
MD58088241160261560a02c84025d107592
SHA1083121f7027557570994c9fc211df61730455bb5
SHA2562072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1
SHA51220d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478