darkcomet | 0d6e873aa8faee0a896e6ac7679a216585933bc29bdd2c1bc006ce56a6e86818

Analysis

max time kernel
1s
max time network
38s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
03-03-2024 01:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RAT/Blackkomet.exe
Size

756KB
MD5

c7dcd585b7e8b046f209052bcd6dd84b
SHA1

604dcfae9eed4f65c80a4a39454db409291e08fa
SHA256

0e8336ed51fe4551ced7d9aa5ce2dde945df8a0cc4e7c60199c24dd1cf7ccd48
SHA512

c5ba102b12d2c685312d7dc8d58d98891b73243f56a8491ea7c41c2edaaad44ad90b8bc0748dbd8c84e92e9ae9bbd0b0157265ebe35fb9b63668c57d0e1ed5f2
SSDEEP

12288:XOANXryu1S69QwWBIlVi4o858nFBKgmvtOwUATgDQ3:eANOCS6qwWB0V5o8mnqvtrdgDQ3

Score

10^/10

darkcomet evasion persistence rat trojan

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

Blackkomet.exewinupdate.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe"	Blackkomet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe

Sets file to hidden 1 TTPs 20 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

Processes:

attrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exe

pid	Process
620	attrib.exe
4976	attrib.exe
4204	attrib.exe
3224	attrib.exe
768	attrib.exe
3344	attrib.exe
4308	attrib.exe
2092	attrib.exe
424	attrib.exe
4572	attrib.exe
1000	attrib.exe
64	attrib.exe
3176	attrib.exe
1488	attrib.exe
1568	attrib.exe
4668	attrib.exe
4256	attrib.exe
2212	attrib.exe
1292	attrib.exe
4192	attrib.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

winupdate.exeBlackkomet.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation	winupdate.exe
Key value queried	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation	Blackkomet.exe

Executes dropped EXE 1 IoCs

Processes:

winupdate.exe

pid	Process
2400	winupdate.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

Blackkomet.exenotepad.exewinupdate.exenotepad.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	Blackkomet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	notepad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	notepad.exe

Drops file in System32 directory 10 IoCs

Processes:

winupdate.exeattrib.exeattrib.exeBlackkomet.exenotepad.exenotepad.exe

description	ioc	Process
File created	C:\Windows\SysWOW64\Windupdt\winupdate.exe	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\winupdate.exe	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\winupdate.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt	attrib.exe
File created	C:\Windows\SysWOW64\Windupdt\winupdate.exe	Blackkomet.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\	Blackkomet.exe
File created	C:\Windows\SysWOW64\Windupdt\winupdate.exe	notepad.exe
File created	C:\Windows\SysWOW64\Windupdt\winupdate.exe	notepad.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\winupdate.exe	Blackkomet.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

Blackkomet.exewinupdate.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Blackkomet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	winupdate.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

Processes:

Blackkomet.exewinupdate.exe

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2848	Blackkomet.exe
Token: SeSecurityPrivilege	2848	Blackkomet.exe
Token: SeTakeOwnershipPrivilege	2848	Blackkomet.exe
Token: SeLoadDriverPrivilege	2848	Blackkomet.exe
Token: SeSystemProfilePrivilege	2848	Blackkomet.exe
Token: SeSystemtimePrivilege	2848	Blackkomet.exe
Token: SeProfSingleProcessPrivilege	2848	Blackkomet.exe
Token: SeIncBasePriorityPrivilege	2848	Blackkomet.exe
Token: SeCreatePagefilePrivilege	2848	Blackkomet.exe
Token: SeBackupPrivilege	2848	Blackkomet.exe
Token: SeRestorePrivilege	2848	Blackkomet.exe
Token: SeShutdownPrivilege	2848	Blackkomet.exe
Token: SeDebugPrivilege	2848	Blackkomet.exe
Token: SeSystemEnvironmentPrivilege	2848	Blackkomet.exe
Token: SeChangeNotifyPrivilege	2848	Blackkomet.exe
Token: SeRemoteShutdownPrivilege	2848	Blackkomet.exe
Token: SeUndockPrivilege	2848	Blackkomet.exe
Token: SeManageVolumePrivilege	2848	Blackkomet.exe
Token: SeImpersonatePrivilege	2848	Blackkomet.exe
Token: SeCreateGlobalPrivilege	2848	Blackkomet.exe
Token: 33	2848	Blackkomet.exe
Token: 34	2848	Blackkomet.exe
Token: 35	2848	Blackkomet.exe
Token: 36	2848	Blackkomet.exe
Token: SeIncreaseQuotaPrivilege	2400	winupdate.exe
Token: SeSecurityPrivilege	2400	winupdate.exe
Token: SeTakeOwnershipPrivilege	2400	winupdate.exe
Token: SeLoadDriverPrivilege	2400	winupdate.exe
Token: SeSystemProfilePrivilege	2400	winupdate.exe
Token: SeSystemtimePrivilege	2400	winupdate.exe
Token: SeProfSingleProcessPrivilege	2400	winupdate.exe
Token: SeIncBasePriorityPrivilege	2400	winupdate.exe
Token: SeCreatePagefilePrivilege	2400	winupdate.exe
Token: SeBackupPrivilege	2400	winupdate.exe
Token: SeRestorePrivilege	2400	winupdate.exe
Token: SeShutdownPrivilege	2400	winupdate.exe
Token: SeDebugPrivilege	2400	winupdate.exe
Token: SeSystemEnvironmentPrivilege	2400	winupdate.exe
Token: SeChangeNotifyPrivilege	2400	winupdate.exe
Token: SeRemoteShutdownPrivilege	2400	winupdate.exe
Token: SeUndockPrivilege	2400	winupdate.exe
Token: SeManageVolumePrivilege	2400	winupdate.exe
Token: SeImpersonatePrivilege	2400	winupdate.exe
Token: SeCreateGlobalPrivilege	2400	winupdate.exe
Token: 33	2400	winupdate.exe
Token: 34	2400	winupdate.exe
Token: 35	2400	winupdate.exe
Token: 36	2400	winupdate.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Blackkomet.exewinupdate.exe

description	pid	Process	procid_target
PID 2848 wrote to memory of 2240	2848	Blackkomet.exe	87
PID 2848 wrote to memory of 2240	2848	Blackkomet.exe	87
PID 2848 wrote to memory of 2240	2848	Blackkomet.exe	87
PID 2848 wrote to memory of 2240	2848	Blackkomet.exe	87
PID 2848 wrote to memory of 2240	2848	Blackkomet.exe	87
PID 2848 wrote to memory of 2240	2848	Blackkomet.exe	87
PID 2848 wrote to memory of 2240	2848	Blackkomet.exe	87
PID 2848 wrote to memory of 2240	2848	Blackkomet.exe	87
PID 2848 wrote to memory of 2240	2848	Blackkomet.exe	87
PID 2848 wrote to memory of 2240	2848	Blackkomet.exe	87
PID 2848 wrote to memory of 2240	2848	Blackkomet.exe	87
PID 2848 wrote to memory of 2240	2848	Blackkomet.exe	87
PID 2848 wrote to memory of 2240	2848	Blackkomet.exe	87
PID 2848 wrote to memory of 2240	2848	Blackkomet.exe	87
PID 2848 wrote to memory of 2240	2848	Blackkomet.exe	87
PID 2848 wrote to memory of 2240	2848	Blackkomet.exe	87
PID 2848 wrote to memory of 2240	2848	Blackkomet.exe	87
PID 2848 wrote to memory of 2240	2848	Blackkomet.exe	87
PID 2848 wrote to memory of 2240	2848	Blackkomet.exe	87
PID 2848 wrote to memory of 2240	2848	Blackkomet.exe	87
PID 2848 wrote to memory of 2240	2848	Blackkomet.exe	87
PID 2848 wrote to memory of 2240	2848	Blackkomet.exe	87
PID 2848 wrote to memory of 2240	2848	Blackkomet.exe	87
PID 2848 wrote to memory of 1000	2848	Blackkomet.exe	88
PID 2848 wrote to memory of 1000	2848	Blackkomet.exe	88
PID 2848 wrote to memory of 1000	2848	Blackkomet.exe	88
PID 2848 wrote to memory of 4572	2848	Blackkomet.exe	89
PID 2848 wrote to memory of 4572	2848	Blackkomet.exe	89
PID 2848 wrote to memory of 4572	2848	Blackkomet.exe	89
PID 2848 wrote to memory of 2400	2848	Blackkomet.exe	94
PID 2848 wrote to memory of 2400	2848	Blackkomet.exe	94
PID 2848 wrote to memory of 2400	2848	Blackkomet.exe	94
PID 2848 wrote to memory of 1176	2848	Blackkomet.exe	95
PID 2848 wrote to memory of 1176	2848	Blackkomet.exe	95
PID 2848 wrote to memory of 1176	2848	Blackkomet.exe	95
PID 2848 wrote to memory of 1176	2848	Blackkomet.exe	95
PID 2848 wrote to memory of 1176	2848	Blackkomet.exe	95
PID 2848 wrote to memory of 1176	2848	Blackkomet.exe	95
PID 2848 wrote to memory of 1176	2848	Blackkomet.exe	95
PID 2848 wrote to memory of 1176	2848	Blackkomet.exe	95
PID 2848 wrote to memory of 1176	2848	Blackkomet.exe	95
PID 2848 wrote to memory of 1176	2848	Blackkomet.exe	95
PID 2848 wrote to memory of 1176	2848	Blackkomet.exe	95
PID 2848 wrote to memory of 1176	2848	Blackkomet.exe	95
PID 2848 wrote to memory of 1176	2848	Blackkomet.exe	95
PID 2848 wrote to memory of 1176	2848	Blackkomet.exe	95
PID 2848 wrote to memory of 1176	2848	Blackkomet.exe	95
PID 2848 wrote to memory of 1176	2848	Blackkomet.exe	95
PID 2848 wrote to memory of 1176	2848	Blackkomet.exe	95
PID 2400 wrote to memory of 2760	2400	winupdate.exe	96
PID 2400 wrote to memory of 2760	2400	winupdate.exe	96
PID 2400 wrote to memory of 2760	2400	winupdate.exe	96
PID 2400 wrote to memory of 2760	2400	winupdate.exe	96
PID 2400 wrote to memory of 2760	2400	winupdate.exe	96
PID 2400 wrote to memory of 2760	2400	winupdate.exe	96
PID 2400 wrote to memory of 2760	2400	winupdate.exe	96
PID 2400 wrote to memory of 2760	2400	winupdate.exe	96
PID 2400 wrote to memory of 2760	2400	winupdate.exe	96
PID 2400 wrote to memory of 2760	2400	winupdate.exe	96
PID 2400 wrote to memory of 2760	2400	winupdate.exe	96
PID 2400 wrote to memory of 2760	2400	winupdate.exe	96
PID 2400 wrote to memory of 2760	2400	winupdate.exe	96
PID 2400 wrote to memory of 2760	2400	winupdate.exe	96
PID 2400 wrote to memory of 2760	2400	winupdate.exe	96

Views/modifies file attributes 1 TTPs 20 IoCs

evasion

Hidden Files and Directories

T1564.001

Processes:

pid	Process
4668	attrib.exe
4204	attrib.exe
4256	attrib.exe
3176	attrib.exe
3344	attrib.exe
4192	attrib.exe
4976	attrib.exe
1488	attrib.exe
1000	attrib.exe
1568	attrib.exe
3224	attrib.exe
768	attrib.exe
424	attrib.exe
4572	attrib.exe
64	attrib.exe
2092	attrib.exe
620	attrib.exe
2212	attrib.exe
1292	attrib.exe
4308	attrib.exe

C:\Users\Admin\AppData\Local\Temp\RAT\Blackkomet.exe
"C:\Users\Admin\AppData\Local\Temp\RAT\Blackkomet.exe"
1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Windows\SysWOW64\notepad.exe
  notepad
  2⤵
  - Adds Run key to start application
  - Drops file in System32 directory
  PID:2240
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Users\Admin\AppData\Local\Temp\RAT\Blackkomet.exe" +s +h
  2⤵
  - Sets file to hidden
  - Views/modifies file attributes
  PID:1000
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Users\Admin\AppData\Local\Temp\RAT" +s +h
  2⤵
  - Sets file to hidden
  - Views/modifies file attributes
  PID:4572
- C:\Windows\SysWOW64\Windupdt\winupdate.exe
  "C:\Windows\system32\Windupdt\winupdate.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2400
- - C:\Windows\SysWOW64\notepad.exe
    notepad
    3⤵
    - Adds Run key to start application
    - Drops file in System32 directory
    PID:2760
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
    3⤵
    - Sets file to hidden
    - Drops file in System32 directory
    - Views/modifies file attributes
    PID:1568
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\Windupdt" +s +h
    3⤵
    - Sets file to hidden
    - Drops file in System32 directory
    - Views/modifies file attributes
    PID:64
- - C:\Windows\SysWOW64\Windupdt\winupdate.exe
    "C:\Windows\system32\Windupdt\winupdate.exe"
    3⤵
    PID:1144
  - - C:\Windows\SysWOW64\notepad.exe
      notepad
      4⤵
      PID:3080
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:2092
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Windows\SysWOW64\Windupdt" +s +h
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:4668
  - - C:\Windows\SysWOW64\Windupdt\winupdate.exe
      "C:\Windows\system32\Windupdt\winupdate.exe"
      4⤵
      PID:4436
    - - C:\Windows\SysWOW64\notepad.exe
        
        notepad
        5⤵
        
        PID:728
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        5⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:620
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        5⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:4976
    - - C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        5⤵
        
        PID:4776
      - C:\Windows\SysWOW64\notepad.exe
        
        notepad
        6⤵
        
        PID:928
      - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        6⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:3224
      - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        6⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:4204
      - C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        6⤵
        
        PID:4720
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        7⤵
        
        PID:3048
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        7⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:768
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        7⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:4256
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        7⤵
        
        PID:1000
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        8⤵
        
        PID:4824
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        8⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:424
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        8⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:3176
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        8⤵
        
        PID:1296
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        9⤵
        
        PID:64
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        9⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:1292
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        9⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:2212
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        9⤵
        
        PID:1176
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        10⤵
        
        PID:4980
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        10⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:1488
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        10⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:3344
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        10⤵
        
        PID:1052
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        11⤵
        
        PID:2356
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        11⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:4308
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        11⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:4192
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        11⤵
        
        PID:3528
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        11⤵
        
        PID:4776
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        10⤵
        
        PID:2660
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        9⤵
        
        PID:4724
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        8⤵
        
        PID:4316
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        7⤵
        
        PID:4016
      - C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        6⤵
        
        PID:4808
    - - C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        5⤵
        
        PID:3848
  - - C:\Windows\SysWOW64\notepad.exe
      C:\Windows\SysWOW64\notepad.exe
      4⤵
      PID:4396
- - C:\Windows\SysWOW64\notepad.exe
    C:\Windows\SysWOW64\notepad.exe
    3⤵
    PID:3460
- C:\Windows\SysWOW64\notepad.exe
  C:\Windows\SysWOW64\notepad.exe
  2⤵
  PID:1176

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Windupdt\winupdate.exe

Filesize
756KB

MD5
c7dcd585b7e8b046f209052bcd6dd84b

SHA1
604dcfae9eed4f65c80a4a39454db409291e08fa

SHA256
0e8336ed51fe4551ced7d9aa5ce2dde945df8a0cc4e7c60199c24dd1cf7ccd48

SHA512
c5ba102b12d2c685312d7dc8d58d98891b73243f56a8491ea7c41c2edaaad44ad90b8bc0748dbd8c84e92e9ae9bbd0b0157265ebe35fb9b63668c57d0e1ed5f2

Download Submit
memory/1000-65-0x0000000001FB0000-0x0000000001FB1000-memory.dmp

Filesize
4KB

Download
memory/1000-68-0x0000000013140000-0x000000001320F000-memory.dmp

Filesize
828KB

Download
memory/1052-80-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/1144-44-0x0000000001FC0000-0x0000000001FC1000-memory.dmp

Filesize
4KB

Download
memory/1144-48-0x0000000013140000-0x000000001320F000-memory.dmp

Filesize
828KB

Download
memory/1176-35-0x0000000000F40000-0x0000000000F41000-memory.dmp

Filesize
4KB

Download
memory/1176-78-0x0000000013140000-0x000000001320F000-memory.dmp

Filesize
828KB

Download
memory/1176-75-0x0000000000700000-0x0000000000701000-memory.dmp

Filesize
4KB

Download
memory/1296-73-0x0000000013140000-0x000000001320F000-memory.dmp

Filesize
828KB

Download
memory/1296-70-0x00000000006E0000-0x00000000006E1000-memory.dmp

Filesize
4KB

Download
memory/2240-2-0x0000000000510000-0x0000000000511000-memory.dmp

Filesize
4KB

Download
memory/2400-37-0x0000000001FB0000-0x0000000001FB1000-memory.dmp

Filesize
4KB

Download
memory/2400-42-0x0000000013140000-0x000000001320F000-memory.dmp

Filesize
828KB

Download
memory/2848-0-0x00000000021F0000-0x00000000021F1000-memory.dmp

Filesize
4KB

Download
memory/2848-38-0x0000000013140000-0x000000001320F000-memory.dmp

Filesize
828KB

Download
memory/4436-53-0x0000000013140000-0x000000001320F000-memory.dmp

Filesize
828KB

Download
memory/4436-50-0x0000000001F00000-0x0000000001F01000-memory.dmp

Filesize
4KB

Download
memory/4720-64-0x0000000013140000-0x000000001320F000-memory.dmp

Filesize
828KB

Download
memory/4720-60-0x0000000000590000-0x0000000000591000-memory.dmp

Filesize
4KB

Download
memory/4776-58-0x0000000013140000-0x000000001320F000-memory.dmp

Filesize
828KB

Download
memory/4776-55-0x0000000002090000-0x0000000002091000-memory.dmp

Filesize
4KB

Download