dcrat | 26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448d

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13-01-2025 15:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Sigmanly_26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448d.exe
Size

1.9MB
MD5

54eff01605da5e7cbdb382c98ece2c2a
SHA1

be2ecfc24603a5e282bdfbb7780a03c1410879b8
SHA256

26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448d
SHA512

dd00705fb9741c6400145e2433af42605264a95e4c1fe44ee1579ac464463f9b493d8bdef98af4a5b03d717cd79357674cc09e5b8780c4ffe31a9704b08c89d0
SSDEEP

49152:gWLMtwyMxRizAwgueOJNN3lRHiKLWDWU:gLwyMb9ue0NTH2P

Score

10^/10

dcrat discovery infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Modifies WinLogon for persistence 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Java\\jdk-1.8\\taskhostw.exe\""	Sigmanly_26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Java\\jdk-1.8\\taskhostw.exe\", \"C:\\Program Files\\Microsoft Office\\PackageManifests\\fontdrvhost.exe\""	Sigmanly_26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Java\\jdk-1.8\\taskhostw.exe\", \"C:\\Program Files\\Microsoft Office\\PackageManifests\\fontdrvhost.exe\", \"C:\\Windows\\BitLockerDiscoveryVolumeContents\\SppExtComObj.exe\""	Sigmanly_26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Java\\jdk-1.8\\taskhostw.exe\", \"C:\\Program Files\\Microsoft Office\\PackageManifests\\fontdrvhost.exe\", \"C:\\Windows\\BitLockerDiscoveryVolumeContents\\SppExtComObj.exe\", \"C:\\Windows\\LiveKernelReports\\smss.exe\""	Sigmanly_26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Java\\jdk-1.8\\taskhostw.exe\", \"C:\\Program Files\\Microsoft Office\\PackageManifests\\fontdrvhost.exe\", \"C:\\Windows\\BitLockerDiscoveryVolumeContents\\SppExtComObj.exe\", \"C:\\Windows\\LiveKernelReports\\smss.exe\", \"C:\\Windows\\SKB\\LanguageModels\\RuntimeBroker.exe\""	Sigmanly_26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Java\\jdk-1.8\\taskhostw.exe\", \"C:\\Program Files\\Microsoft Office\\PackageManifests\\fontdrvhost.exe\", \"C:\\Windows\\BitLockerDiscoveryVolumeContents\\SppExtComObj.exe\", \"C:\\Windows\\LiveKernelReports\\smss.exe\", \"C:\\Windows\\SKB\\LanguageModels\\RuntimeBroker.exe\", \"C:\\Users\\Admin\\AppData\\Local\\Temp\\Sigmanly_26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448d.exe\""	Sigmanly_26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448d.exe

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3224	3652	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3696	3652	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	864	3652	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5008	3652	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3552	3652	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3208	3652	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5068	3652	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3184	3652	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4296	3652	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	764	3652	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4868	3652	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2944	3652	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	620	3652	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	540	3652	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4376	3652	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5064	3652	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	216	3652	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1424	3652	schtasks.exe	83

Checks computer location settings 2 TTPs 14 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	taskhostw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	taskhostw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	taskhostw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	taskhostw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	taskhostw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	taskhostw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	taskhostw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	taskhostw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	taskhostw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	taskhostw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	Sigmanly_26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448d.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	taskhostw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	taskhostw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	taskhostw.exe

Executes dropped EXE 13 IoCs

pid	Process
2096	taskhostw.exe
1992	taskhostw.exe
4832	taskhostw.exe
4724	taskhostw.exe
1276	taskhostw.exe
1952	taskhostw.exe
4992	taskhostw.exe
1068	taskhostw.exe
4672	taskhostw.exe
3044	taskhostw.exe
4596	taskhostw.exe
2564	taskhostw.exe
2608	taskhostw.exe

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Program Files\\Microsoft Office\\PackageManifests\\fontdrvhost.exe\""	Sigmanly_26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Program Files\\Microsoft Office\\PackageManifests\\fontdrvhost.exe\""	Sigmanly_26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Windows\\LiveKernelReports\\smss.exe\""	Sigmanly_26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Windows\\LiveKernelReports\\smss.exe\""	Sigmanly_26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Windows\\SKB\\LanguageModels\\RuntimeBroker.exe\""	Sigmanly_26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Sigmanly_26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448d = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Sigmanly_26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448d.exe\""	Sigmanly_26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Program Files\\Java\\jdk-1.8\\taskhostw.exe\""	Sigmanly_26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Program Files\\Java\\jdk-1.8\\taskhostw.exe\""	Sigmanly_26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Windows\\BitLockerDiscoveryVolumeContents\\SppExtComObj.exe\""	Sigmanly_26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Windows\\BitLockerDiscoveryVolumeContents\\SppExtComObj.exe\""	Sigmanly_26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Windows\\SKB\\LanguageModels\\RuntimeBroker.exe\""	Sigmanly_26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Sigmanly_26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448d = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Sigmanly_26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448d.exe\""	Sigmanly_26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448d.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\Windows\System32\CSCD63231C0E61249FAA790B59095BE75E.TMP	csc.exe
File created	\??\c:\Windows\System32\hnaorh.exe	csc.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\PackageManifests\fontdrvhost.exe	Sigmanly_26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448d.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\5b884080fd4f94	Sigmanly_26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448d.exe
File created	C:\Program Files\Java\jdk-1.8\taskhostw.exe	Sigmanly_26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448d.exe
File created	C:\Program Files\Java\jdk-1.8\ea9f0e6c9e2dcd	Sigmanly_26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448d.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SKB\LanguageModels\RuntimeBroker.exe	Sigmanly_26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448d.exe
File created	C:\Windows\SKB\LanguageModels\9e8d7a4ca61bd9	Sigmanly_26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448d.exe
File created	C:\Windows\LiveKernelReports\smss.exe	Sigmanly_26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448d.exe
File created	C:\Windows\LiveKernelReports\69ddcba757bf72	Sigmanly_26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448d.exe
File created	C:\Windows\ServiceState\EventLog\upfc.exe	Sigmanly_26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448d.exe
File created	C:\Windows\BitLockerDiscoveryVolumeContents\SppExtComObj.exe	Sigmanly_26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448d.exe
File created	C:\Windows\BitLockerDiscoveryVolumeContents\e1ef82546f0b02	Sigmanly_26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448d.exe
File created	C:\Windows\SKB\LanguageModels\RuntimeBroker.exe	Sigmanly_26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 11 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3564	PING.EXE
3236	PING.EXE
428	PING.EXE
3700	PING.EXE
4252	PING.EXE
3116	PING.EXE
4484	PING.EXE
1900	PING.EXE
2392	PING.EXE
2776	PING.EXE
2660	PING.EXE

Modifies registry class 14 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	Sigmanly_26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448d.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	taskhostw.exe

Runs ping.exe 1 TTPs 11 IoCs

Remote System Discovery

T1018

pid	Process
1900	PING.EXE
4484	PING.EXE
3116	PING.EXE
4252	PING.EXE
2392	PING.EXE
2776	PING.EXE
3236	PING.EXE
428	PING.EXE
2660	PING.EXE
3700	PING.EXE
3564	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2944	schtasks.exe
540	schtasks.exe
864	schtasks.exe
3552	schtasks.exe
3184	schtasks.exe
764	schtasks.exe
5068	schtasks.exe
4868	schtasks.exe
4376	schtasks.exe
3224	schtasks.exe
5008	schtasks.exe
3208	schtasks.exe
620	schtasks.exe
1424	schtasks.exe
3696	schtasks.exe
4296	schtasks.exe
5064	schtasks.exe
216	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4932	Sigmanly_26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448d.exe
4932	Sigmanly_26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448d.exe
4932	Sigmanly_26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448d.exe
4932	Sigmanly_26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448d.exe
4932	Sigmanly_26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448d.exe
4932	Sigmanly_26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448d.exe
4932	Sigmanly_26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448d.exe
4932	Sigmanly_26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448d.exe
4932	Sigmanly_26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448d.exe
4932	Sigmanly_26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448d.exe
4932	Sigmanly_26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448d.exe
4932	Sigmanly_26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448d.exe
4932	Sigmanly_26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448d.exe
4932	Sigmanly_26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448d.exe
4932	Sigmanly_26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448d.exe
4932	Sigmanly_26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448d.exe
4932	Sigmanly_26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448d.exe
4932	Sigmanly_26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448d.exe
4932	Sigmanly_26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448d.exe
4932	Sigmanly_26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448d.exe
4932	Sigmanly_26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448d.exe
4932	Sigmanly_26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448d.exe
4932	Sigmanly_26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448d.exe
4932	Sigmanly_26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448d.exe
4932	Sigmanly_26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448d.exe
4932	Sigmanly_26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448d.exe
4932	Sigmanly_26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448d.exe
4932	Sigmanly_26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448d.exe
4932	Sigmanly_26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448d.exe
4932	Sigmanly_26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448d.exe
4932	Sigmanly_26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448d.exe
4932	Sigmanly_26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448d.exe
4932	Sigmanly_26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448d.exe
4932	Sigmanly_26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448d.exe
4932	Sigmanly_26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448d.exe
4932	Sigmanly_26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448d.exe
4932	Sigmanly_26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448d.exe
4932	Sigmanly_26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448d.exe
4932	Sigmanly_26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448d.exe
4932	Sigmanly_26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448d.exe
4932	Sigmanly_26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448d.exe
4932	Sigmanly_26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448d.exe
4932	Sigmanly_26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448d.exe
4932	Sigmanly_26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448d.exe
4932	Sigmanly_26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448d.exe
4932	Sigmanly_26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448d.exe
4932	Sigmanly_26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448d.exe
4932	Sigmanly_26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448d.exe
4932	Sigmanly_26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448d.exe
4932	Sigmanly_26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448d.exe
4932	Sigmanly_26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448d.exe
4932	Sigmanly_26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448d.exe
4932	Sigmanly_26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448d.exe
4932	Sigmanly_26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448d.exe
4932	Sigmanly_26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448d.exe
4932	Sigmanly_26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448d.exe
4932	Sigmanly_26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448d.exe
4932	Sigmanly_26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448d.exe
4932	Sigmanly_26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448d.exe
4932	Sigmanly_26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448d.exe
4932	Sigmanly_26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448d.exe
4932	Sigmanly_26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448d.exe
4932	Sigmanly_26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448d.exe
4932	Sigmanly_26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448d.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	4932	Sigmanly_26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448d.exe
Token: SeDebugPrivilege	2096	taskhostw.exe
Token: SeDebugPrivilege	1992	taskhostw.exe
Token: SeDebugPrivilege	4832	taskhostw.exe
Token: SeDebugPrivilege	1276	taskhostw.exe
Token: SeDebugPrivilege	1952	taskhostw.exe
Token: SeDebugPrivilege	4992	taskhostw.exe
Token: SeDebugPrivilege	1068	taskhostw.exe
Token: SeDebugPrivilege	4672	taskhostw.exe
Token: SeDebugPrivilege	3044	taskhostw.exe
Token: SeDebugPrivilege	4596	taskhostw.exe
Token: SeDebugPrivilege	2564	taskhostw.exe
Token: SeDebugPrivilege	2608	taskhostw.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4932 wrote to memory of 2168	4932	Sigmanly_26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448d.exe	87
PID 4932 wrote to memory of 2168	4932	Sigmanly_26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448d.exe	87
PID 2168 wrote to memory of 3228	2168	csc.exe	89
PID 2168 wrote to memory of 3228	2168	csc.exe	89
PID 4932 wrote to memory of 5028	4932	Sigmanly_26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448d.exe	105
PID 4932 wrote to memory of 5028	4932	Sigmanly_26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448d.exe	105
PID 5028 wrote to memory of 1868	5028	cmd.exe	107
PID 5028 wrote to memory of 1868	5028	cmd.exe	107
PID 5028 wrote to memory of 1900	5028	cmd.exe	108
PID 5028 wrote to memory of 1900	5028	cmd.exe	108
PID 5028 wrote to memory of 2096	5028	cmd.exe	114
PID 5028 wrote to memory of 2096	5028	cmd.exe	114
PID 2096 wrote to memory of 4936	2096	taskhostw.exe	119
PID 2096 wrote to memory of 4936	2096	taskhostw.exe	119
PID 4936 wrote to memory of 4284	4936	cmd.exe	121
PID 4936 wrote to memory of 4284	4936	cmd.exe	121
PID 4936 wrote to memory of 2392	4936	cmd.exe	122
PID 4936 wrote to memory of 2392	4936	cmd.exe	122
PID 4936 wrote to memory of 1992	4936	cmd.exe	128
PID 4936 wrote to memory of 1992	4936	cmd.exe	128
PID 1992 wrote to memory of 3116	1992	taskhostw.exe	131
PID 1992 wrote to memory of 3116	1992	taskhostw.exe	131
PID 3116 wrote to memory of 5020	3116	cmd.exe	133
PID 3116 wrote to memory of 5020	3116	cmd.exe	133
PID 3116 wrote to memory of 4464	3116	cmd.exe	134
PID 3116 wrote to memory of 4464	3116	cmd.exe	134
PID 3116 wrote to memory of 4832	3116	cmd.exe	138
PID 3116 wrote to memory of 4832	3116	cmd.exe	138
PID 4832 wrote to memory of 3352	4832	taskhostw.exe	142
PID 4832 wrote to memory of 3352	4832	taskhostw.exe	142
PID 3352 wrote to memory of 1700	3352	cmd.exe	144
PID 3352 wrote to memory of 1700	3352	cmd.exe	144
PID 3352 wrote to memory of 3660	3352	cmd.exe	145
PID 3352 wrote to memory of 3660	3352	cmd.exe	145
PID 3352 wrote to memory of 4724	3352	cmd.exe	147
PID 3352 wrote to memory of 4724	3352	cmd.exe	147
PID 4284 wrote to memory of 3224	4284	cmd.exe	152
PID 4284 wrote to memory of 3224	4284	cmd.exe	152
PID 4284 wrote to memory of 3228	4284	cmd.exe	153
PID 4284 wrote to memory of 3228	4284	cmd.exe	153
PID 4284 wrote to memory of 1276	4284	cmd.exe	155
PID 4284 wrote to memory of 1276	4284	cmd.exe	155
PID 1276 wrote to memory of 3624	1276	taskhostw.exe	158
PID 1276 wrote to memory of 3624	1276	taskhostw.exe	158
PID 3624 wrote to memory of 4376	3624	cmd.exe	160
PID 3624 wrote to memory of 4376	3624	cmd.exe	160
PID 3624 wrote to memory of 2776	3624	cmd.exe	161
PID 3624 wrote to memory of 2776	3624	cmd.exe	161
PID 3624 wrote to memory of 1952	3624	cmd.exe	163
PID 3624 wrote to memory of 1952	3624	cmd.exe	163
PID 1952 wrote to memory of 3964	1952	taskhostw.exe	166
PID 1952 wrote to memory of 3964	1952	taskhostw.exe	166
PID 3964 wrote to memory of 3380	3964	cmd.exe	168
PID 3964 wrote to memory of 3380	3964	cmd.exe	168
PID 3964 wrote to memory of 3236	3964	cmd.exe	169
PID 3964 wrote to memory of 3236	3964	cmd.exe	169
PID 3964 wrote to memory of 4992	3964	cmd.exe	171
PID 3964 wrote to memory of 4992	3964	cmd.exe	171
PID 4992 wrote to memory of 3544	4992	taskhostw.exe	174
PID 4992 wrote to memory of 3544	4992	taskhostw.exe	174
PID 3544 wrote to memory of 4228	3544	cmd.exe	176
PID 3544 wrote to memory of 4228	3544	cmd.exe	176
PID 3544 wrote to memory of 428	3544	cmd.exe	177
PID 3544 wrote to memory of 428	3544	cmd.exe	177

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Sigmanly_26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448d.exe
"C:\Users\Admin\AppData\Local\Temp\Sigmanly_26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448d.exe"
1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4932
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\oannol0x\oannol0x.cmdline"
  2⤵
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2168
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7BF6.tmp" "c:\Windows\System32\CSCD63231C0E61249FAA790B59095BE75E.TMP"
    3⤵
    PID:3228
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\pjhAmlyPTC.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5028
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:1868
- - C:\Windows\system32\PING.EXE
    ping -n 10 localhost
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1900
- - C:\Program Files\Java\jdk-1.8\taskhostw.exe
    "C:\Program Files\Java\jdk-1.8\taskhostw.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2096
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\wle9X4LEtL.bat"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4936
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:4284
    - - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2392
    - - C:\Program Files\Java\jdk-1.8\taskhostw.exe
        
        "C:\Program Files\Java\jdk-1.8\taskhostw.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1992
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\nLkpgeVQrJ.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3116
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        7⤵
        
        PID:5020
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:4464
        
        C:\Program Files\Java\jdk-1.8\taskhostw.exe
        
        "C:\Program Files\Java\jdk-1.8\taskhostw.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4832
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\GzP9pAsQzT.bat"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:3352
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        9⤵
        
        PID:1700
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:3660
        
        C:\Program Files\Java\jdk-1.8\taskhostw.exe
        
        "C:\Program Files\Java\jdk-1.8\taskhostw.exe"
        9⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        
        PID:4724
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\jdGRDNWrIY.bat"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:4284
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        11⤵
        
        PID:3224
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:3228
        
        C:\Program Files\Java\jdk-1.8\taskhostw.exe
        
        "C:\Program Files\Java\jdk-1.8\taskhostw.exe"
        11⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1276
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\bsXeB76KRP.bat"
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:3624
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        13⤵
        
        PID:4376
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        13⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2776
        
        C:\Program Files\Java\jdk-1.8\taskhostw.exe
        
        "C:\Program Files\Java\jdk-1.8\taskhostw.exe"
        13⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1952
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\r3ED9wUyR4.bat"
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:3964
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        15⤵
        
        PID:3380
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        15⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3236
        
        C:\Program Files\Java\jdk-1.8\taskhostw.exe
        
        "C:\Program Files\Java\jdk-1.8\taskhostw.exe"
        15⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4992
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\e1ZPDUpkB4.bat"
        16⤵
        Suspicious use of WriteProcessMemory
        
        PID:3544
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        17⤵
        
        PID:4228
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        17⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:428
        
        C:\Program Files\Java\jdk-1.8\taskhostw.exe
        
        "C:\Program Files\Java\jdk-1.8\taskhostw.exe"
        17⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:1068
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\J8RurXaqj7.bat"
        18⤵
        
        PID:4104
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        19⤵
        
        PID:4476
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        19⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2660
        
        C:\Program Files\Java\jdk-1.8\taskhostw.exe
        
        "C:\Program Files\Java\jdk-1.8\taskhostw.exe"
        19⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:4672
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\r3ED9wUyR4.bat"
        20⤵
        
        PID:3308
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        21⤵
        
        PID:4424
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        21⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3700
        
        C:\Program Files\Java\jdk-1.8\taskhostw.exe
        
        "C:\Program Files\Java\jdk-1.8\taskhostw.exe"
        21⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:3044
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\vXp13JMNiQ.bat"
        22⤵
        
        PID:3336
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        23⤵
        
        PID:3964
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        23⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3116
        
        C:\Program Files\Java\jdk-1.8\taskhostw.exe
        
        "C:\Program Files\Java\jdk-1.8\taskhostw.exe"
        23⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:4596
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\J8RurXaqj7.bat"
        24⤵
        
        PID:464
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        25⤵
        
        PID:1672
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        25⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4252
        
        C:\Program Files\Java\jdk-1.8\taskhostw.exe
        
        "C:\Program Files\Java\jdk-1.8\taskhostw.exe"
        25⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:2564
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\1iyfU6Kdf1.bat"
        26⤵
        
        PID:2992
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        27⤵
        
        PID:1240
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        27⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4484
        
        C:\Program Files\Java\jdk-1.8\taskhostw.exe
        
        "C:\Program Files\Java\jdk-1.8\taskhostw.exe"
        27⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:2608
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\vXp13JMNiQ.bat"
        28⤵
        
        PID:620
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        29⤵
        
        PID:1992
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        29⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 14 /tr "'C:\Program Files\Java\jdk-1.8\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Program Files\Java\jdk-1.8\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 8 /tr "'C:\Program Files\Java\jdk-1.8\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Program Files\Microsoft Office\PackageManifests\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\PackageManifests\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\Program Files\Microsoft Office\PackageManifests\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 9 /tr "'C:\Windows\BitLockerDiscoveryVolumeContents\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Windows\BitLockerDiscoveryVolumeContents\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 12 /tr "'C:\Windows\BitLockerDiscoveryVolumeContents\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4296

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\Windows\LiveKernelReports\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\LiveKernelReports\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 14 /tr "'C:\Windows\LiveKernelReports\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Windows\SKB\LanguageModels\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\SKB\LanguageModels\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Windows\SKB\LanguageModels\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Sigmanly_26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448dS" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\AppData\Local\Temp\Sigmanly_26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448d.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Sigmanly_26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448d" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\Temp\Sigmanly_26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448d.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Sigmanly_26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448dS" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\AppData\Local\Temp\Sigmanly_26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448d.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Java\jdk-1.8\taskhostw.exe

Filesize
1.9MB

MD5
54eff01605da5e7cbdb382c98ece2c2a

SHA1
be2ecfc24603a5e282bdfbb7780a03c1410879b8

SHA256
26bda6e083db3a3c3ccaf29434850d91bbb9e10c48886a6f6a06bbf6c183448d

SHA512
dd00705fb9741c6400145e2433af42605264a95e4c1fe44ee1579ac464463f9b493d8bdef98af4a5b03d717cd79357674cc09e5b8780c4ffe31a9704b08c89d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\taskhostw.exe.log

Filesize
1KB

MD5
935ecb30a8e13f625a9a89e3b0fcbf8f

SHA1
41cb046b7b5f89955fd53949efad8e9f3971d731

SHA256
2a7b829afe6a140bb37d24cc7711749c20cdaaf9cc7c4a182ff081180b4d99e9

SHA512
1210281612b0101ce63555a1a7855589ff68e1eac5b8a2461e10808c5b92c5dd111be72406c2923a94e10b687ceda43dc24d8c22a49dab40a4af793ee6b740aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\1iyfU6Kdf1.bat

Filesize
171B

MD5
938f4ae5dcb951333515fccdf5c0e7ce

SHA1
30c3fe089d9208da419647db404f721fda984db9

SHA256
a165a726271002c46cd926b044926f96fbceb36bdaf4852d6190ab79b7f84d6d

SHA512
26b2a8fe7c9ef197a79cd8b0957ebeeccbf51ccd58c0467dae32bcb0aa86649ba2794dde7f84ed1698bef8758686855932ba20f5e7a2235d14aec751d8d06704

Download Submit
C:\Users\Admin\AppData\Local\Temp\GzP9pAsQzT.bat

Filesize
219B

MD5
24b430435cd482c39349fa881c4a42a1

SHA1
80471b08d2560479dfdec002a253ef0dcdab946b

SHA256
efdd455266a86a27535008e33f473c0ff446b1b63ef205c0242bd9ff0516ab35

SHA512
3dbbca5657c191a08f02b433dc87fceb9309c10c815769fded96847be4c9cf9c1525004647756ff6564a4413a1144305084b1ae8f1407e1e4675cebe2552f398

Download Submit
C:\Users\Admin\AppData\Local\Temp\J8RurXaqj7.bat

Filesize
171B

MD5
7fe1a1486e4861325269d7526fe94728

SHA1
e6dab7f5a188fb99623c3a5fdfaab870f2267b33

SHA256
cee29ed47e37f4bff3f076ede12e2f28c22a252fac8482737f00f9ce89273fb5

SHA512
85e8708d646befcbe94c9d3578cf00c01585cb2001c6a04bf9702515e84abfecf5cbbdb6630d0b79fa411ce67936c2e63ac8c7e920fec5fbe465ad222f1f28dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES7BF6.tmp

Filesize
1KB

MD5
3085d314827126f5318f2f4a84cbcf52

SHA1
f1127d50fbd421271040491421fcb2829067eac9

SHA256
98e5bd734b5da3880be62cdd9b825c14515aa5505353a0413de51a586f18e732

SHA512
3cdd6cf63e5543b6b78c20db759eb6b469088312804d73395ce2a348dee7e3971021ec8d2a1c929fd694a9f4049fe54210c80e9f062127904d9ae550236804b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\bsXeB76KRP.bat

Filesize
171B

MD5
a0b1835cee723fa0f4bfc15e44e3c509

SHA1
93fa00cfa0319b099ccde2755b79a16e9f955ead

SHA256
2234795faa11c0f9838fbc4bd176d4609db65f6b8d877e7611bf03722699c340

SHA512
24f62f3b42b6848ed508c2767e35a1b14a655fd3ab508f52452a12752a5c7e353467917a1703aaa418970f1d2cfa7b7eba38787743e86e1e9353a05bee797512

Download Submit
C:\Users\Admin\AppData\Local\Temp\e1ZPDUpkB4.bat

Filesize
171B

MD5
43f5720a5225887e0306671fb0ef3ab0

SHA1
64f8ff2cbfda8a7c3704a235beae153d7b8de53d

SHA256
367cedcaf1909d093a4aa42279f6d39b9372ffa1ee567f1b9fe507ccbeabac18

SHA512
08a3449ed3b9477930f088d7fa30786af2c2963a777dbc6fd484fadac2f45fb879f9e8d79278552f314f84aafb4c462058edcdba664eab7499cd55b56260fa6f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nLkpgeVQrJ.bat

Filesize
219B

MD5
b98303334347f234f7a785073f7a9716

SHA1
55efcad677336ceabfff55611414bd8db7161ded

SHA256
23e479e82aa39cc52221aaa9315d48e27f4f23f0da33c3266f2363cde0b6b163

SHA512
030d891b185ca7728cfb9b54b6c4eaf2b372be6106dc0752a3ce58f392f53bcc8b13d933a2dc6079fc74517ed87940042640ab14c2d9fa5e38498620364ee366

Download Submit
C:\Users\Admin\AppData\Local\Temp\pjhAmlyPTC.bat

Filesize
171B

MD5
19ac53226fcb249902bbc0c7743b6639

SHA1
bf5dadec97f95a31f330d088d6e702a11983dfec

SHA256
a3658061b7c66e5ca28cf0516fe30a204a6edef2562ac910fcd7a84ccca819a2

SHA512
f84dce2b29974b5c1df63fa6c315f7655172900d7994479675fc9183d9a4678a6f07c777a8c3c9d9c4cc4d77f71f7f323bc76af3b16c4751e09b522c114251fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\r3ED9wUyR4.bat

Filesize
171B

MD5
eeea4d5baf52bf47230c9a976482d335

SHA1
c23d09136230e5684089dc0713d4abe1b455f20b

SHA256
753f7a43aca227079a2d3bea0279d6ccb97dffdba7022c4d1b0b768f27f4aed4

SHA512
9bfd04ca36144ec5677357262e712ba49ec1aff1d91ba77e45dad057b0b2c491dfca1013a24270b834b1d11957bc806d68e2977f0fac46f2677e8be36c8c276a

Download Submit
C:\Users\Admin\AppData\Local\Temp\vXp13JMNiQ.bat

Filesize
171B

MD5
52214ad27960419f7d66f2276f8c7f92

SHA1
13bdf856947a8f2da095d8881ccc5d9b58dd3e51

SHA256
bcd556d3e042b7ad7298bcaccb2af7c4b33e5d1bc0b76fb5ceca51b1b21c0f7d

SHA512
4aa4dbc9cb91fecfea541ba2b662d207e2ee5b85a03a34d7cf6c353ee5db193b94c02fa06e9cae1847693247839c84ac5df3ebd8391fb3fd7ca3527a0f637db1

Download Submit
C:\Users\Admin\AppData\Local\Temp\wle9X4LEtL.bat

Filesize
171B

MD5
b7fdcd00502c42d2059c7b4494512124

SHA1
79a4f47b94bfebe78c4c7026cf11f2779e66ab55

SHA256
269c823b414021892f60808e38fbed4c69f9be4a173909f0559504b67902c315

SHA512
11d636b538357bdeb4614b09ee12b45349cc806c34f5fb52ffb7967217743274e163e7199dd0ff0ddce7bad2b1e76032109c69da0d0cbc2ecefbf1c4939c2417

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\oannol0x\oannol0x.0.cs

Filesize
375B

MD5
e5e425477f4e7b69750db273ad7b58a9

SHA1
0c1582564bfbf7f1b93e909f99163a3104fabe96

SHA256
e92179252f647592c618f8bfea97fb93e3a34cd21ba9b2936a8c6eb1ba9cce92

SHA512
fcad5cee316715e31b05ecb5881fa555f0db77d9462d6052adfd88ecbaa8773c3592e959ff964744d75227ea177774e45bb059479387bfd0b6ee26b700713b43

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\oannol0x\oannol0x.cmdline

Filesize
235B

MD5
c38081f68c51419320d43a3dd8359e79

SHA1
4573566a13c182d6a7b632868a88db82a427f050

SHA256
8e8c80f30f90dcb21fcd1f85d7f0b996fc5bbb18d9f4f7b42e39bd3fe28aed6f

SHA512
03afdc63332ca9bc230477be9dba452e17a4234187b3cf86d0c0b071c5c118cd0a2d143630cb64237da9adff1e1c35991aa840b32e3d981db74aa077a6af09a5

Download Submit
\??\c:\Windows\System32\CSCD63231C0E61249FAA790B59095BE75E.TMP

Filesize
1KB

MD5
65d5babddb4bd68783c40f9e3678613f

SHA1
71e76abb44dbea735b9faaccb8c0fad345b514f4

SHA256
d61a59849cacd91b8039a8e41a5b92a7f93e2d46c90791b9ba6b5f856008cd8f

SHA512
21223e9a32df265bb75093d1ebaa879880a947d25ac764f3452b9104893b05f2c8fe4150cb2465681df7a0554dcefdb7f623aaf54772ade878270f453ebc1bcf

Download Submit
memory/1068-152-0x000000001CE00000-0x000000001CF6A000-memory.dmp

Filesize
1.4MB

Download
memory/2564-208-0x000000001C9D0000-0x000000001CB3A000-memory.dmp

Filesize
1.4MB

Download
memory/3044-180-0x000000001C9B0000-0x000000001CB1A000-memory.dmp

Filesize
1.4MB

Download
memory/4596-194-0x000000001BFE0000-0x000000001C14A000-memory.dmp

Filesize
1.4MB

Download
memory/4672-166-0x000000001C650000-0x000000001C7BA000-memory.dmp

Filesize
1.4MB

Download
memory/4932-11-0x0000000003040000-0x0000000003090000-memory.dmp

Filesize
320KB

Download
memory/4932-6-0x0000000001530000-0x000000000153E000-memory.dmp

Filesize
56KB

Download
memory/4932-48-0x00007FFA20940000-0x00007FFA21401000-memory.dmp

Filesize
10.8MB

Download
memory/4932-52-0x00007FFA20940000-0x00007FFA21401000-memory.dmp

Filesize
10.8MB

Download
memory/4932-55-0x00007FFA20940000-0x00007FFA21401000-memory.dmp

Filesize
10.8MB

Download
memory/4932-15-0x0000000002F80000-0x0000000002F8C000-memory.dmp

Filesize
48KB

Download
memory/4932-13-0x0000000002FC0000-0x0000000002FD8000-memory.dmp

Filesize
96KB

Download
memory/4932-19-0x0000000002FE0000-0x0000000002FEE000-memory.dmp

Filesize
56KB

Download
memory/4932-8-0x00007FFA20940000-0x00007FFA21401000-memory.dmp

Filesize
10.8MB

Download
memory/4932-10-0x0000000002FA0000-0x0000000002FBC000-memory.dmp

Filesize
112KB

Download
memory/4932-7-0x00007FFA20940000-0x00007FFA21401000-memory.dmp

Filesize
10.8MB

Download
memory/4932-17-0x0000000002F90000-0x0000000002F9C000-memory.dmp

Filesize
48KB

Download
memory/4932-4-0x00007FFA20940000-0x00007FFA21401000-memory.dmp

Filesize
10.8MB

Download
memory/4932-0-0x00007FFA20943000-0x00007FFA20945000-memory.dmp

Filesize
8KB

Download
memory/4932-3-0x00007FFA20940000-0x00007FFA21401000-memory.dmp

Filesize
10.8MB

Download
memory/4932-38-0x00007FFA20940000-0x00007FFA21401000-memory.dmp

Filesize
10.8MB

Download
memory/4932-21-0x0000000002FF0000-0x0000000002FFC000-memory.dmp

Filesize
48KB

Download
memory/4932-2-0x00007FFA20940000-0x00007FFA21401000-memory.dmp

Filesize
10.8MB

Download
memory/4932-32-0x00007FFA20940000-0x00007FFA21401000-memory.dmp

Filesize
10.8MB

Download
memory/4932-22-0x00007FFA20940000-0x00007FFA21401000-memory.dmp

Filesize
10.8MB

Download
memory/4932-1-0x0000000000C70000-0x0000000000E64000-memory.dmp

Filesize
2.0MB

Download