darkcomet | 94c3f397f31b5cc0873ba528bffc2ba819c0ed2b438da708c76be809ff5146b9

General

Target

Result.jpg.exe
Size

1.2MB
MD5

da81c76543b3f280abfaf1c04a820c8d
SHA1

e746372c52ab53a7dcded6ffd497f10d3b84bda9
SHA256

996d745b0948add2ef943870d637afb46d4463432df4cb766509ecaa1982a35a
SHA512

8fe78aee184022b8a15646d1a847aed29e3bf463599d5b8b517a321cc876f53ebb170b03ccdddb2032a6ab420956bfd233c489e954044a93a4c7995ed41b3346

Score

10^/10

darkcomet 1 evasion persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

1

C2

sadist.ddns.net:500

Mutex

DC_MUTEX-WDGJLC3

Attributes

InstallPath
MSDCSC\msdcsc.exe
gencode
bg0tFwB3BTiD
install
true
offline_keylogger
true
persistence
true
reg_key
MicroUpdate

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

1.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	1.exe

Modifies firewall policy service 2 TTPs 3 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

msdcsc.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	msdcsc.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	msdcsc.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0"	msdcsc.exe

Executes dropped EXE 2 IoCs

Processes:

1.exemsdcsc.exe

pid process

1284 1.exe
4588 msdcsc.exe
Sets file to hidden 1 TTPs
Modifies file attributes to stop it showing in Explorer etc.
evasion

Hidden Files and Directories
T1158

pid	process
1284	1.exe
4588	msdcsc.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Result.jpg.exe1.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation	Result.jpg.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation	1.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

1.exemsdcsc.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	msdcsc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 18 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

PaintStudio.View.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	PaintStudio.View.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	PaintStudio.View.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	PaintStudio.View.exe

Modifies registry class 18 IoCs

Processes:

Result.jpg.exePaintStudio.View.exe1.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings	Result.jpg.exe
Key created	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache	PaintStudio.View.exe
Key created	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\History	PaintStudio.View.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\History\CacheVersion = "1"	PaintStudio.View.exe
Key created	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings	PaintStudio.View.exe
Key created	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Extensible Cache	PaintStudio.View.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Content\CacheVersion = "1"	PaintStudio.View.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\History\CacheLimit = "1"	PaintStudio.View.exe
Key created	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Cookies	PaintStudio.View.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	PaintStudio.View.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CacheVersion = "1"	PaintStudio.View.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	1.exe
Key created	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings\MuiCache	PaintStudio.View.exe
Key created	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Content	PaintStudio.View.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix	PaintStudio.View.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Content\CacheLimit = "51200"	PaintStudio.View.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CacheLimit = "1"	PaintStudio.View.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:"	PaintStudio.View.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

PaintStudio.View.exe

pid process

3884 PaintStudio.View.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

mspaint.exe

pid process

2580 mspaint.exe
2580 mspaint.exe

pid	process
3884	PaintStudio.View.exe

pid	process
2580	mspaint.exe
2580	mspaint.exe

Suspicious use of AdjustPrivilegeToken 51 IoCs

Processes:

1.exemsdcsc.exePaintStudio.View.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	1284	1.exe
Token: SeSecurityPrivilege	1284	1.exe
Token: SeTakeOwnershipPrivilege	1284	1.exe
Token: SeLoadDriverPrivilege	1284	1.exe
Token: SeSystemProfilePrivilege	1284	1.exe
Token: SeSystemtimePrivilege	1284	1.exe
Token: SeProfSingleProcessPrivilege	1284	1.exe
Token: SeIncBasePriorityPrivilege	1284	1.exe
Token: SeCreatePagefilePrivilege	1284	1.exe
Token: SeBackupPrivilege	1284	1.exe
Token: SeRestorePrivilege	1284	1.exe
Token: SeShutdownPrivilege	1284	1.exe
Token: SeDebugPrivilege	1284	1.exe
Token: SeSystemEnvironmentPrivilege	1284	1.exe
Token: SeChangeNotifyPrivilege	1284	1.exe
Token: SeRemoteShutdownPrivilege	1284	1.exe
Token: SeUndockPrivilege	1284	1.exe
Token: SeManageVolumePrivilege	1284	1.exe
Token: SeImpersonatePrivilege	1284	1.exe
Token: SeCreateGlobalPrivilege	1284	1.exe
Token: 33	1284	1.exe
Token: 34	1284	1.exe
Token: 35	1284	1.exe
Token: 36	1284	1.exe
Token: SeIncreaseQuotaPrivilege	4588	msdcsc.exe
Token: SeSecurityPrivilege	4588	msdcsc.exe
Token: SeTakeOwnershipPrivilege	4588	msdcsc.exe
Token: SeLoadDriverPrivilege	4588	msdcsc.exe
Token: SeSystemProfilePrivilege	4588	msdcsc.exe
Token: SeSystemtimePrivilege	4588	msdcsc.exe
Token: SeProfSingleProcessPrivilege	4588	msdcsc.exe
Token: SeIncBasePriorityPrivilege	4588	msdcsc.exe
Token: SeCreatePagefilePrivilege	4588	msdcsc.exe
Token: SeBackupPrivilege	4588	msdcsc.exe
Token: SeRestorePrivilege	4588	msdcsc.exe
Token: SeShutdownPrivilege	4588	msdcsc.exe
Token: SeDebugPrivilege	4588	msdcsc.exe
Token: SeSystemEnvironmentPrivilege	4588	msdcsc.exe
Token: SeChangeNotifyPrivilege	4588	msdcsc.exe
Token: SeRemoteShutdownPrivilege	4588	msdcsc.exe
Token: SeUndockPrivilege	4588	msdcsc.exe
Token: SeManageVolumePrivilege	4588	msdcsc.exe
Token: SeImpersonatePrivilege	4588	msdcsc.exe
Token: SeCreateGlobalPrivilege	4588	msdcsc.exe
Token: 33	4588	msdcsc.exe
Token: 34	4588	msdcsc.exe
Token: 35	4588	msdcsc.exe
Token: 36	4588	msdcsc.exe
Token: SeDebugPrivilege	3884	PaintStudio.View.exe
Token: SeDebugPrivilege	3884	PaintStudio.View.exe
Token: SeDebugPrivilege	3884	PaintStudio.View.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

mspaint.exemsdcsc.exePaintStudio.View.exe

pid process

2580 mspaint.exe
4588 msdcsc.exe
3884 PaintStudio.View.exe

pid	process
2580	mspaint.exe
4588	msdcsc.exe
3884	PaintStudio.View.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

Result.jpg.exe1.execmd.execmd.exemsdcsc.exe

description	pid	process	target process
PID 3644 wrote to memory of 2580	3644	Result.jpg.exe	mspaint.exe
PID 3644 wrote to memory of 2580	3644	Result.jpg.exe	mspaint.exe
PID 3644 wrote to memory of 2580	3644	Result.jpg.exe	mspaint.exe
PID 3644 wrote to memory of 1284	3644	Result.jpg.exe	1.exe
PID 3644 wrote to memory of 1284	3644	Result.jpg.exe	1.exe
PID 3644 wrote to memory of 1284	3644	Result.jpg.exe	1.exe
PID 1284 wrote to memory of 1608	1284	1.exe	cmd.exe
PID 1284 wrote to memory of 1608	1284	1.exe	cmd.exe
PID 1284 wrote to memory of 1608	1284	1.exe	cmd.exe
PID 1284 wrote to memory of 2012	1284	1.exe	cmd.exe
PID 1284 wrote to memory of 2012	1284	1.exe	cmd.exe
PID 1284 wrote to memory of 2012	1284	1.exe	cmd.exe
PID 1284 wrote to memory of 2164	1284	1.exe	notepad.exe
PID 1284 wrote to memory of 2164	1284	1.exe	notepad.exe
PID 1284 wrote to memory of 2164	1284	1.exe	notepad.exe
PID 1284 wrote to memory of 2164	1284	1.exe	notepad.exe
PID 1284 wrote to memory of 2164	1284	1.exe	notepad.exe
PID 1284 wrote to memory of 2164	1284	1.exe	notepad.exe
PID 1284 wrote to memory of 2164	1284	1.exe	notepad.exe
PID 1284 wrote to memory of 2164	1284	1.exe	notepad.exe
PID 1284 wrote to memory of 2164	1284	1.exe	notepad.exe
PID 1284 wrote to memory of 2164	1284	1.exe	notepad.exe
PID 1284 wrote to memory of 2164	1284	1.exe	notepad.exe
PID 1284 wrote to memory of 2164	1284	1.exe	notepad.exe
PID 1284 wrote to memory of 2164	1284	1.exe	notepad.exe
PID 1284 wrote to memory of 2164	1284	1.exe	notepad.exe
PID 1284 wrote to memory of 2164	1284	1.exe	notepad.exe
PID 1284 wrote to memory of 2164	1284	1.exe	notepad.exe
PID 1284 wrote to memory of 2164	1284	1.exe	notepad.exe
PID 1608 wrote to memory of 4756	1608	cmd.exe	attrib.exe
PID 1608 wrote to memory of 4756	1608	cmd.exe	attrib.exe
PID 1608 wrote to memory of 4756	1608	cmd.exe	attrib.exe
PID 2012 wrote to memory of 2296	2012	cmd.exe	attrib.exe
PID 2012 wrote to memory of 2296	2012	cmd.exe	attrib.exe
PID 2012 wrote to memory of 2296	2012	cmd.exe	attrib.exe
PID 1284 wrote to memory of 4588	1284	1.exe	msdcsc.exe
PID 1284 wrote to memory of 4588	1284	1.exe	msdcsc.exe
PID 1284 wrote to memory of 4588	1284	1.exe	msdcsc.exe
PID 4588 wrote to memory of 3180	4588	msdcsc.exe	iexplore.exe
PID 4588 wrote to memory of 3180	4588	msdcsc.exe	iexplore.exe
PID 4588 wrote to memory of 3180	4588	msdcsc.exe	iexplore.exe
PID 4588 wrote to memory of 4472	4588	msdcsc.exe	explorer.exe
PID 4588 wrote to memory of 4472	4588	msdcsc.exe	explorer.exe

Views/modifies file attributes 1 TTPs 2 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exeattrib.exe

pid process

4756 attrib.exe
2296 attrib.exe

pid	process
4756	attrib.exe
2296	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Result.jpg.exe
"C:\Users\Admin\AppData\Local\Temp\Result.jpg.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3644

C:\Windows\SysWOW64\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\1574605225_22.ico.jpg" /ForceBootstrapPaint3D
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2580

C:\Users\Admin\AppData\Local\Temp\1.exe
"C:\Users\Admin\AppData\Local\Temp\1.exe"
2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1284

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\1.exe" +s +h
3⤵
- Suspicious use of WriteProcessMemory
PID:1608

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Users\Admin\AppData\Local\Temp\1.exe" +s +h
4⤵
- Views/modifies file attributes
PID:4756

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
3⤵
- Suspicious use of WriteProcessMemory
PID:2012

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
4⤵
- Views/modifies file attributes
PID:2296

C:\Windows\SysWOW64\notepad.exe
notepad
3⤵
PID:2164

C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"
3⤵
- Modifies firewall policy service
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4588

C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
4⤵
PID:3180

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
4⤵
PID:4472

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc
1⤵
PID:5012

C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe
"C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe"
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3884

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s BthAvctpSvc
1⤵
PID:3596

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1

T1004

Modify Existing Service

1

T1031

Hidden Files and Directories

2

T1158

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

3

T1112

Hidden Files and Directories

2

T1158

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

3

T1082

Peripheral Device Discovery

1

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1.exe
Filesize
658KB

MD5
fbb4270367abd1e26b0a72f302b263cf

SHA1
d68d73d6eec4ab2b086babcbaeff0a85fb487067

SHA256
f06eb9383ca282824c0fa3172b4d404de4a03c1eea2ee74aeaf022514255743b

SHA512
73bc3fbe0efa3040751ccc1396362a60136e6b864862eb0682d1d1e29d7c89012f61e98ddaf102580f075315f3959997210e5c56ba34dec483b139eac8639ef9

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.exe
Filesize
658KB

MD5
fbb4270367abd1e26b0a72f302b263cf

SHA1
d68d73d6eec4ab2b086babcbaeff0a85fb487067

SHA256
f06eb9383ca282824c0fa3172b4d404de4a03c1eea2ee74aeaf022514255743b

SHA512
73bc3fbe0efa3040751ccc1396362a60136e6b864862eb0682d1d1e29d7c89012f61e98ddaf102580f075315f3959997210e5c56ba34dec483b139eac8639ef9

Download Submit
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
Filesize
658KB

MD5
fbb4270367abd1e26b0a72f302b263cf

SHA1
d68d73d6eec4ab2b086babcbaeff0a85fb487067

SHA256
f06eb9383ca282824c0fa3172b4d404de4a03c1eea2ee74aeaf022514255743b

SHA512
73bc3fbe0efa3040751ccc1396362a60136e6b864862eb0682d1d1e29d7c89012f61e98ddaf102580f075315f3959997210e5c56ba34dec483b139eac8639ef9

Download Submit
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
Filesize
658KB

MD5
fbb4270367abd1e26b0a72f302b263cf

SHA1
d68d73d6eec4ab2b086babcbaeff0a85fb487067

SHA256
f06eb9383ca282824c0fa3172b4d404de4a03c1eea2ee74aeaf022514255743b

SHA512
73bc3fbe0efa3040751ccc1396362a60136e6b864862eb0682d1d1e29d7c89012f61e98ddaf102580f075315f3959997210e5c56ba34dec483b139eac8639ef9

Download Submit
memory/1284-131-0x0000000000000000-mapping.dmp

Download
memory/1608-134-0x0000000000000000-mapping.dmp

Download
memory/2012-135-0x0000000000000000-mapping.dmp

Download
memory/2164-136-0x0000000000000000-mapping.dmp

Download
memory/2296-138-0x0000000000000000-mapping.dmp

Download
memory/2580-130-0x0000000000000000-mapping.dmp

Download
memory/4472-142-0x0000000000000000-mapping.dmp

Download
memory/4588-139-0x0000000000000000-mapping.dmp

Download
memory/4756-137-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads