darkcomet | c52abb32db94605646393bb19038b26915e5e946965fbef23df8bb12fa95b4b6

Analysis

max time kernel
150s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03-12-2022 01:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c52abb32db94605646393bb19038b26915e5e946965fbef23df8bb12fa95b4b6.exe
Size

384KB
MD5

fd1db0659e64c6c253a6f6b6ef624151
SHA1

d3004a293774e76624155f2e0751d2abc3a64885
SHA256

c52abb32db94605646393bb19038b26915e5e946965fbef23df8bb12fa95b4b6
SHA512

3650e7647eb478678cd459c5442223a4703f6ec7fe4a37bc644afe18821588dde06b36e488c07c718bd20f179c6937cb705343f903598ec3167bbe86248c5905
SSDEEP

6144:Hlb6SDOiIN4o2cOMayarS0IjX7n6wXmzbBFXoNWfi:H0Siiu2cOMayaZerXXmhFXPa

Score

10^/10

darkcomet persistence rat trojan upx

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies WinLogon for persistence 2 TTPs 25 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

msdcsc.exemsdcsc.exemsdcsc.exec52abb32db94605646393bb19038b26915e5e946965fbef23df8bb12fa95b4b6.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	c52abb32db94605646393bb19038b26915e5e946965fbef23df8bb12fa95b4b6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe

Executes dropped EXE 24 IoCs

Processes:

msdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exe

pid	process
1948	msdcsc.exe
1960	msdcsc.exe
1276	msdcsc.exe
1132	msdcsc.exe
1012	msdcsc.exe
1672	msdcsc.exe
1460	msdcsc.exe
1680	msdcsc.exe
1832	msdcsc.exe
1092	msdcsc.exe
1584	msdcsc.exe
1560	msdcsc.exe
1056	msdcsc.exe
2028	msdcsc.exe
2032	msdcsc.exe
2044	msdcsc.exe
1476	msdcsc.exe
1180	msdcsc.exe
608	msdcsc.exe
1020	msdcsc.exe
1008	msdcsc.exe
1524	msdcsc.exe
2020	msdcsc.exe
1312	msdcsc.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1448-55-0x0000000000400000-0x00000000004F9000-memory.dmp	upx
\Windows\SysWOW64\MSDCSC\msdcsc.exe	upx
\Windows\SysWOW64\MSDCSC\msdcsc.exe	upx
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	upx
behavioral1/memory/1448-68-0x0000000000400000-0x00000000004F9000-memory.dmp	upx
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	upx
behavioral1/memory/1948-70-0x0000000000400000-0x00000000004F9000-memory.dmp	upx
\Windows\SysWOW64\MSDCSC\msdcsc.exe	upx
\Windows\SysWOW64\MSDCSC\msdcsc.exe	upx
behavioral1/memory/1960-84-0x0000000000400000-0x00000000004F9000-memory.dmp	upx
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	upx
behavioral1/memory/1948-81-0x0000000000400000-0x00000000004F9000-memory.dmp	upx
\Windows\SysWOW64\MSDCSC\msdcsc.exe	upx
\Windows\SysWOW64\MSDCSC\msdcsc.exe	upx
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	upx
behavioral1/memory/1960-99-0x0000000000400000-0x00000000004F9000-memory.dmp	upx
behavioral1/memory/1276-100-0x0000000000400000-0x00000000004F9000-memory.dmp	upx
\Windows\SysWOW64\MSDCSC\msdcsc.exe	upx
\Windows\SysWOW64\MSDCSC\msdcsc.exe	upx
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	upx
behavioral1/memory/1276-113-0x0000000000400000-0x00000000004F9000-memory.dmp	upx
behavioral1/memory/1132-114-0x0000000000400000-0x00000000004F9000-memory.dmp	upx
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	upx
behavioral1/memory/1132-128-0x0000000000400000-0x00000000004F9000-memory.dmp	upx
\Windows\SysWOW64\MSDCSC\msdcsc.exe	upx
\Windows\SysWOW64\MSDCSC\msdcsc.exe	upx
behavioral1/memory/1012-129-0x0000000000400000-0x00000000004F9000-memory.dmp	upx
\Windows\SysWOW64\MSDCSC\msdcsc.exe	upx
\Windows\SysWOW64\MSDCSC\msdcsc.exe	upx
behavioral1/memory/1012-142-0x0000000000400000-0x00000000004F9000-memory.dmp	upx
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	upx
behavioral1/memory/1672-143-0x0000000000400000-0x00000000004F9000-memory.dmp	upx
\Windows\SysWOW64\MSDCSC\msdcsc.exe	upx
\Windows\SysWOW64\MSDCSC\msdcsc.exe	upx
behavioral1/memory/1672-156-0x0000000000400000-0x00000000004F9000-memory.dmp	upx
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	upx
behavioral1/memory/1460-157-0x0000000000400000-0x00000000004F9000-memory.dmp	upx
\Windows\SysWOW64\MSDCSC\msdcsc.exe	upx
\Windows\SysWOW64\MSDCSC\msdcsc.exe	upx
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	upx
behavioral1/memory/1460-170-0x0000000000400000-0x00000000004F9000-memory.dmp	upx
behavioral1/memory/1680-171-0x0000000000400000-0x00000000004F9000-memory.dmp	upx
\Windows\SysWOW64\MSDCSC\msdcsc.exe	upx
\Windows\SysWOW64\MSDCSC\msdcsc.exe	upx
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	upx
behavioral1/memory/1680-184-0x0000000000400000-0x00000000004F9000-memory.dmp	upx
behavioral1/memory/1832-185-0x0000000000400000-0x00000000004F9000-memory.dmp	upx
\Windows\SysWOW64\MSDCSC\msdcsc.exe	upx
\Windows\SysWOW64\MSDCSC\msdcsc.exe	upx
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	upx
behavioral1/memory/1832-191-0x0000000000400000-0x00000000004F9000-memory.dmp	upx
behavioral1/memory/1832-190-0x0000000003BC0000-0x0000000003CB9000-memory.dmp	upx
behavioral1/memory/1092-194-0x0000000000400000-0x00000000004F9000-memory.dmp	upx
\Windows\SysWOW64\MSDCSC\msdcsc.exe	upx
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	upx
\Windows\SysWOW64\MSDCSC\msdcsc.exe	upx
behavioral1/memory/1092-201-0x0000000000400000-0x00000000004F9000-memory.dmp	upx
behavioral1/memory/1584-202-0x0000000000400000-0x00000000004F9000-memory.dmp	upx
\Windows\SysWOW64\MSDCSC\msdcsc.exe	upx
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	upx
behavioral1/memory/1584-208-0x0000000000400000-0x00000000004F9000-memory.dmp	upx
\Windows\SysWOW64\MSDCSC\msdcsc.exe	upx
behavioral1/memory/1560-209-0x0000000000400000-0x00000000004F9000-memory.dmp	upx
\Windows\SysWOW64\MSDCSC\msdcsc.exe	upx

Loads dropped DLL 48 IoCs

Processes:

c52abb32db94605646393bb19038b26915e5e946965fbef23df8bb12fa95b4b6.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exe

pid	process
1448	c52abb32db94605646393bb19038b26915e5e946965fbef23df8bb12fa95b4b6.exe
1448	c52abb32db94605646393bb19038b26915e5e946965fbef23df8bb12fa95b4b6.exe
1948	msdcsc.exe
1948	msdcsc.exe
1960	msdcsc.exe
1960	msdcsc.exe
1276	msdcsc.exe
1276	msdcsc.exe
1132	msdcsc.exe
1132	msdcsc.exe
1012	msdcsc.exe
1012	msdcsc.exe
1672	msdcsc.exe
1672	msdcsc.exe
1460	msdcsc.exe
1460	msdcsc.exe
1680	msdcsc.exe
1680	msdcsc.exe
1832	msdcsc.exe
1832	msdcsc.exe
1092	msdcsc.exe
1092	msdcsc.exe
1584	msdcsc.exe
1584	msdcsc.exe
1560	msdcsc.exe
1560	msdcsc.exe
1056	msdcsc.exe
1056	msdcsc.exe
2028	msdcsc.exe
2028	msdcsc.exe
2032	msdcsc.exe
2032	msdcsc.exe
2044	msdcsc.exe
2044	msdcsc.exe
1476	msdcsc.exe
1476	msdcsc.exe
1180	msdcsc.exe
1180	msdcsc.exe
608	msdcsc.exe
608	msdcsc.exe
1020	msdcsc.exe
1020	msdcsc.exe
1008	msdcsc.exe
1008	msdcsc.exe
1524	msdcsc.exe
1524	msdcsc.exe
2020	msdcsc.exe
2020	msdcsc.exe

Adds Run key to start application 2 TTPs 25 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

msdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exec52abb32db94605646393bb19038b26915e5e946965fbef23df8bb12fa95b4b6.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	c52abb32db94605646393bb19038b26915e5e946965fbef23df8bb12fa95b4b6.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe

Drops file in System32 directory 64 IoCs

Processes:

msdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exec52abb32db94605646393bb19038b26915e5e946965fbef23df8bb12fa95b4b6.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exe

description	ioc	process
File created	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\	msdcsc.exe
File created	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\	msdcsc.exe
File created	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File created	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File created	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File created	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\	msdcsc.exe
File created	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\	msdcsc.exe
File created	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	c52abb32db94605646393bb19038b26915e5e946965fbef23df8bb12fa95b4b6.exe
File created	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File created	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File created	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\	msdcsc.exe
File created	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	c52abb32db94605646393bb19038b26915e5e946965fbef23df8bb12fa95b4b6.exe
File created	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File created	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File created	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\	msdcsc.exe
File created	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File created	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\	msdcsc.exe
File created	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File created	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\	msdcsc.exe
File created	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\	c52abb32db94605646393bb19038b26915e5e946965fbef23df8bb12fa95b4b6.exe
File created	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\	msdcsc.exe
File created	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File created	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\	msdcsc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Runs ping.exe 1 TTPs 64 IoCs

Remote System Discovery

T1018

Processes:

PING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXE

pid	process
1632	PING.EXE
1160	PING.EXE
1868	PING.EXE
1656	PING.EXE
1560	PING.EXE
324	PING.EXE
680	PING.EXE
680	PING.EXE
1704	PING.EXE
1764	PING.EXE
1404	PING.EXE
1916	PING.EXE
1716	PING.EXE
1920	PING.EXE
1716	PING.EXE
1900	PING.EXE
1312	PING.EXE
1684	PING.EXE
2044	PING.EXE
1904	PING.EXE
324	PING.EXE
1160	PING.EXE
832	PING.EXE
1868	PING.EXE
812	PING.EXE
1044	PING.EXE
2012	PING.EXE
784	PING.EXE
1928	PING.EXE
608	PING.EXE
1420	PING.EXE
820	PING.EXE
1212	PING.EXE
1188	PING.EXE
1712	PING.EXE
1212	PING.EXE
1116	PING.EXE
368	PING.EXE
1980	PING.EXE
1468	PING.EXE
1812	PING.EXE
604	PING.EXE
860	PING.EXE
1604	PING.EXE
1820	PING.EXE
1316	PING.EXE
1100	PING.EXE
1624	PING.EXE
1212	PING.EXE
860	PING.EXE
1932	PING.EXE
1368	PING.EXE
1728	PING.EXE
1284	PING.EXE
772	PING.EXE
1188	PING.EXE
1820	PING.EXE
1312	PING.EXE
668	PING.EXE
1900	PING.EXE
1556	PING.EXE
1932	PING.EXE
1368	PING.EXE
1056	PING.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

c52abb32db94605646393bb19038b26915e5e946965fbef23df8bb12fa95b4b6.exemsdcsc.exemsdcsc.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	1448	c52abb32db94605646393bb19038b26915e5e946965fbef23df8bb12fa95b4b6.exe
Token: SeSecurityPrivilege	1448	c52abb32db94605646393bb19038b26915e5e946965fbef23df8bb12fa95b4b6.exe
Token: SeTakeOwnershipPrivilege	1448	c52abb32db94605646393bb19038b26915e5e946965fbef23df8bb12fa95b4b6.exe
Token: SeLoadDriverPrivilege	1448	c52abb32db94605646393bb19038b26915e5e946965fbef23df8bb12fa95b4b6.exe
Token: SeSystemProfilePrivilege	1448	c52abb32db94605646393bb19038b26915e5e946965fbef23df8bb12fa95b4b6.exe
Token: SeSystemtimePrivilege	1448	c52abb32db94605646393bb19038b26915e5e946965fbef23df8bb12fa95b4b6.exe
Token: SeProfSingleProcessPrivilege	1448	c52abb32db94605646393bb19038b26915e5e946965fbef23df8bb12fa95b4b6.exe
Token: SeIncBasePriorityPrivilege	1448	c52abb32db94605646393bb19038b26915e5e946965fbef23df8bb12fa95b4b6.exe
Token: SeCreatePagefilePrivilege	1448	c52abb32db94605646393bb19038b26915e5e946965fbef23df8bb12fa95b4b6.exe
Token: SeBackupPrivilege	1448	c52abb32db94605646393bb19038b26915e5e946965fbef23df8bb12fa95b4b6.exe
Token: SeRestorePrivilege	1448	c52abb32db94605646393bb19038b26915e5e946965fbef23df8bb12fa95b4b6.exe
Token: SeShutdownPrivilege	1448	c52abb32db94605646393bb19038b26915e5e946965fbef23df8bb12fa95b4b6.exe
Token: SeDebugPrivilege	1448	c52abb32db94605646393bb19038b26915e5e946965fbef23df8bb12fa95b4b6.exe
Token: SeSystemEnvironmentPrivilege	1448	c52abb32db94605646393bb19038b26915e5e946965fbef23df8bb12fa95b4b6.exe
Token: SeChangeNotifyPrivilege	1448	c52abb32db94605646393bb19038b26915e5e946965fbef23df8bb12fa95b4b6.exe
Token: SeRemoteShutdownPrivilege	1448	c52abb32db94605646393bb19038b26915e5e946965fbef23df8bb12fa95b4b6.exe
Token: SeUndockPrivilege	1448	c52abb32db94605646393bb19038b26915e5e946965fbef23df8bb12fa95b4b6.exe
Token: SeManageVolumePrivilege	1448	c52abb32db94605646393bb19038b26915e5e946965fbef23df8bb12fa95b4b6.exe
Token: SeImpersonatePrivilege	1448	c52abb32db94605646393bb19038b26915e5e946965fbef23df8bb12fa95b4b6.exe
Token: SeCreateGlobalPrivilege	1448	c52abb32db94605646393bb19038b26915e5e946965fbef23df8bb12fa95b4b6.exe
Token: 33	1448	c52abb32db94605646393bb19038b26915e5e946965fbef23df8bb12fa95b4b6.exe
Token: 34	1448	c52abb32db94605646393bb19038b26915e5e946965fbef23df8bb12fa95b4b6.exe
Token: 35	1448	c52abb32db94605646393bb19038b26915e5e946965fbef23df8bb12fa95b4b6.exe
Token: SeIncreaseQuotaPrivilege	1948	msdcsc.exe
Token: SeSecurityPrivilege	1948	msdcsc.exe
Token: SeTakeOwnershipPrivilege	1948	msdcsc.exe
Token: SeLoadDriverPrivilege	1948	msdcsc.exe
Token: SeSystemProfilePrivilege	1948	msdcsc.exe
Token: SeSystemtimePrivilege	1948	msdcsc.exe
Token: SeProfSingleProcessPrivilege	1948	msdcsc.exe
Token: SeIncBasePriorityPrivilege	1948	msdcsc.exe
Token: SeCreatePagefilePrivilege	1948	msdcsc.exe
Token: SeBackupPrivilege	1948	msdcsc.exe
Token: SeRestorePrivilege	1948	msdcsc.exe
Token: SeShutdownPrivilege	1948	msdcsc.exe
Token: SeDebugPrivilege	1948	msdcsc.exe
Token: SeSystemEnvironmentPrivilege	1948	msdcsc.exe
Token: SeChangeNotifyPrivilege	1948	msdcsc.exe
Token: SeRemoteShutdownPrivilege	1948	msdcsc.exe
Token: SeUndockPrivilege	1948	msdcsc.exe
Token: SeManageVolumePrivilege	1948	msdcsc.exe
Token: SeImpersonatePrivilege	1948	msdcsc.exe
Token: SeCreateGlobalPrivilege	1948	msdcsc.exe
Token: 33	1948	msdcsc.exe
Token: 34	1948	msdcsc.exe
Token: 35	1948	msdcsc.exe
Token: SeIncreaseQuotaPrivilege	1960	msdcsc.exe
Token: SeSecurityPrivilege	1960	msdcsc.exe
Token: SeTakeOwnershipPrivilege	1960	msdcsc.exe
Token: SeLoadDriverPrivilege	1960	msdcsc.exe
Token: SeSystemProfilePrivilege	1960	msdcsc.exe
Token: SeSystemtimePrivilege	1960	msdcsc.exe
Token: SeProfSingleProcessPrivilege	1960	msdcsc.exe
Token: SeIncBasePriorityPrivilege	1960	msdcsc.exe
Token: SeCreatePagefilePrivilege	1960	msdcsc.exe
Token: SeBackupPrivilege	1960	msdcsc.exe
Token: SeRestorePrivilege	1960	msdcsc.exe
Token: SeShutdownPrivilege	1960	msdcsc.exe
Token: SeDebugPrivilege	1960	msdcsc.exe
Token: SeSystemEnvironmentPrivilege	1960	msdcsc.exe
Token: SeChangeNotifyPrivilege	1960	msdcsc.exe
Token: SeRemoteShutdownPrivilege	1960	msdcsc.exe
Token: SeUndockPrivilege	1960	msdcsc.exe
Token: SeManageVolumePrivilege	1960	msdcsc.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

c52abb32db94605646393bb19038b26915e5e946965fbef23df8bb12fa95b4b6.execmd.execmd.execmd.exemsdcsc.execmd.execmd.execmd.exemsdcsc.exe

description	pid	process	target process
PID 1448 wrote to memory of 1936	1448	c52abb32db94605646393bb19038b26915e5e946965fbef23df8bb12fa95b4b6.exe	cmd.exe
PID 1448 wrote to memory of 1936	1448	c52abb32db94605646393bb19038b26915e5e946965fbef23df8bb12fa95b4b6.exe	cmd.exe
PID 1448 wrote to memory of 1936	1448	c52abb32db94605646393bb19038b26915e5e946965fbef23df8bb12fa95b4b6.exe	cmd.exe
PID 1448 wrote to memory of 1936	1448	c52abb32db94605646393bb19038b26915e5e946965fbef23df8bb12fa95b4b6.exe	cmd.exe
PID 1448 wrote to memory of 1156	1448	c52abb32db94605646393bb19038b26915e5e946965fbef23df8bb12fa95b4b6.exe	cmd.exe
PID 1448 wrote to memory of 1156	1448	c52abb32db94605646393bb19038b26915e5e946965fbef23df8bb12fa95b4b6.exe	cmd.exe
PID 1448 wrote to memory of 1156	1448	c52abb32db94605646393bb19038b26915e5e946965fbef23df8bb12fa95b4b6.exe	cmd.exe
PID 1448 wrote to memory of 1156	1448	c52abb32db94605646393bb19038b26915e5e946965fbef23df8bb12fa95b4b6.exe	cmd.exe
PID 1448 wrote to memory of 600	1448	c52abb32db94605646393bb19038b26915e5e946965fbef23df8bb12fa95b4b6.exe	cmd.exe
PID 1448 wrote to memory of 600	1448	c52abb32db94605646393bb19038b26915e5e946965fbef23df8bb12fa95b4b6.exe	cmd.exe
PID 1448 wrote to memory of 600	1448	c52abb32db94605646393bb19038b26915e5e946965fbef23df8bb12fa95b4b6.exe	cmd.exe
PID 1448 wrote to memory of 600	1448	c52abb32db94605646393bb19038b26915e5e946965fbef23df8bb12fa95b4b6.exe	cmd.exe
PID 1936 wrote to memory of 680	1936	cmd.exe	PING.EXE
PID 1936 wrote to memory of 680	1936	cmd.exe	PING.EXE
PID 1936 wrote to memory of 680	1936	cmd.exe	PING.EXE
PID 1936 wrote to memory of 680	1936	cmd.exe	PING.EXE
PID 1156 wrote to memory of 1468	1156	cmd.exe	PING.EXE
PID 1156 wrote to memory of 1468	1156	cmd.exe	PING.EXE
PID 1156 wrote to memory of 1468	1156	cmd.exe	PING.EXE
PID 1156 wrote to memory of 1468	1156	cmd.exe	PING.EXE
PID 600 wrote to memory of 1056	600	cmd.exe	PING.EXE
PID 600 wrote to memory of 1056	600	cmd.exe	PING.EXE
PID 600 wrote to memory of 1056	600	cmd.exe	PING.EXE
PID 600 wrote to memory of 1056	600	cmd.exe	PING.EXE
PID 1448 wrote to memory of 1948	1448	c52abb32db94605646393bb19038b26915e5e946965fbef23df8bb12fa95b4b6.exe	msdcsc.exe
PID 1448 wrote to memory of 1948	1448	c52abb32db94605646393bb19038b26915e5e946965fbef23df8bb12fa95b4b6.exe	msdcsc.exe
PID 1448 wrote to memory of 1948	1448	c52abb32db94605646393bb19038b26915e5e946965fbef23df8bb12fa95b4b6.exe	msdcsc.exe
PID 1448 wrote to memory of 1948	1448	c52abb32db94605646393bb19038b26915e5e946965fbef23df8bb12fa95b4b6.exe	msdcsc.exe
PID 1948 wrote to memory of 1540	1948	msdcsc.exe	cmd.exe
PID 1948 wrote to memory of 1540	1948	msdcsc.exe	cmd.exe
PID 1948 wrote to memory of 1540	1948	msdcsc.exe	cmd.exe
PID 1948 wrote to memory of 1540	1948	msdcsc.exe	cmd.exe
PID 1948 wrote to memory of 904	1948	msdcsc.exe	cmd.exe
PID 1948 wrote to memory of 904	1948	msdcsc.exe	cmd.exe
PID 1948 wrote to memory of 904	1948	msdcsc.exe	cmd.exe
PID 1948 wrote to memory of 904	1948	msdcsc.exe	cmd.exe
PID 1948 wrote to memory of 1892	1948	msdcsc.exe	cmd.exe
PID 1948 wrote to memory of 1892	1948	msdcsc.exe	cmd.exe
PID 1948 wrote to memory of 1892	1948	msdcsc.exe	cmd.exe
PID 1948 wrote to memory of 1892	1948	msdcsc.exe	cmd.exe
PID 1892 wrote to memory of 1716	1892	cmd.exe	PING.EXE
PID 1892 wrote to memory of 1716	1892	cmd.exe	PING.EXE
PID 1892 wrote to memory of 1716	1892	cmd.exe	PING.EXE
PID 1892 wrote to memory of 1716	1892	cmd.exe	PING.EXE
PID 1540 wrote to memory of 2012	1540	cmd.exe	PING.EXE
PID 1540 wrote to memory of 2012	1540	cmd.exe	PING.EXE
PID 1540 wrote to memory of 2012	1540	cmd.exe	PING.EXE
PID 1540 wrote to memory of 2012	1540	cmd.exe	PING.EXE
PID 904 wrote to memory of 784	904	cmd.exe	PING.EXE
PID 904 wrote to memory of 784	904	cmd.exe	PING.EXE
PID 904 wrote to memory of 784	904	cmd.exe	PING.EXE
PID 904 wrote to memory of 784	904	cmd.exe	PING.EXE
PID 1948 wrote to memory of 1960	1948	msdcsc.exe	msdcsc.exe
PID 1948 wrote to memory of 1960	1948	msdcsc.exe	msdcsc.exe
PID 1948 wrote to memory of 1960	1948	msdcsc.exe	msdcsc.exe
PID 1948 wrote to memory of 1960	1948	msdcsc.exe	msdcsc.exe
PID 1960 wrote to memory of 1528	1960	msdcsc.exe	cmd.exe
PID 1960 wrote to memory of 1528	1960	msdcsc.exe	cmd.exe
PID 1960 wrote to memory of 1528	1960	msdcsc.exe	cmd.exe
PID 1960 wrote to memory of 1528	1960	msdcsc.exe	cmd.exe
PID 1960 wrote to memory of 1020	1960	msdcsc.exe	cmd.exe
PID 1960 wrote to memory of 1020	1960	msdcsc.exe	cmd.exe
PID 1960 wrote to memory of 1020	1960	msdcsc.exe	cmd.exe
PID 1960 wrote to memory of 1020	1960	msdcsc.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\c52abb32db94605646393bb19038b26915e5e946965fbef23df8bb12fa95b4b6.exe
"C:\Users\Admin\AppData\Local\Temp\c52abb32db94605646393bb19038b26915e5e946965fbef23df8bb12fa95b4b6.exe"
1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1448

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
2⤵
- Suspicious use of WriteProcessMemory
PID:1936

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
3⤵
- Runs ping.exe
PID:680

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
2⤵
- Suspicious use of WriteProcessMemory
PID:1156

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
3⤵
- Runs ping.exe
PID:1468

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
2⤵
- Suspicious use of WriteProcessMemory
PID:600

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
3⤵
PID:1056

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1948

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
3⤵
- Suspicious use of WriteProcessMemory
PID:1540

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
4⤵
- Runs ping.exe
PID:2012

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
3⤵
- Suspicious use of WriteProcessMemory
PID:904

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
4⤵
- Runs ping.exe
PID:784

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
3⤵
- Suspicious use of WriteProcessMemory
PID:1892

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
4⤵
- Runs ping.exe
PID:1716

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
3⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1960

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
4⤵
PID:1528

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
5⤵
- Runs ping.exe
PID:1188

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
4⤵
PID:1020

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
5⤵
- Runs ping.exe
PID:1632

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
4⤵
PID:1600

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
5⤵
- Runs ping.exe
PID:1932

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
4⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
PID:1276

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
5⤵
PID:1636

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
6⤵
- Runs ping.exe
PID:1820

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
5⤵
PID:1648

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
6⤵
- Runs ping.exe
PID:1160

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
5⤵
PID:2020

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
6⤵
PID:1468

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
5⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
PID:1132

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
6⤵
PID:1924

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
7⤵
- Runs ping.exe
PID:1368

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
6⤵
PID:1204

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
7⤵
- Runs ping.exe
PID:1900

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
6⤵
PID:1656

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
7⤵
- Runs ping.exe
PID:1928

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
6⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
PID:1012

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
7⤵
PID:1968

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
8⤵
- Runs ping.exe
PID:1932

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
7⤵
PID:1100

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
8⤵
- Runs ping.exe
PID:1712

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
7⤵
PID:980

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
8⤵
- Runs ping.exe
PID:1312

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
7⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
PID:1672

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
8⤵
PID:1892

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
9⤵
- Runs ping.exe
PID:1812

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
8⤵
PID:288

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
9⤵
- Runs ping.exe
PID:1056

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
8⤵
PID:1040

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
9⤵
- Runs ping.exe
PID:1704

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
8⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
PID:1460

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
9⤵
PID:528

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
10⤵
- Runs ping.exe
PID:1368

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
9⤵
PID:860

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
10⤵
- Runs ping.exe
PID:604

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
9⤵
PID:1320

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
10⤵
- Runs ping.exe
PID:1684

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
9⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
PID:1680

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
10⤵
PID:832

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
11⤵
- Runs ping.exe
PID:1316

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
10⤵
PID:436

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
11⤵
- Runs ping.exe
PID:1560

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
10⤵
PID:2012

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
11⤵
- Runs ping.exe
PID:1100

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
10⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
PID:1832

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
11⤵
PID:1648

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
12⤵
PID:556

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
11⤵
PID:632

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
12⤵
- Runs ping.exe
PID:2044

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
11⤵
PID:1536

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
12⤵
- Runs ping.exe
PID:1624

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
11⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
PID:1092

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
12⤵
PID:1556

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
13⤵
- Runs ping.exe
PID:860

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
12⤵
PID:1920

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
13⤵
- Runs ping.exe
PID:1904

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
12⤵
PID:1524

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
13⤵
- Runs ping.exe
PID:1284

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
12⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
PID:1584

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
13⤵
PID:964

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
14⤵
- Runs ping.exe
PID:772

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
13⤵
PID:680

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
14⤵
- Runs ping.exe
PID:1212

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
13⤵
PID:1940

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
14⤵
- Runs ping.exe
PID:832

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
13⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
PID:1560

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
14⤵
PID:1668

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
15⤵
PID:608

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
14⤵
PID:1956

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
15⤵
- Runs ping.exe
PID:1716

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
14⤵
PID:1868

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
15⤵
- Runs ping.exe
PID:1764

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
14⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
PID:1056

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
15⤵
PID:980

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
16⤵
- Runs ping.exe
PID:1820

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
15⤵
PID:1600

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
16⤵
PID:1504

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
15⤵
PID:552

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
16⤵
- Runs ping.exe
PID:860

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
15⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
PID:2028

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
16⤵
PID:1608

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
17⤵
- Runs ping.exe
PID:1312

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
16⤵
PID:1528

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
17⤵
- Runs ping.exe
PID:1212

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
16⤵
PID:1536

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
17⤵
- Runs ping.exe
PID:1728

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
16⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
PID:2032

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
17⤵
PID:668

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
18⤵
- Runs ping.exe
PID:1920

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
17⤵
PID:2036

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
18⤵
- Runs ping.exe
PID:1404

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
17⤵
PID:1148

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
18⤵
- Runs ping.exe
PID:608

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
17⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
PID:2044

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
18⤵
PID:1908

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
19⤵
- Runs ping.exe
PID:324

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
18⤵
PID:572

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
19⤵
PID:1952

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
18⤵
PID:956

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
19⤵
- Runs ping.exe
PID:1420

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
18⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
PID:1476

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
19⤵
PID:1044

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
20⤵
- Runs ping.exe
PID:820

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
19⤵
PID:1544

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
20⤵
- Runs ping.exe
PID:1868

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
19⤵
PID:1316

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
20⤵
PID:816

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
19⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
PID:1180

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
20⤵
PID:1932

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
21⤵
- Runs ping.exe
PID:1916

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
20⤵
PID:2008

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
21⤵
- Runs ping.exe
PID:668

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
20⤵
PID:1048

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
21⤵
- Runs ping.exe
PID:1116

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
20⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
PID:608

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
21⤵
PID:784

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
22⤵
- Runs ping.exe
PID:812

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
21⤵
PID:1696

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
22⤵
- Runs ping.exe
PID:324

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
21⤵
PID:1580

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
22⤵
- Runs ping.exe
PID:1188

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
21⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
PID:1020

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
22⤵
PID:1616

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
23⤵
- Runs ping.exe
PID:1044

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
22⤵
PID:436

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
23⤵
- Runs ping.exe
PID:1900

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
22⤵
PID:1312

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
23⤵
- Runs ping.exe
PID:1868

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
22⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
PID:1008

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
23⤵
PID:1716

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
24⤵
- Runs ping.exe
PID:1604

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
23⤵
PID:1284

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
24⤵
- Runs ping.exe
PID:1556

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
23⤵
PID:980

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
24⤵
- Runs ping.exe
PID:1656

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
23⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
PID:1524

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
24⤵
PID:1420

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
25⤵
- Runs ping.exe
PID:1160

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
24⤵
PID:1736

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
25⤵
- Runs ping.exe
PID:368

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
24⤵
PID:1732

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
25⤵
- Runs ping.exe
PID:680

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
24⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
PID:2020

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
25⤵
PID:1936

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
26⤵
- Runs ping.exe
PID:1980

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
25⤵
PID:1972

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
26⤵
- Runs ping.exe
PID:1212

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
25⤵
PID:1968

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
26⤵
PID:604

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
25⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:1312

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

T1004

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Remote System Discovery

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat
Filesize
131B

MD5
fa5e4409731a04062d34bbcc60914374

SHA1
0ebd1dfb094fe66ede921918a9efa4ef88527f29

SHA256
cb01da5f82bb69690006fce20f95a9c4b644f8c9b65c1254e830ec6271907f71

SHA512
f3d911283116ef1975a1f1b0a25b123bd1f66431e849dae084a804bee5029be720371a28e333f1a957df2c47180ab371a8e3eedc80916f7669aeb85143912054

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat
Filesize
66B

MD5
928f845a43174a6b50c9d6570ffcdb80

SHA1
9629e5d002dc135413b955de93265f94bbb52411

SHA256
7b6ab8d8dd0c4871db96bb2ebe5f00596e891b6585edd125836bff6410ba5c37

SHA512
2b7b6e68fde35cd63ba2d9a13d5929988fba551b9ec546558a56ea7588bd146032b4473bcac733d4c3a938bf86bdac392e28208c8a4c71f7ffb2f37b8f680f63

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat
Filesize
66B

MD5
928f845a43174a6b50c9d6570ffcdb80

SHA1
9629e5d002dc135413b955de93265f94bbb52411

SHA256
7b6ab8d8dd0c4871db96bb2ebe5f00596e891b6585edd125836bff6410ba5c37

SHA512
2b7b6e68fde35cd63ba2d9a13d5929988fba551b9ec546558a56ea7588bd146032b4473bcac733d4c3a938bf86bdac392e28208c8a4c71f7ffb2f37b8f680f63

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat
Filesize
66B

MD5
928f845a43174a6b50c9d6570ffcdb80

SHA1
9629e5d002dc135413b955de93265f94bbb52411

SHA256
7b6ab8d8dd0c4871db96bb2ebe5f00596e891b6585edd125836bff6410ba5c37

SHA512
2b7b6e68fde35cd63ba2d9a13d5929988fba551b9ec546558a56ea7588bd146032b4473bcac733d4c3a938bf86bdac392e28208c8a4c71f7ffb2f37b8f680f63

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat
Filesize
66B

MD5
928f845a43174a6b50c9d6570ffcdb80

SHA1
9629e5d002dc135413b955de93265f94bbb52411

SHA256
7b6ab8d8dd0c4871db96bb2ebe5f00596e891b6585edd125836bff6410ba5c37

SHA512
2b7b6e68fde35cd63ba2d9a13d5929988fba551b9ec546558a56ea7588bd146032b4473bcac733d4c3a938bf86bdac392e28208c8a4c71f7ffb2f37b8f680f63

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat
Filesize
66B

MD5
928f845a43174a6b50c9d6570ffcdb80

SHA1
9629e5d002dc135413b955de93265f94bbb52411

SHA256
7b6ab8d8dd0c4871db96bb2ebe5f00596e891b6585edd125836bff6410ba5c37

SHA512
2b7b6e68fde35cd63ba2d9a13d5929988fba551b9ec546558a56ea7588bd146032b4473bcac733d4c3a938bf86bdac392e28208c8a4c71f7ffb2f37b8f680f63

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat
Filesize
66B

MD5
928f845a43174a6b50c9d6570ffcdb80

SHA1
9629e5d002dc135413b955de93265f94bbb52411

SHA256
7b6ab8d8dd0c4871db96bb2ebe5f00596e891b6585edd125836bff6410ba5c37

SHA512
2b7b6e68fde35cd63ba2d9a13d5929988fba551b9ec546558a56ea7588bd146032b4473bcac733d4c3a938bf86bdac392e28208c8a4c71f7ffb2f37b8f680f63

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat
Filesize
66B

MD5
928f845a43174a6b50c9d6570ffcdb80

SHA1
9629e5d002dc135413b955de93265f94bbb52411

SHA256
7b6ab8d8dd0c4871db96bb2ebe5f00596e891b6585edd125836bff6410ba5c37

SHA512
2b7b6e68fde35cd63ba2d9a13d5929988fba551b9ec546558a56ea7588bd146032b4473bcac733d4c3a938bf86bdac392e28208c8a4c71f7ffb2f37b8f680f63

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat
Filesize
66B

MD5
928f845a43174a6b50c9d6570ffcdb80

SHA1
9629e5d002dc135413b955de93265f94bbb52411

SHA256
7b6ab8d8dd0c4871db96bb2ebe5f00596e891b6585edd125836bff6410ba5c37

SHA512
2b7b6e68fde35cd63ba2d9a13d5929988fba551b9ec546558a56ea7588bd146032b4473bcac733d4c3a938bf86bdac392e28208c8a4c71f7ffb2f37b8f680f63

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat
Filesize
66B

MD5
928f845a43174a6b50c9d6570ffcdb80

SHA1
9629e5d002dc135413b955de93265f94bbb52411

SHA256
7b6ab8d8dd0c4871db96bb2ebe5f00596e891b6585edd125836bff6410ba5c37

SHA512
2b7b6e68fde35cd63ba2d9a13d5929988fba551b9ec546558a56ea7588bd146032b4473bcac733d4c3a938bf86bdac392e28208c8a4c71f7ffb2f37b8f680f63

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat
Filesize
66B

MD5
928f845a43174a6b50c9d6570ffcdb80

SHA1
9629e5d002dc135413b955de93265f94bbb52411

SHA256
7b6ab8d8dd0c4871db96bb2ebe5f00596e891b6585edd125836bff6410ba5c37

SHA512
2b7b6e68fde35cd63ba2d9a13d5929988fba551b9ec546558a56ea7588bd146032b4473bcac733d4c3a938bf86bdac392e28208c8a4c71f7ffb2f37b8f680f63

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat
Filesize
66B

MD5
928f845a43174a6b50c9d6570ffcdb80

SHA1
9629e5d002dc135413b955de93265f94bbb52411

SHA256
7b6ab8d8dd0c4871db96bb2ebe5f00596e891b6585edd125836bff6410ba5c37

SHA512
2b7b6e68fde35cd63ba2d9a13d5929988fba551b9ec546558a56ea7588bd146032b4473bcac733d4c3a938bf86bdac392e28208c8a4c71f7ffb2f37b8f680f63

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat
Filesize
66B

MD5
928f845a43174a6b50c9d6570ffcdb80

SHA1
9629e5d002dc135413b955de93265f94bbb52411

SHA256
7b6ab8d8dd0c4871db96bb2ebe5f00596e891b6585edd125836bff6410ba5c37

SHA512
2b7b6e68fde35cd63ba2d9a13d5929988fba551b9ec546558a56ea7588bd146032b4473bcac733d4c3a938bf86bdac392e28208c8a4c71f7ffb2f37b8f680f63

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat
Filesize
66B

MD5
928f845a43174a6b50c9d6570ffcdb80

SHA1
9629e5d002dc135413b955de93265f94bbb52411

SHA256
7b6ab8d8dd0c4871db96bb2ebe5f00596e891b6585edd125836bff6410ba5c37

SHA512
2b7b6e68fde35cd63ba2d9a13d5929988fba551b9ec546558a56ea7588bd146032b4473bcac733d4c3a938bf86bdac392e28208c8a4c71f7ffb2f37b8f680f63

Download Submit
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
Filesize
384KB

MD5
fd1db0659e64c6c253a6f6b6ef624151

SHA1
d3004a293774e76624155f2e0751d2abc3a64885

SHA256
c52abb32db94605646393bb19038b26915e5e946965fbef23df8bb12fa95b4b6

SHA512
3650e7647eb478678cd459c5442223a4703f6ec7fe4a37bc644afe18821588dde06b36e488c07c718bd20f179c6937cb705343f903598ec3167bbe86248c5905

Download Submit
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
Filesize
384KB

MD5
fd1db0659e64c6c253a6f6b6ef624151

SHA1
d3004a293774e76624155f2e0751d2abc3a64885

SHA256
c52abb32db94605646393bb19038b26915e5e946965fbef23df8bb12fa95b4b6

SHA512
3650e7647eb478678cd459c5442223a4703f6ec7fe4a37bc644afe18821588dde06b36e488c07c718bd20f179c6937cb705343f903598ec3167bbe86248c5905

Download Submit
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
Filesize
384KB

MD5
fd1db0659e64c6c253a6f6b6ef624151

SHA1
d3004a293774e76624155f2e0751d2abc3a64885

SHA256
c52abb32db94605646393bb19038b26915e5e946965fbef23df8bb12fa95b4b6

SHA512
3650e7647eb478678cd459c5442223a4703f6ec7fe4a37bc644afe18821588dde06b36e488c07c718bd20f179c6937cb705343f903598ec3167bbe86248c5905

Download Submit
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
Filesize
384KB

MD5
fd1db0659e64c6c253a6f6b6ef624151

SHA1
d3004a293774e76624155f2e0751d2abc3a64885

SHA256
c52abb32db94605646393bb19038b26915e5e946965fbef23df8bb12fa95b4b6

SHA512
3650e7647eb478678cd459c5442223a4703f6ec7fe4a37bc644afe18821588dde06b36e488c07c718bd20f179c6937cb705343f903598ec3167bbe86248c5905

Download Submit
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
Filesize
384KB

MD5
fd1db0659e64c6c253a6f6b6ef624151

SHA1
d3004a293774e76624155f2e0751d2abc3a64885

SHA256
c52abb32db94605646393bb19038b26915e5e946965fbef23df8bb12fa95b4b6

SHA512
3650e7647eb478678cd459c5442223a4703f6ec7fe4a37bc644afe18821588dde06b36e488c07c718bd20f179c6937cb705343f903598ec3167bbe86248c5905

Download Submit
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
Filesize
384KB

MD5
fd1db0659e64c6c253a6f6b6ef624151

SHA1
d3004a293774e76624155f2e0751d2abc3a64885

SHA256
c52abb32db94605646393bb19038b26915e5e946965fbef23df8bb12fa95b4b6

SHA512
3650e7647eb478678cd459c5442223a4703f6ec7fe4a37bc644afe18821588dde06b36e488c07c718bd20f179c6937cb705343f903598ec3167bbe86248c5905

Download Submit
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
Filesize
384KB

MD5
fd1db0659e64c6c253a6f6b6ef624151

SHA1
d3004a293774e76624155f2e0751d2abc3a64885

SHA256
c52abb32db94605646393bb19038b26915e5e946965fbef23df8bb12fa95b4b6

SHA512
3650e7647eb478678cd459c5442223a4703f6ec7fe4a37bc644afe18821588dde06b36e488c07c718bd20f179c6937cb705343f903598ec3167bbe86248c5905

Download Submit
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
Filesize
384KB

MD5
fd1db0659e64c6c253a6f6b6ef624151

SHA1
d3004a293774e76624155f2e0751d2abc3a64885

SHA256
c52abb32db94605646393bb19038b26915e5e946965fbef23df8bb12fa95b4b6

SHA512
3650e7647eb478678cd459c5442223a4703f6ec7fe4a37bc644afe18821588dde06b36e488c07c718bd20f179c6937cb705343f903598ec3167bbe86248c5905

Download Submit
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
Filesize
384KB

MD5
fd1db0659e64c6c253a6f6b6ef624151

SHA1
d3004a293774e76624155f2e0751d2abc3a64885

SHA256
c52abb32db94605646393bb19038b26915e5e946965fbef23df8bb12fa95b4b6

SHA512
3650e7647eb478678cd459c5442223a4703f6ec7fe4a37bc644afe18821588dde06b36e488c07c718bd20f179c6937cb705343f903598ec3167bbe86248c5905

Download Submit
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
Filesize
384KB

MD5
fd1db0659e64c6c253a6f6b6ef624151

SHA1
d3004a293774e76624155f2e0751d2abc3a64885

SHA256
c52abb32db94605646393bb19038b26915e5e946965fbef23df8bb12fa95b4b6

SHA512
3650e7647eb478678cd459c5442223a4703f6ec7fe4a37bc644afe18821588dde06b36e488c07c718bd20f179c6937cb705343f903598ec3167bbe86248c5905

Download Submit
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
Filesize
384KB

MD5
fd1db0659e64c6c253a6f6b6ef624151

SHA1
d3004a293774e76624155f2e0751d2abc3a64885

SHA256
c52abb32db94605646393bb19038b26915e5e946965fbef23df8bb12fa95b4b6

SHA512
3650e7647eb478678cd459c5442223a4703f6ec7fe4a37bc644afe18821588dde06b36e488c07c718bd20f179c6937cb705343f903598ec3167bbe86248c5905

Download Submit
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
Filesize
384KB

MD5
fd1db0659e64c6c253a6f6b6ef624151

SHA1
d3004a293774e76624155f2e0751d2abc3a64885

SHA256
c52abb32db94605646393bb19038b26915e5e946965fbef23df8bb12fa95b4b6

SHA512
3650e7647eb478678cd459c5442223a4703f6ec7fe4a37bc644afe18821588dde06b36e488c07c718bd20f179c6937cb705343f903598ec3167bbe86248c5905

Download Submit
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
Filesize
384KB

MD5
fd1db0659e64c6c253a6f6b6ef624151

SHA1
d3004a293774e76624155f2e0751d2abc3a64885

SHA256
c52abb32db94605646393bb19038b26915e5e946965fbef23df8bb12fa95b4b6

SHA512
3650e7647eb478678cd459c5442223a4703f6ec7fe4a37bc644afe18821588dde06b36e488c07c718bd20f179c6937cb705343f903598ec3167bbe86248c5905

Download Submit
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
Filesize
384KB

MD5
fd1db0659e64c6c253a6f6b6ef624151

SHA1
d3004a293774e76624155f2e0751d2abc3a64885

SHA256
c52abb32db94605646393bb19038b26915e5e946965fbef23df8bb12fa95b4b6

SHA512
3650e7647eb478678cd459c5442223a4703f6ec7fe4a37bc644afe18821588dde06b36e488c07c718bd20f179c6937cb705343f903598ec3167bbe86248c5905

Download Submit
\??\PIPE\srvsvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\PIPE\srvsvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\PIPE\srvsvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\PIPE\srvsvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\PIPE\srvsvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Windows\SysWOW64\MSDCSC\msdcsc.exe
Filesize
384KB

MD5
fd1db0659e64c6c253a6f6b6ef624151

SHA1
d3004a293774e76624155f2e0751d2abc3a64885

SHA256
c52abb32db94605646393bb19038b26915e5e946965fbef23df8bb12fa95b4b6

SHA512
3650e7647eb478678cd459c5442223a4703f6ec7fe4a37bc644afe18821588dde06b36e488c07c718bd20f179c6937cb705343f903598ec3167bbe86248c5905

Download Submit
\Windows\SysWOW64\MSDCSC\msdcsc.exe
Filesize
384KB

MD5
fd1db0659e64c6c253a6f6b6ef624151

SHA1
d3004a293774e76624155f2e0751d2abc3a64885

SHA256
c52abb32db94605646393bb19038b26915e5e946965fbef23df8bb12fa95b4b6

SHA512
3650e7647eb478678cd459c5442223a4703f6ec7fe4a37bc644afe18821588dde06b36e488c07c718bd20f179c6937cb705343f903598ec3167bbe86248c5905

Download Submit
\Windows\SysWOW64\MSDCSC\msdcsc.exe
Filesize
384KB

MD5
fd1db0659e64c6c253a6f6b6ef624151

SHA1
d3004a293774e76624155f2e0751d2abc3a64885

SHA256
c52abb32db94605646393bb19038b26915e5e946965fbef23df8bb12fa95b4b6

SHA512
3650e7647eb478678cd459c5442223a4703f6ec7fe4a37bc644afe18821588dde06b36e488c07c718bd20f179c6937cb705343f903598ec3167bbe86248c5905

Download Submit
\Windows\SysWOW64\MSDCSC\msdcsc.exe
Filesize
384KB

MD5
fd1db0659e64c6c253a6f6b6ef624151

SHA1
d3004a293774e76624155f2e0751d2abc3a64885

SHA256
c52abb32db94605646393bb19038b26915e5e946965fbef23df8bb12fa95b4b6

SHA512
3650e7647eb478678cd459c5442223a4703f6ec7fe4a37bc644afe18821588dde06b36e488c07c718bd20f179c6937cb705343f903598ec3167bbe86248c5905

Download Submit
\Windows\SysWOW64\MSDCSC\msdcsc.exe
Filesize
384KB

MD5
fd1db0659e64c6c253a6f6b6ef624151

SHA1
d3004a293774e76624155f2e0751d2abc3a64885

SHA256
c52abb32db94605646393bb19038b26915e5e946965fbef23df8bb12fa95b4b6

SHA512
3650e7647eb478678cd459c5442223a4703f6ec7fe4a37bc644afe18821588dde06b36e488c07c718bd20f179c6937cb705343f903598ec3167bbe86248c5905

Download Submit
\Windows\SysWOW64\MSDCSC\msdcsc.exe
Filesize
384KB

MD5
fd1db0659e64c6c253a6f6b6ef624151

SHA1
d3004a293774e76624155f2e0751d2abc3a64885

SHA256
c52abb32db94605646393bb19038b26915e5e946965fbef23df8bb12fa95b4b6

SHA512
3650e7647eb478678cd459c5442223a4703f6ec7fe4a37bc644afe18821588dde06b36e488c07c718bd20f179c6937cb705343f903598ec3167bbe86248c5905

Download Submit
\Windows\SysWOW64\MSDCSC\msdcsc.exe
Filesize
384KB

MD5
fd1db0659e64c6c253a6f6b6ef624151

SHA1
d3004a293774e76624155f2e0751d2abc3a64885

SHA256
c52abb32db94605646393bb19038b26915e5e946965fbef23df8bb12fa95b4b6

SHA512
3650e7647eb478678cd459c5442223a4703f6ec7fe4a37bc644afe18821588dde06b36e488c07c718bd20f179c6937cb705343f903598ec3167bbe86248c5905

Download Submit
\Windows\SysWOW64\MSDCSC\msdcsc.exe
Filesize
384KB

MD5
fd1db0659e64c6c253a6f6b6ef624151

SHA1
d3004a293774e76624155f2e0751d2abc3a64885

SHA256
c52abb32db94605646393bb19038b26915e5e946965fbef23df8bb12fa95b4b6

SHA512
3650e7647eb478678cd459c5442223a4703f6ec7fe4a37bc644afe18821588dde06b36e488c07c718bd20f179c6937cb705343f903598ec3167bbe86248c5905

Download Submit
\Windows\SysWOW64\MSDCSC\msdcsc.exe
Filesize
384KB

MD5
fd1db0659e64c6c253a6f6b6ef624151

SHA1
d3004a293774e76624155f2e0751d2abc3a64885

SHA256
c52abb32db94605646393bb19038b26915e5e946965fbef23df8bb12fa95b4b6

SHA512
3650e7647eb478678cd459c5442223a4703f6ec7fe4a37bc644afe18821588dde06b36e488c07c718bd20f179c6937cb705343f903598ec3167bbe86248c5905

Download Submit
\Windows\SysWOW64\MSDCSC\msdcsc.exe
Filesize
384KB

MD5
fd1db0659e64c6c253a6f6b6ef624151

SHA1
d3004a293774e76624155f2e0751d2abc3a64885

SHA256
c52abb32db94605646393bb19038b26915e5e946965fbef23df8bb12fa95b4b6

SHA512
3650e7647eb478678cd459c5442223a4703f6ec7fe4a37bc644afe18821588dde06b36e488c07c718bd20f179c6937cb705343f903598ec3167bbe86248c5905

Download Submit
\Windows\SysWOW64\MSDCSC\msdcsc.exe
Filesize
384KB

MD5
fd1db0659e64c6c253a6f6b6ef624151

SHA1
d3004a293774e76624155f2e0751d2abc3a64885

SHA256
c52abb32db94605646393bb19038b26915e5e946965fbef23df8bb12fa95b4b6

SHA512
3650e7647eb478678cd459c5442223a4703f6ec7fe4a37bc644afe18821588dde06b36e488c07c718bd20f179c6937cb705343f903598ec3167bbe86248c5905

Download Submit
\Windows\SysWOW64\MSDCSC\msdcsc.exe
Filesize
384KB

MD5
fd1db0659e64c6c253a6f6b6ef624151

SHA1
d3004a293774e76624155f2e0751d2abc3a64885

SHA256
c52abb32db94605646393bb19038b26915e5e946965fbef23df8bb12fa95b4b6

SHA512
3650e7647eb478678cd459c5442223a4703f6ec7fe4a37bc644afe18821588dde06b36e488c07c718bd20f179c6937cb705343f903598ec3167bbe86248c5905

Download Submit
\Windows\SysWOW64\MSDCSC\msdcsc.exe
Filesize
384KB

MD5
fd1db0659e64c6c253a6f6b6ef624151

SHA1
d3004a293774e76624155f2e0751d2abc3a64885

SHA256
c52abb32db94605646393bb19038b26915e5e946965fbef23df8bb12fa95b4b6

SHA512
3650e7647eb478678cd459c5442223a4703f6ec7fe4a37bc644afe18821588dde06b36e488c07c718bd20f179c6937cb705343f903598ec3167bbe86248c5905

Download Submit
\Windows\SysWOW64\MSDCSC\msdcsc.exe
Filesize
384KB

MD5
fd1db0659e64c6c253a6f6b6ef624151

SHA1
d3004a293774e76624155f2e0751d2abc3a64885

SHA256
c52abb32db94605646393bb19038b26915e5e946965fbef23df8bb12fa95b4b6

SHA512
3650e7647eb478678cd459c5442223a4703f6ec7fe4a37bc644afe18821588dde06b36e488c07c718bd20f179c6937cb705343f903598ec3167bbe86248c5905

Download Submit
\Windows\SysWOW64\MSDCSC\msdcsc.exe
Filesize
384KB

MD5
fd1db0659e64c6c253a6f6b6ef624151

SHA1
d3004a293774e76624155f2e0751d2abc3a64885

SHA256
c52abb32db94605646393bb19038b26915e5e946965fbef23df8bb12fa95b4b6

SHA512
3650e7647eb478678cd459c5442223a4703f6ec7fe4a37bc644afe18821588dde06b36e488c07c718bd20f179c6937cb705343f903598ec3167bbe86248c5905

Download Submit
\Windows\SysWOW64\MSDCSC\msdcsc.exe
Filesize
384KB

MD5
fd1db0659e64c6c253a6f6b6ef624151

SHA1
d3004a293774e76624155f2e0751d2abc3a64885

SHA256
c52abb32db94605646393bb19038b26915e5e946965fbef23df8bb12fa95b4b6

SHA512
3650e7647eb478678cd459c5442223a4703f6ec7fe4a37bc644afe18821588dde06b36e488c07c718bd20f179c6937cb705343f903598ec3167bbe86248c5905

Download Submit
\Windows\SysWOW64\MSDCSC\msdcsc.exe
Filesize
384KB

MD5
fd1db0659e64c6c253a6f6b6ef624151

SHA1
d3004a293774e76624155f2e0751d2abc3a64885

SHA256
c52abb32db94605646393bb19038b26915e5e946965fbef23df8bb12fa95b4b6

SHA512
3650e7647eb478678cd459c5442223a4703f6ec7fe4a37bc644afe18821588dde06b36e488c07c718bd20f179c6937cb705343f903598ec3167bbe86248c5905

Download Submit
\Windows\SysWOW64\MSDCSC\msdcsc.exe
Filesize
384KB

MD5
fd1db0659e64c6c253a6f6b6ef624151

SHA1
d3004a293774e76624155f2e0751d2abc3a64885

SHA256
c52abb32db94605646393bb19038b26915e5e946965fbef23df8bb12fa95b4b6

SHA512
3650e7647eb478678cd459c5442223a4703f6ec7fe4a37bc644afe18821588dde06b36e488c07c718bd20f179c6937cb705343f903598ec3167bbe86248c5905

Download Submit
\Windows\SysWOW64\MSDCSC\msdcsc.exe
Filesize
384KB

MD5
fd1db0659e64c6c253a6f6b6ef624151

SHA1
d3004a293774e76624155f2e0751d2abc3a64885

SHA256
c52abb32db94605646393bb19038b26915e5e946965fbef23df8bb12fa95b4b6

SHA512
3650e7647eb478678cd459c5442223a4703f6ec7fe4a37bc644afe18821588dde06b36e488c07c718bd20f179c6937cb705343f903598ec3167bbe86248c5905

Download Submit
\Windows\SysWOW64\MSDCSC\msdcsc.exe
Filesize
384KB

MD5
fd1db0659e64c6c253a6f6b6ef624151

SHA1
d3004a293774e76624155f2e0751d2abc3a64885

SHA256
c52abb32db94605646393bb19038b26915e5e946965fbef23df8bb12fa95b4b6

SHA512
3650e7647eb478678cd459c5442223a4703f6ec7fe4a37bc644afe18821588dde06b36e488c07c718bd20f179c6937cb705343f903598ec3167bbe86248c5905

Download Submit
\Windows\SysWOW64\MSDCSC\msdcsc.exe
Filesize
384KB

MD5
fd1db0659e64c6c253a6f6b6ef624151

SHA1
d3004a293774e76624155f2e0751d2abc3a64885

SHA256
c52abb32db94605646393bb19038b26915e5e946965fbef23df8bb12fa95b4b6

SHA512
3650e7647eb478678cd459c5442223a4703f6ec7fe4a37bc644afe18821588dde06b36e488c07c718bd20f179c6937cb705343f903598ec3167bbe86248c5905

Download Submit
\Windows\SysWOW64\MSDCSC\msdcsc.exe
Filesize
384KB

MD5
fd1db0659e64c6c253a6f6b6ef624151

SHA1
d3004a293774e76624155f2e0751d2abc3a64885

SHA256
c52abb32db94605646393bb19038b26915e5e946965fbef23df8bb12fa95b4b6

SHA512
3650e7647eb478678cd459c5442223a4703f6ec7fe4a37bc644afe18821588dde06b36e488c07c718bd20f179c6937cb705343f903598ec3167bbe86248c5905

Download Submit
\Windows\SysWOW64\MSDCSC\msdcsc.exe
Filesize
384KB

MD5
fd1db0659e64c6c253a6f6b6ef624151

SHA1
d3004a293774e76624155f2e0751d2abc3a64885

SHA256
c52abb32db94605646393bb19038b26915e5e946965fbef23df8bb12fa95b4b6

SHA512
3650e7647eb478678cd459c5442223a4703f6ec7fe4a37bc644afe18821588dde06b36e488c07c718bd20f179c6937cb705343f903598ec3167bbe86248c5905

Download Submit
\Windows\SysWOW64\MSDCSC\msdcsc.exe
Filesize
384KB

MD5
fd1db0659e64c6c253a6f6b6ef624151

SHA1
d3004a293774e76624155f2e0751d2abc3a64885

SHA256
c52abb32db94605646393bb19038b26915e5e946965fbef23df8bb12fa95b4b6

SHA512
3650e7647eb478678cd459c5442223a4703f6ec7fe4a37bc644afe18821588dde06b36e488c07c718bd20f179c6937cb705343f903598ec3167bbe86248c5905

Download Submit
\Windows\SysWOW64\MSDCSC\msdcsc.exe
Filesize
384KB

MD5
fd1db0659e64c6c253a6f6b6ef624151

SHA1
d3004a293774e76624155f2e0751d2abc3a64885

SHA256
c52abb32db94605646393bb19038b26915e5e946965fbef23df8bb12fa95b4b6

SHA512
3650e7647eb478678cd459c5442223a4703f6ec7fe4a37bc644afe18821588dde06b36e488c07c718bd20f179c6937cb705343f903598ec3167bbe86248c5905

Download Submit
\Windows\SysWOW64\MSDCSC\msdcsc.exe
Filesize
384KB

MD5
fd1db0659e64c6c253a6f6b6ef624151

SHA1
d3004a293774e76624155f2e0751d2abc3a64885

SHA256
c52abb32db94605646393bb19038b26915e5e946965fbef23df8bb12fa95b4b6

SHA512
3650e7647eb478678cd459c5442223a4703f6ec7fe4a37bc644afe18821588dde06b36e488c07c718bd20f179c6937cb705343f903598ec3167bbe86248c5905

Download Submit
\Windows\SysWOW64\MSDCSC\msdcsc.exe
Filesize
384KB

MD5
fd1db0659e64c6c253a6f6b6ef624151

SHA1
d3004a293774e76624155f2e0751d2abc3a64885

SHA256
c52abb32db94605646393bb19038b26915e5e946965fbef23df8bb12fa95b4b6

SHA512
3650e7647eb478678cd459c5442223a4703f6ec7fe4a37bc644afe18821588dde06b36e488c07c718bd20f179c6937cb705343f903598ec3167bbe86248c5905

Download Submit
\Windows\SysWOW64\MSDCSC\msdcsc.exe
Filesize
384KB

MD5
fd1db0659e64c6c253a6f6b6ef624151

SHA1
d3004a293774e76624155f2e0751d2abc3a64885

SHA256
c52abb32db94605646393bb19038b26915e5e946965fbef23df8bb12fa95b4b6

SHA512
3650e7647eb478678cd459c5442223a4703f6ec7fe4a37bc644afe18821588dde06b36e488c07c718bd20f179c6937cb705343f903598ec3167bbe86248c5905

Download Submit
memory/288-145-0x0000000000000000-mapping.dmp

Download
memory/436-172-0x0000000000000000-mapping.dmp

Download
memory/528-159-0x0000000000000000-mapping.dmp

Download
memory/600-58-0x0000000000000000-mapping.dmp

Download
memory/604-162-0x0000000000000000-mapping.dmp

Download
memory/608-238-0x0000000000400000-0x00000000004F9000-memory.dmp

Filesize
996KB

Download
memory/608-239-0x0000000000400000-0x00000000004F9000-memory.dmp

Filesize
996KB

Download
memory/680-60-0x0000000000000000-mapping.dmp

Download
memory/784-77-0x0000000000000000-mapping.dmp

Download
memory/832-173-0x0000000000000000-mapping.dmp

Download
memory/860-158-0x0000000000000000-mapping.dmp

Download
memory/904-72-0x0000000000000000-mapping.dmp

Download
memory/980-132-0x0000000000000000-mapping.dmp

Download
memory/1008-244-0x0000000000400000-0x00000000004F9000-memory.dmp

Filesize
996KB

Download
memory/1008-245-0x0000000000400000-0x00000000004F9000-memory.dmp

Filesize
996KB

Download
memory/1012-129-0x0000000000400000-0x00000000004F9000-memory.dmp

Filesize
996KB

Download
memory/1012-125-0x0000000000000000-mapping.dmp

Download
memory/1012-142-0x0000000000400000-0x00000000004F9000-memory.dmp

Filesize
996KB

Download
memory/1020-87-0x0000000000000000-mapping.dmp

Download
memory/1020-242-0x0000000000400000-0x00000000004F9000-memory.dmp

Filesize
996KB

Download
memory/1020-241-0x0000000000400000-0x00000000004F9000-memory.dmp

Filesize
996KB

Download
memory/1040-146-0x0000000000000000-mapping.dmp

Download
memory/1056-149-0x0000000000000000-mapping.dmp

Download
memory/1056-223-0x0000000000400000-0x00000000004F9000-memory.dmp

Filesize
996KB

Download
memory/1056-217-0x0000000000400000-0x00000000004F9000-memory.dmp

Filesize
996KB

Download
memory/1056-62-0x0000000000000000-mapping.dmp

Download
memory/1092-194-0x0000000000400000-0x00000000004F9000-memory.dmp

Filesize
996KB

Download
memory/1092-201-0x0000000000400000-0x00000000004F9000-memory.dmp

Filesize
996KB

Download
memory/1100-178-0x0000000000000000-mapping.dmp

Download
memory/1100-131-0x0000000000000000-mapping.dmp

Download
memory/1132-110-0x0000000000000000-mapping.dmp

Download
memory/1132-128-0x0000000000400000-0x00000000004F9000-memory.dmp

Filesize
996KB

Download
memory/1132-114-0x0000000000400000-0x00000000004F9000-memory.dmp

Filesize
996KB

Download
memory/1156-57-0x0000000000000000-mapping.dmp

Download
memory/1160-106-0x0000000000000000-mapping.dmp

Download
memory/1180-237-0x0000000000400000-0x00000000004F9000-memory.dmp

Filesize
996KB

Download
memory/1188-91-0x0000000000000000-mapping.dmp

Download
memory/1204-116-0x0000000000000000-mapping.dmp

Download
memory/1276-113-0x0000000000400000-0x00000000004F9000-memory.dmp

Filesize
996KB

Download
memory/1276-96-0x0000000000000000-mapping.dmp

Download
memory/1276-100-0x0000000000400000-0x00000000004F9000-memory.dmp

Filesize
996KB

Download
memory/1312-253-0x0000000000400000-0x00000000004F9000-memory.dmp

Filesize
996KB

Download
memory/1312-136-0x0000000000000000-mapping.dmp

Download
memory/1316-176-0x0000000000000000-mapping.dmp

Download
memory/1320-160-0x0000000000000000-mapping.dmp

Download
memory/1368-122-0x0000000000000000-mapping.dmp

Download
memory/1368-163-0x0000000000000000-mapping.dmp

Download
memory/1448-55-0x0000000000400000-0x00000000004F9000-memory.dmp

Filesize
996KB

Download
memory/1448-54-0x00000000758B1000-0x00000000758B3000-memory.dmp

Filesize
8KB

Download
memory/1448-68-0x0000000000400000-0x00000000004F9000-memory.dmp

Filesize
996KB

Download
memory/1460-170-0x0000000000400000-0x00000000004F9000-memory.dmp

Filesize
996KB

Download
memory/1460-153-0x0000000000000000-mapping.dmp

Download
memory/1460-157-0x0000000000400000-0x00000000004F9000-memory.dmp

Filesize
996KB

Download
memory/1468-61-0x0000000000000000-mapping.dmp

Download
memory/1468-107-0x0000000000000000-mapping.dmp

Download
memory/1476-234-0x0000000000400000-0x00000000004F9000-memory.dmp

Filesize
996KB

Download
memory/1476-233-0x0000000000400000-0x00000000004F9000-memory.dmp

Filesize
996KB

Download
memory/1524-247-0x0000000000400000-0x00000000004F9000-memory.dmp

Filesize
996KB

Download
memory/1524-249-0x0000000000400000-0x00000000004F9000-memory.dmp

Filesize
996KB

Download
memory/1528-86-0x0000000000000000-mapping.dmp

Download
memory/1540-71-0x0000000000000000-mapping.dmp

Download
memory/1560-209-0x0000000000400000-0x00000000004F9000-memory.dmp

Filesize
996KB

Download
memory/1560-216-0x0000000000400000-0x00000000004F9000-memory.dmp

Filesize
996KB

Download
memory/1560-177-0x0000000000000000-mapping.dmp

Download
memory/1584-208-0x0000000000400000-0x00000000004F9000-memory.dmp

Filesize
996KB

Download
memory/1584-202-0x0000000000400000-0x00000000004F9000-memory.dmp

Filesize
996KB

Download
memory/1600-88-0x0000000000000000-mapping.dmp

Download
memory/1632-93-0x0000000000000000-mapping.dmp

Download
memory/1636-101-0x0000000000000000-mapping.dmp

Download
memory/1648-186-0x0000000000000000-mapping.dmp

Download
memory/1648-102-0x0000000000000000-mapping.dmp

Download
memory/1656-117-0x0000000000000000-mapping.dmp

Download
memory/1672-156-0x0000000000400000-0x00000000004F9000-memory.dmp

Filesize
996KB

Download
memory/1672-139-0x0000000000000000-mapping.dmp

Download
memory/1672-143-0x0000000000400000-0x00000000004F9000-memory.dmp

Filesize
996KB

Download
memory/1680-167-0x0000000000000000-mapping.dmp

Download
memory/1680-171-0x0000000000400000-0x00000000004F9000-memory.dmp

Filesize
996KB

Download
memory/1680-184-0x0000000000400000-0x00000000004F9000-memory.dmp

Filesize
996KB

Download
memory/1684-164-0x0000000000000000-mapping.dmp

Download
memory/1704-150-0x0000000000000000-mapping.dmp

Download
memory/1712-135-0x0000000000000000-mapping.dmp

Download
memory/1716-75-0x0000000000000000-mapping.dmp

Download
memory/1812-148-0x0000000000000000-mapping.dmp

Download
memory/1820-105-0x0000000000000000-mapping.dmp

Download
memory/1832-181-0x0000000000000000-mapping.dmp

Download
memory/1832-185-0x0000000000400000-0x00000000004F9000-memory.dmp

Filesize
996KB

Download
memory/1832-190-0x0000000003BC0000-0x0000000003CB9000-memory.dmp

Filesize
996KB

Download
memory/1832-191-0x0000000000400000-0x00000000004F9000-memory.dmp

Filesize
996KB

Download
memory/1892-144-0x0000000000000000-mapping.dmp

Download
memory/1892-73-0x0000000000000000-mapping.dmp

Download
memory/1900-119-0x0000000000000000-mapping.dmp

Download
memory/1924-115-0x0000000000000000-mapping.dmp

Download
memory/1928-121-0x0000000000000000-mapping.dmp

Download
memory/1932-134-0x0000000000000000-mapping.dmp

Download
memory/1932-90-0x0000000000000000-mapping.dmp

Download
memory/1936-56-0x0000000000000000-mapping.dmp

Download
memory/1948-81-0x0000000000400000-0x00000000004F9000-memory.dmp

Filesize
996KB

Download
memory/1948-65-0x0000000000000000-mapping.dmp

Download
memory/1948-85-0x0000000003B50000-0x0000000003C49000-memory.dmp

Filesize
996KB

Download
memory/1948-70-0x0000000000400000-0x00000000004F9000-memory.dmp

Filesize
996KB

Download
memory/1960-99-0x0000000000400000-0x00000000004F9000-memory.dmp

Filesize
996KB

Download
memory/1960-84-0x0000000000400000-0x00000000004F9000-memory.dmp

Filesize
996KB

Download
memory/1960-80-0x0000000000000000-mapping.dmp

Download
memory/1968-130-0x0000000000000000-mapping.dmp

Download
memory/2012-76-0x0000000000000000-mapping.dmp

Download
memory/2012-174-0x0000000000000000-mapping.dmp

Download
memory/2020-250-0x0000000000400000-0x00000000004F9000-memory.dmp

Filesize
996KB

Download
memory/2020-252-0x0000000000400000-0x00000000004F9000-memory.dmp

Filesize
996KB

Download
memory/2020-103-0x0000000000000000-mapping.dmp

Download
memory/2028-224-0x0000000000400000-0x00000000004F9000-memory.dmp

Filesize
996KB

Download
memory/2028-226-0x0000000000400000-0x00000000004F9000-memory.dmp

Filesize
996KB

Download
memory/2032-227-0x0000000000400000-0x00000000004F9000-memory.dmp

Filesize
996KB

Download
memory/2032-228-0x0000000000400000-0x00000000004F9000-memory.dmp

Filesize
996KB

Download
memory/2044-232-0x0000000000400000-0x00000000004F9000-memory.dmp

Filesize
996KB

Download
memory/2044-230-0x0000000000400000-0x00000000004F9000-memory.dmp

Filesize
996KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads