darkcomet | 44beca4107263dd406893a7c9f46e716bcfd121c41c15130a868f2345d5143f2

Analysis

max time kernel
149s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08/03/2024, 11:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bb32e1af9a4bfa8e3cf473ad54354eb9.exe
Size 702KB
Sample240308-n4dfpaec76
SHA256 44beca4107263dd406893a7c9f46e716bcfd121c41c15130a868f2345d5143f2
MD5 bb32e1af9a4bfa8e3cf473ad54354eb9
SHA1 55428fad1677ddd437fcb798baac234c99de7b59
SHA512 7750bcad505a96382e9c7652faac3f2d27cf38242aedcfb89bb3989eea4d0a68dffc3b4c326123360572bb6b1751a2c03dbadf76951148e8348a6cfcd84a4c0c
SSDEEP 12288:ffFcGAT79cO2ZKpKHNMF4cDzJRlK2o58u1ij3Z2yn/fj:npYoZKEMFvDzJqhOuQ5/
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

darkcomet evasion persistence rat trojan

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies WinLogon for persistence 2 TTPs 24 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe"	bb32e1af9a4bfa8e3cf473ad54354eb9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe"	shell32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe"	shell32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe"	shell32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe"	shell32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe"	shell32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe"	shell32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe"	shell32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe"	shell32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe"	shell32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe"	shell32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe"	shell32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe"	shell32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe"	shell32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe"	shell32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe"	shell32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe"	shell32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe"	shell32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe"	shell32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe"	shell32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe"	shell32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe"	shell32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe"	shell32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe,C:\\Windows\\system32\\Windupdt\\shell32.exe"	shell32.exe

Drops file in Drivers directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	shell32.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	shell32.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	shell32.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	shell32.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	shell32.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	shell32.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	shell32.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	shell32.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	shell32.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	shell32.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	shell32.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	shell32.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	shell32.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	shell32.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	shell32.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	shell32.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	bb32e1af9a4bfa8e3cf473ad54354eb9.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	shell32.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	shell32.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	shell32.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	shell32.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	shell32.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	shell32.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	shell32.exe

Sets file to hidden 1 TTPs 48 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
2596	attrib.exe
2360	attrib.exe
4560	attrib.exe
4420	attrib.exe
2296	attrib.exe
1152	attrib.exe
2972	attrib.exe
3956	attrib.exe
4904	attrib.exe
2244	attrib.exe
2276	attrib.exe
5124	attrib.exe
4768	attrib.exe
4020	attrib.exe
4428	attrib.exe
4632	attrib.exe
3880	attrib.exe
5328	attrib.exe
4364	attrib.exe
3212	attrib.exe
2968	attrib.exe
5764	attrib.exe
5776	attrib.exe
2716	attrib.exe
2304	attrib.exe
4532	attrib.exe
1692	attrib.exe
4516	attrib.exe
3376	attrib.exe
4608	attrib.exe
4956	attrib.exe
5336	attrib.exe
3112	attrib.exe
3900	attrib.exe
2608	attrib.exe
5064	attrib.exe
4464	attrib.exe
4300	attrib.exe
3956	attrib.exe
1784	attrib.exe
456	attrib.exe
5048	attrib.exe
2908	attrib.exe
3692	attrib.exe
644	attrib.exe
4344	attrib.exe
2320	attrib.exe
2044	attrib.exe

Checks computer location settings 2 TTPs 24 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	shell32.exe
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	shell32.exe
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	shell32.exe
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	shell32.exe
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	shell32.exe
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	shell32.exe
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	shell32.exe
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	shell32.exe
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	shell32.exe
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	bb32e1af9a4bfa8e3cf473ad54354eb9.exe
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	shell32.exe
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	shell32.exe
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	shell32.exe
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	shell32.exe
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	shell32.exe
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	shell32.exe
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	shell32.exe
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	shell32.exe
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	shell32.exe
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	shell32.exe
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	shell32.exe
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	shell32.exe
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	shell32.exe
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	shell32.exe

Executes dropped EXE 23 IoCs

pid	Process
3216	shell32.exe
4792	shell32.exe
4592	shell32.exe
3236	shell32.exe
324	shell32.exe
4792	shell32.exe
2324	shell32.exe
1184	shell32.exe
1528	shell32.exe
4252	shell32.exe
3936	shell32.exe
3260	shell32.exe
3420	shell32.exe
4504	shell32.exe
3220	shell32.exe
3244	shell32.exe
2268	shell32.exe
1956	shell32.exe
1320	shell32.exe
3352	shell32.exe
1564	shell32.exe
5144	shell32.exe
5360	shell32.exe

Adds Run key to start application 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Shell32.dll = "C:\\Windows\\system32\\Windupdt\\shell32.exe"	shell32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Shell32.dll = "C:\\Windows\\system32\\Windupdt\\shell32.exe"	shell32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Shell32.dll = "C:\\Windows\\system32\\Windupdt\\shell32.exe"	shell32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Shell32.dll = "C:\\Windows\\system32\\Windupdt\\shell32.exe"	shell32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Shell32.dll = "C:\\Windows\\system32\\Windupdt\\shell32.exe"	shell32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Shell32.dll = "C:\\Windows\\system32\\Windupdt\\shell32.exe"	shell32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Shell32.dll = "C:\\Windows\\system32\\Windupdt\\shell32.exe"	shell32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Shell32.dll = "C:\\Windows\\system32\\Windupdt\\shell32.exe"	shell32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Shell32.dll = "C:\\Windows\\system32\\Windupdt\\shell32.exe"	shell32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Shell32.dll = "C:\\Windows\\system32\\Windupdt\\shell32.exe"	shell32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Shell32.dll = "C:\\Windows\\system32\\Windupdt\\shell32.exe"	shell32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Shell32.dll = "C:\\Windows\\system32\\Windupdt\\shell32.exe"	shell32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Shell32.dll = "C:\\Windows\\system32\\Windupdt\\shell32.exe"	shell32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Shell32.dll = "C:\\Windows\\system32\\Windupdt\\shell32.exe"	shell32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Shell32.dll = "C:\\Windows\\system32\\Windupdt\\shell32.exe"	shell32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Shell32.dll = "C:\\Windows\\system32\\Windupdt\\shell32.exe"	bb32e1af9a4bfa8e3cf473ad54354eb9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Shell32.dll = "C:\\Windows\\system32\\Windupdt\\shell32.exe"	shell32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Shell32.dll = "C:\\Windows\\system32\\Windupdt\\shell32.exe"	shell32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Shell32.dll = "C:\\Windows\\system32\\Windupdt\\shell32.exe"	shell32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Shell32.dll = "C:\\Windows\\system32\\Windupdt\\shell32.exe"	shell32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Shell32.dll = "C:\\Windows\\system32\\Windupdt\\shell32.exe"	shell32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Shell32.dll = "C:\\Windows\\system32\\Windupdt\\shell32.exe"	shell32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Shell32.dll = "C:\\Windows\\system32\\Windupdt\\shell32.exe"	shell32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Shell32.dll = "C:\\Windows\\system32\\Windupdt\\shell32.exe"	shell32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Windupdt\shell32.exe	shell32.exe
File created	C:\Windows\SysWOW64\Windupdt\shell32.exe	shell32.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt	attrib.exe
File created	C:\Windows\SysWOW64\Windupdt\shell32.exe	shell32.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\	shell32.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\	shell32.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\	shell32.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\shell32.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\shell32.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\shell32.exe	shell32.exe
File created	C:\Windows\SysWOW64\Windupdt\shell32.exe	shell32.exe
File created	C:\Windows\SysWOW64\Windupdt\shell32.exe	shell32.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\	shell32.exe
File created	C:\Windows\SysWOW64\Windupdt\shell32.exe	shell32.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\	shell32.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\shell32.exe	attrib.exe
File created	C:\Windows\SysWOW64\Windupdt\shell32.exe	shell32.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\shell32.exe	shell32.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\	shell32.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\	shell32.exe
File created	C:\Windows\SysWOW64\Windupdt\shell32.exe	shell32.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\	shell32.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\shell32.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\shell32.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\shell32.exe	shell32.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt	attrib.exe
File created	C:\Windows\SysWOW64\Windupdt\shell32.exe	shell32.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\	shell32.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\	shell32.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\shell32.exe	shell32.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\shell32.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\shell32.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\	shell32.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\	shell32.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\shell32.exe	attrib.exe
File created	C:\Windows\SysWOW64\Windupdt\shell32.exe	shell32.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\shell32.exe	shell32.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\shell32.exe	attrib.exe
File created	C:\Windows\SysWOW64\Windupdt\shell32.exe	shell32.exe
File created	C:\Windows\SysWOW64\Windupdt\shell32.exe	shell32.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt	attrib.exe
File created	C:\Windows\SysWOW64\Windupdt\shell32.exe	shell32.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\shell32.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\	shell32.exe
File created	C:\Windows\SysWOW64\Windupdt\shell32.exe	shell32.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\shell32.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\shell32.exe	shell32.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt	attrib.exe
File created	C:\Windows\SysWOW64\Windupdt\shell32.exe	shell32.exe
File created	C:\Windows\SysWOW64\Windupdt\shell32.exe	shell32.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\shell32.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\shell32.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\	shell32.exe
File created	C:\Windows\SysWOW64\Windupdt\shell32.exe	shell32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 24 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	shell32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	shell32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	shell32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	shell32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	shell32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	shell32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	shell32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	shell32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	shell32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	bb32e1af9a4bfa8e3cf473ad54354eb9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	shell32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	shell32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	shell32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	shell32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	shell32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	shell32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	shell32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	shell32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	shell32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	shell32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	shell32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	shell32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	shell32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	shell32.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2096	bb32e1af9a4bfa8e3cf473ad54354eb9.exe
Token: SeSecurityPrivilege	2096	bb32e1af9a4bfa8e3cf473ad54354eb9.exe
Token: SeTakeOwnershipPrivilege	2096	bb32e1af9a4bfa8e3cf473ad54354eb9.exe
Token: SeLoadDriverPrivilege	2096	bb32e1af9a4bfa8e3cf473ad54354eb9.exe
Token: SeSystemProfilePrivilege	2096	bb32e1af9a4bfa8e3cf473ad54354eb9.exe
Token: SeSystemtimePrivilege	2096	bb32e1af9a4bfa8e3cf473ad54354eb9.exe
Token: SeProfSingleProcessPrivilege	2096	bb32e1af9a4bfa8e3cf473ad54354eb9.exe
Token: SeIncBasePriorityPrivilege	2096	bb32e1af9a4bfa8e3cf473ad54354eb9.exe
Token: SeCreatePagefilePrivilege	2096	bb32e1af9a4bfa8e3cf473ad54354eb9.exe
Token: SeBackupPrivilege	2096	bb32e1af9a4bfa8e3cf473ad54354eb9.exe
Token: SeRestorePrivilege	2096	bb32e1af9a4bfa8e3cf473ad54354eb9.exe
Token: SeShutdownPrivilege	2096	bb32e1af9a4bfa8e3cf473ad54354eb9.exe
Token: SeDebugPrivilege	2096	bb32e1af9a4bfa8e3cf473ad54354eb9.exe
Token: SeSystemEnvironmentPrivilege	2096	bb32e1af9a4bfa8e3cf473ad54354eb9.exe
Token: SeChangeNotifyPrivilege	2096	bb32e1af9a4bfa8e3cf473ad54354eb9.exe
Token: SeRemoteShutdownPrivilege	2096	bb32e1af9a4bfa8e3cf473ad54354eb9.exe
Token: SeUndockPrivilege	2096	bb32e1af9a4bfa8e3cf473ad54354eb9.exe
Token: SeManageVolumePrivilege	2096	bb32e1af9a4bfa8e3cf473ad54354eb9.exe
Token: SeImpersonatePrivilege	2096	bb32e1af9a4bfa8e3cf473ad54354eb9.exe
Token: SeCreateGlobalPrivilege	2096	bb32e1af9a4bfa8e3cf473ad54354eb9.exe
Token: 33	2096	bb32e1af9a4bfa8e3cf473ad54354eb9.exe
Token: 34	2096	bb32e1af9a4bfa8e3cf473ad54354eb9.exe
Token: 35	2096	bb32e1af9a4bfa8e3cf473ad54354eb9.exe
Token: 36	2096	bb32e1af9a4bfa8e3cf473ad54354eb9.exe
Token: SeIncreaseQuotaPrivilege	3216	shell32.exe
Token: SeSecurityPrivilege	3216	shell32.exe
Token: SeTakeOwnershipPrivilege	3216	shell32.exe
Token: SeLoadDriverPrivilege	3216	shell32.exe
Token: SeSystemProfilePrivilege	3216	shell32.exe
Token: SeSystemtimePrivilege	3216	shell32.exe
Token: SeProfSingleProcessPrivilege	3216	shell32.exe
Token: SeIncBasePriorityPrivilege	3216	shell32.exe
Token: SeCreatePagefilePrivilege	3216	shell32.exe
Token: SeBackupPrivilege	3216	shell32.exe
Token: SeRestorePrivilege	3216	shell32.exe
Token: SeShutdownPrivilege	3216	shell32.exe
Token: SeDebugPrivilege	3216	shell32.exe
Token: SeSystemEnvironmentPrivilege	3216	shell32.exe
Token: SeChangeNotifyPrivilege	3216	shell32.exe
Token: SeRemoteShutdownPrivilege	3216	shell32.exe
Token: SeUndockPrivilege	3216	shell32.exe
Token: SeManageVolumePrivilege	3216	shell32.exe
Token: SeImpersonatePrivilege	3216	shell32.exe
Token: SeCreateGlobalPrivilege	3216	shell32.exe
Token: 33	3216	shell32.exe
Token: 34	3216	shell32.exe
Token: 35	3216	shell32.exe
Token: 36	3216	shell32.exe
Token: SeIncreaseQuotaPrivilege	4792	shell32.exe
Token: SeSecurityPrivilege	4792	shell32.exe
Token: SeTakeOwnershipPrivilege	4792	shell32.exe
Token: SeLoadDriverPrivilege	4792	shell32.exe
Token: SeSystemProfilePrivilege	4792	shell32.exe
Token: SeSystemtimePrivilege	4792	shell32.exe
Token: SeProfSingleProcessPrivilege	4792	shell32.exe
Token: SeIncBasePriorityPrivilege	4792	shell32.exe
Token: SeCreatePagefilePrivilege	4792	shell32.exe
Token: SeBackupPrivilege	4792	shell32.exe
Token: SeRestorePrivilege	4792	shell32.exe
Token: SeShutdownPrivilege	4792	shell32.exe
Token: SeDebugPrivilege	4792	shell32.exe
Token: SeSystemEnvironmentPrivilege	4792	shell32.exe
Token: SeChangeNotifyPrivilege	4792	shell32.exe
Token: SeRemoteShutdownPrivilege	4792	shell32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2096 wrote to memory of 2712	2096	bb32e1af9a4bfa8e3cf473ad54354eb9.exe	99
PID 2096 wrote to memory of 2712	2096	bb32e1af9a4bfa8e3cf473ad54354eb9.exe	99
PID 2096 wrote to memory of 2712	2096	bb32e1af9a4bfa8e3cf473ad54354eb9.exe	99
PID 2096 wrote to memory of 3224	2096	bb32e1af9a4bfa8e3cf473ad54354eb9.exe	100
PID 2096 wrote to memory of 3224	2096	bb32e1af9a4bfa8e3cf473ad54354eb9.exe	100
PID 2096 wrote to memory of 3224	2096	bb32e1af9a4bfa8e3cf473ad54354eb9.exe	100
PID 2712 wrote to memory of 2716	2712	cmd.exe	103
PID 2712 wrote to memory of 2716	2712	cmd.exe	103
PID 2712 wrote to memory of 2716	2712	cmd.exe	103
PID 3224 wrote to memory of 644	3224	cmd.exe	104
PID 3224 wrote to memory of 644	3224	cmd.exe	104
PID 3224 wrote to memory of 644	3224	cmd.exe	104
PID 2096 wrote to memory of 3216	2096	bb32e1af9a4bfa8e3cf473ad54354eb9.exe	105
PID 2096 wrote to memory of 3216	2096	bb32e1af9a4bfa8e3cf473ad54354eb9.exe	105
PID 2096 wrote to memory of 3216	2096	bb32e1af9a4bfa8e3cf473ad54354eb9.exe	105
PID 3216 wrote to memory of 1212	3216	shell32.exe	108
PID 3216 wrote to memory of 1212	3216	shell32.exe	108
PID 3216 wrote to memory of 1212	3216	shell32.exe	108
PID 3216 wrote to memory of 4312	3216	shell32.exe	110
PID 3216 wrote to memory of 4312	3216	shell32.exe	110
PID 3216 wrote to memory of 4312	3216	shell32.exe	110
PID 4312 wrote to memory of 1152	4312	cmd.exe	112
PID 4312 wrote to memory of 1152	4312	cmd.exe	112
PID 4312 wrote to memory of 1152	4312	cmd.exe	112
PID 1212 wrote to memory of 3112	1212	cmd.exe	113
PID 1212 wrote to memory of 3112	1212	cmd.exe	113
PID 1212 wrote to memory of 3112	1212	cmd.exe	113
PID 3216 wrote to memory of 4792	3216	shell32.exe	114
PID 3216 wrote to memory of 4792	3216	shell32.exe	114
PID 3216 wrote to memory of 4792	3216	shell32.exe	114
PID 4792 wrote to memory of 1576	4792	shell32.exe	116
PID 4792 wrote to memory of 1576	4792	shell32.exe	116
PID 4792 wrote to memory of 1576	4792	shell32.exe	116
PID 4792 wrote to memory of 4748	4792	shell32.exe	117
PID 4792 wrote to memory of 4748	4792	shell32.exe	117
PID 4792 wrote to memory of 4748	4792	shell32.exe	117
PID 4748 wrote to memory of 4364	4748	cmd.exe	120
PID 4748 wrote to memory of 4364	4748	cmd.exe	120
PID 4748 wrote to memory of 4364	4748	cmd.exe	120
PID 1576 wrote to memory of 2304	1576	cmd.exe	121
PID 1576 wrote to memory of 2304	1576	cmd.exe	121
PID 1576 wrote to memory of 2304	1576	cmd.exe	121
PID 4792 wrote to memory of 4592	4792	shell32.exe	122
PID 4792 wrote to memory of 4592	4792	shell32.exe	122
PID 4792 wrote to memory of 4592	4792	shell32.exe	122
PID 4592 wrote to memory of 1040	4592	shell32.exe	123
PID 4592 wrote to memory of 1040	4592	shell32.exe	123
PID 4592 wrote to memory of 1040	4592	shell32.exe	123
PID 4592 wrote to memory of 1628	4592	shell32.exe	125
PID 4592 wrote to memory of 1628	4592	shell32.exe	125
PID 4592 wrote to memory of 1628	4592	shell32.exe	125
PID 1040 wrote to memory of 3212	1040	cmd.exe	127
PID 1040 wrote to memory of 3212	1040	cmd.exe	127
PID 1040 wrote to memory of 3212	1040	cmd.exe	127
PID 1628 wrote to memory of 4532	1628	cmd.exe	128
PID 1628 wrote to memory of 4532	1628	cmd.exe	128
PID 1628 wrote to memory of 4532	1628	cmd.exe	128
PID 4592 wrote to memory of 3236	4592	shell32.exe	129
PID 4592 wrote to memory of 3236	4592	shell32.exe	129
PID 4592 wrote to memory of 3236	4592	shell32.exe	129
PID 3236 wrote to memory of 212	3236	shell32.exe	132
PID 3236 wrote to memory of 212	3236	shell32.exe	132
PID 3236 wrote to memory of 212	3236	shell32.exe	132
PID 3236 wrote to memory of 1152	3236	shell32.exe	134

Views/modifies file attributes 1 TTPs 48 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
4560	attrib.exe
456	attrib.exe
4420	attrib.exe
2608	attrib.exe
4300	attrib.exe
1152	attrib.exe
4768	attrib.exe
4516	attrib.exe
2276	attrib.exe
5328	attrib.exe
5124	attrib.exe
2360	attrib.exe
5048	attrib.exe
4956	attrib.exe
4428	attrib.exe
3376	attrib.exe
2972	attrib.exe
2296	attrib.exe
2244	attrib.exe
2716	attrib.exe
2304	attrib.exe
2320	attrib.exe
2968	attrib.exe
5064	attrib.exe
4532	attrib.exe
3956	attrib.exe
2596	attrib.exe
4904	attrib.exe
3900	attrib.exe
4608	attrib.exe
5776	attrib.exe
4364	attrib.exe
3212	attrib.exe
4344	attrib.exe
2044	attrib.exe
2908	attrib.exe
3112	attrib.exe
1692	attrib.exe
4020	attrib.exe
3692	attrib.exe
4632	attrib.exe
4464	attrib.exe
3880	attrib.exe
5336	attrib.exe
644	attrib.exe
3956	attrib.exe
1784	attrib.exe
5764	attrib.exe

C:\Users\Admin\AppData\Local\Temp\bb32e1af9a4bfa8e3cf473ad54354eb9.exe
"C:\Users\Admin\AppData\Local\Temp\bb32e1af9a4bfa8e3cf473ad54354eb9.exe"
1⤵
- Modifies WinLogon for persistence
- Drops file in Drivers directory
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2096
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\bb32e1af9a4bfa8e3cf473ad54354eb9.exe" +s +h
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2712
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Users\Admin\AppData\Local\Temp\bb32e1af9a4bfa8e3cf473ad54354eb9.exe" +s +h
    3⤵
    - Sets file to hidden
    - Views/modifies file attributes
    PID:2716
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3224
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
    3⤵
    - Sets file to hidden
    - Views/modifies file attributes
    PID:644
- C:\Windows\SysWOW64\Windupdt\shell32.exe
  "C:\Windows\system32\Windupdt\shell32.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Drops file in Drivers directory
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3216
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Windupdt\shell32.exe" +s +h
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1212
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Windows\SysWOW64\Windupdt\shell32.exe" +s +h
      4⤵
      Sets file to hidden
      Drops file in System32 directory
      Views/modifies file attributes
      PID:3112
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Windupdt" +s +h
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4312
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Windows\SysWOW64\Windupdt" +s +h
      4⤵
      Sets file to hidden
      Drops file in System32 directory
      Views/modifies file attributes
      PID:1152
- - C:\Windows\SysWOW64\Windupdt\shell32.exe
    "C:\Windows\system32\Windupdt\shell32.exe"
    3⤵
    - Modifies WinLogon for persistence
    - Drops file in Drivers directory
    - Checks computer location settings
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in System32 directory
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4792
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Windupdt\shell32.exe" +s +h
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1576
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\shell32.exe" +s +h
        5⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:2304
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Windupdt" +s +h
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4748
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        5⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:4364
  - - C:\Windows\SysWOW64\Windupdt\shell32.exe
      "C:\Windows\system32\Windupdt\shell32.exe"
      4⤵
      Modifies WinLogon for persistence
      Drops file in Drivers directory
      Checks computer location settings
      Executes dropped EXE
      Adds Run key to start application
      Drops file in System32 directory
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:4592
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Windupdt\shell32.exe" +s +h
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1040
      - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\shell32.exe" +s +h
        6⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:3212
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1628
      - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        6⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:4532
    - - C:\Windows\SysWOW64\Windupdt\shell32.exe
        
        "C:\Windows\system32\Windupdt\shell32.exe"
        5⤵
        Modifies WinLogon for persistence
        Drops file in Drivers directory
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3236
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Windupdt\shell32.exe" +s +h
        6⤵
        
        PID:212
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\shell32.exe" +s +h
        7⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:1692
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        6⤵
        
        PID:1152
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        7⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:4768
      - C:\Windows\SysWOW64\Windupdt\shell32.exe
        
        "C:\Windows\system32\Windupdt\shell32.exe"
        6⤵
        Modifies WinLogon for persistence
        Drops file in Drivers directory
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        
        PID:324
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Windupdt\shell32.exe" +s +h
        7⤵
        
        PID:4640
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\shell32.exe" +s +h
        8⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:4344
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        7⤵
        
        PID:3436
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        8⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:3956
        
        C:\Windows\SysWOW64\Windupdt\shell32.exe
        
        "C:\Windows\system32\Windupdt\shell32.exe"
        7⤵
        Modifies WinLogon for persistence
        Drops file in Drivers directory
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        
        PID:4792
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Windupdt\shell32.exe" +s +h
        8⤵
        
        PID:632
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\shell32.exe" +s +h
        9⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:2360
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        8⤵
        
        PID:3212
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        9⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:2596
        
        C:\Windows\SysWOW64\Windupdt\shell32.exe
        
        "C:\Windows\system32\Windupdt\shell32.exe"
        8⤵
        Modifies WinLogon for persistence
        Drops file in Drivers directory
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        
        PID:2324
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Windupdt\shell32.exe" +s +h
        9⤵
        
        PID:2096
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\shell32.exe" +s +h
        10⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:4020
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        9⤵
        
        PID:876
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        10⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:2320
        
        C:\Windows\SysWOW64\Windupdt\shell32.exe
        
        "C:\Windows\system32\Windupdt\shell32.exe"
        9⤵
        Modifies WinLogon for persistence
        Drops file in Drivers directory
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        
        PID:1184
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Windupdt\shell32.exe" +s +h
        10⤵
        
        PID:4860
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\shell32.exe" +s +h
        11⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:2972
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        10⤵
        
        PID:792
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        11⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:3956
        
        C:\Windows\SysWOW64\Windupdt\shell32.exe
        
        "C:\Windows\system32\Windupdt\shell32.exe"
        10⤵
        Modifies WinLogon for persistence
        Drops file in Drivers directory
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        
        PID:1528
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Windupdt\shell32.exe" +s +h
        11⤵
        
        PID:2740
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\shell32.exe" +s +h
        12⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:4516
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        11⤵
        
        PID:2320
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        12⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:4560
        
        C:\Windows\SysWOW64\Windupdt\shell32.exe
        
        "C:\Windows\system32\Windupdt\shell32.exe"
        11⤵
        Modifies WinLogon for persistence
        Drops file in Drivers directory
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        
        PID:4252
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Windupdt\shell32.exe" +s +h
        12⤵
        
        PID:3512
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\shell32.exe" +s +h
        13⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:456
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        12⤵
        
        PID:2620
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        13⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:1784
        
        C:\Windows\SysWOW64\Windupdt\shell32.exe
        
        "C:\Windows\system32\Windupdt\shell32.exe"
        12⤵
        Modifies WinLogon for persistence
        Drops file in Drivers directory
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        
        PID:3936
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Windupdt\shell32.exe" +s +h
        13⤵
        
        PID:3800
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\shell32.exe" +s +h
        14⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:4428
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        13⤵
        
        PID:1132
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        14⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:2968
        
        C:\Windows\SysWOW64\Windupdt\shell32.exe
        
        "C:\Windows\system32\Windupdt\shell32.exe"
        13⤵
        Modifies WinLogon for persistence
        Drops file in Drivers directory
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        
        PID:3260
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Windupdt\shell32.exe" +s +h
        14⤵
        
        PID:5108
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\shell32.exe" +s +h
        15⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:2044
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        14⤵
        
        PID:3028
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        15⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:5048
        
        C:\Windows\SysWOW64\Windupdt\shell32.exe
        
        "C:\Windows\system32\Windupdt\shell32.exe"
        14⤵
        Modifies WinLogon for persistence
        Drops file in Drivers directory
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        
        PID:3420
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Windupdt\shell32.exe" +s +h
        15⤵
        
        PID:4024
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\shell32.exe" +s +h
        16⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:3376
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        15⤵
        
        PID:4012
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        16⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:2908
        
        C:\Windows\SysWOW64\Windupdt\shell32.exe
        
        "C:\Windows\system32\Windupdt\shell32.exe"
        15⤵
        Modifies WinLogon for persistence
        Drops file in Drivers directory
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        
        PID:4504
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Windupdt\shell32.exe" +s +h
        16⤵
        
        PID:2996
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\shell32.exe" +s +h
        17⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:4904
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        16⤵
        
        PID:5048
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        17⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:4420
        
        C:\Windows\SysWOW64\Windupdt\shell32.exe
        
        "C:\Windows\system32\Windupdt\shell32.exe"
        16⤵
        Modifies WinLogon for persistence
        Drops file in Drivers directory
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        
        PID:3220
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Windupdt\shell32.exe" +s +h
        17⤵
        
        PID:4424
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\shell32.exe" +s +h
        18⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:3692
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        17⤵
        
        PID:556
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        18⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:3900
        
        C:\Windows\SysWOW64\Windupdt\shell32.exe
        
        "C:\Windows\system32\Windupdt\shell32.exe"
        17⤵
        Modifies WinLogon for persistence
        Drops file in Drivers directory
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        
        PID:3244
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Windupdt\shell32.exe" +s +h
        18⤵
        
        PID:4472
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\shell32.exe" +s +h
        19⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:4608
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        18⤵
        
        PID:468
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        19⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:2296
        
        C:\Windows\SysWOW64\Windupdt\shell32.exe
        
        "C:\Windows\system32\Windupdt\shell32.exe"
        18⤵
        Modifies WinLogon for persistence
        Drops file in Drivers directory
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        
        PID:2268
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Windupdt\shell32.exe" +s +h
        19⤵
        
        PID:3220
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\shell32.exe" +s +h
        20⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:4632
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        19⤵
        
        PID:2588
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        20⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:2608
        
        C:\Windows\SysWOW64\Windupdt\shell32.exe
        
        "C:\Windows\system32\Windupdt\shell32.exe"
        19⤵
        Modifies WinLogon for persistence
        Drops file in Drivers directory
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        
        PID:1956
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Windupdt\shell32.exe" +s +h
        20⤵
        
        PID:4728
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\shell32.exe" +s +h
        21⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:2244
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        20⤵
        
        PID:4228
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        21⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:4956
        
        C:\Windows\SysWOW64\Windupdt\shell32.exe
        
        "C:\Windows\system32\Windupdt\shell32.exe"
        20⤵
        Modifies WinLogon for persistence
        Drops file in Drivers directory
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        
        PID:1320
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Windupdt\shell32.exe" +s +h
        21⤵
        
        PID:920
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\shell32.exe" +s +h
        22⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:5064
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        21⤵
        
        PID:2684
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        22⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:4464
        
        C:\Windows\SysWOW64\Windupdt\shell32.exe
        
        "C:\Windows\system32\Windupdt\shell32.exe"
        21⤵
        Modifies WinLogon for persistence
        Drops file in Drivers directory
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        
        PID:3352
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Windupdt\shell32.exe" +s +h
        22⤵
        
        PID:4528
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\shell32.exe" +s +h
        23⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:3880
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        22⤵
        
        PID:4348
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        23⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:4300
        
        C:\Windows\SysWOW64\Windupdt\shell32.exe
        
        "C:\Windows\system32\Windupdt\shell32.exe"
        22⤵
        Modifies WinLogon for persistence
        Drops file in Drivers directory
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        
        PID:1564
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Windupdt\shell32.exe" +s +h
        23⤵
        
        PID:4600
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\shell32.exe" +s +h
        24⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:2276
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        23⤵
        
        PID:2080
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        24⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:5124
        
        C:\Windows\SysWOW64\Windupdt\shell32.exe
        
        "C:\Windows\system32\Windupdt\shell32.exe"
        23⤵
        Modifies WinLogon for persistence
        Drops file in Drivers directory
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        
        PID:5144
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Windupdt\shell32.exe" +s +h
        24⤵
        
        PID:5240
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\shell32.exe" +s +h
        25⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:5328
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        24⤵
        
        PID:5264
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        25⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:5336
        
        C:\Windows\SysWOW64\Windupdt\shell32.exe
        
        "C:\Windows\system32\Windupdt\shell32.exe"
        24⤵
        Modifies WinLogon for persistence
        Drops file in Drivers directory
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        
        PID:5360
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Windupdt\shell32.exe" +s +h
        25⤵
        
        PID:5676
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\shell32.exe" +s +h
        26⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:5764
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        25⤵
        
        PID:5684
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        26⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:5776
        
        C:\Windows\SysWOW64\Windupdt\shell32.exe
        
        "C:\Windows\system32\Windupdt\shell32.exe"
        25⤵
        
        PID:5792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

shell32.exe

Path C:\Windows\SysWOW64\Windupdt\shell32.exe
Size 702KB
SHA256 44beca4107263dd406893a7c9f46e716bcfd121c41c15130a868f2345d5143f2
MD5 bb32e1af9a4bfa8e3cf473ad54354eb9
SHA1 55428fad1677ddd437fcb798baac234c99de7b59
SHA512 7750bcad505a96382e9c7652faac3f2d27cf38242aedcfb89bb3989eea4d0a68dffc3b4c326123360572bb6b1751a2c03dbadf76951148e8348a6cfcd84a4c0c
SSDEEP 12288:ffFcGAT79cO2ZKpKHNMF4cDzJRlK2o58u1ij3Z2yn/fj:npYoZKEMFvDzJqhOuQ5/
MD5 SHA1 SHA512 SSDEEP

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 a2c3c44306b6d2b2b6d886ec8b1499ae5f0faa376caddd18b6231496b307f316
MD5 3191bd7970e8a94d547337b44e89e3c7
SHA1 6e633c9554762b7d39ffdec13fd0fdccd267927f
SHA512 08f6c053294289454521c9a02e270bc942c62350205167e6d90c1b2d05d75a5cbea1f15b7836eabf58cdf68744145a9e887c9029cd5b89a2870c4c7f8d4b6c78
MD5 SHA1 SHA512

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 006817fd8d1edf2a2bc14fcc843d0f89f308188afcefad640e712ebb778b4598
MD5 3f303f33cd35b4d781a077a20ef70f71
SHA1 14f345f578d43c1f82ed9fcf200617070b6eca2d
SHA512 63cf39506ed90a5a209939f33ee8f5ddf0b5662a1fb79843a2b219129baa4deacd1c7e5745c2f3a419b4ded1564ab36bf7bf7c6f8dd9ede416727ed077d68786
MD5 SHA1 SHA512

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 65222cfa633951e876794a2fc399763ffde241e7edfd49739fb0fe0cf6bce33c
MD5 b2680a1e8762ec4dd26f22d3200bbebb
SHA1 7fbe99418abdd3da52887a898ce455f2a316c154
SHA512 65b3d974be971efb92e99a366694cd005a44570d195cafc9dd79da86277a8988eaf65258accb5e2d0b8bf557914af7ee136252b5fbdfdce58d4ba83db328a351
MD5 SHA1 SHA512

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 9a4c802815ea69d9803a743d857d09edbfb1a719276487888f1e318daeb0bb95
MD5 4e1c1176e5ef6dd5a9228995c964ae0e
SHA1 073ee1c47091c0b8161fab0afa1ff9a8ab207636
SHA512 2b6acc824b308f97b27c2c5718a7955f16846be41a30fc6792bda6f38fbe1e30b39f6d5e6872e480dab9a7942e6a067f2fbe2ef55561d7793305f8d6ea7d4a3f
MD5 SHA1 SHA512

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1024B
SHA256 f15000ebdfc5dd1bad3610e90bf7009278e6a7de5b3259cdc449ef5fa52ee97d
MD5 f11b32344b2a473cb68dc098d93507a3
SHA1 836d89ce13f4cdd5ec74f8f9473bff334321270f
SHA512 5bb3c1d3a4597a289710826b21623d1248798070fa40bc1c1ef1bc5c967172d59a37e15397520689f8ed658ee42deacb98a9c7bfa03d79179ca3ae51cdc527af
MD5 SHA1 SHA512

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 5a79a3bb0f35efe65f5c5f6a9827924a9b1d25b6f99611f2b0be2fc98e3aae4b
MD5 5c92a1d27ba3d37f0f2546211ae5ecb8
SHA1 16f0dcfd2dd6cb6ed4bab10247c621559891425d
SHA512 71124486152a2fa86e931ab2426d9bdfce09524131dd677f8eb4a06a6a120e1d56ab313d0fcd9fd7d89a3fac0832bf48f2d5f8faa5b5b5255517530956737ef1
MD5 SHA1 SHA512

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 d495b05b9f6ffdf61344495ecb138e2e60b1637da2edd7bd298d2cc311d87802
MD5 fb3c557bba95bef784b9657683fdc615
SHA1 142688b8de95b4bec921eff163b2b7a670b2d5f5
SHA512 0673f5eb852f0c17ed4f8c4cf968d4e86056bec8a799749bf67d492f8aafa6e33bf51594780d785ffca9e9212ed219a69d675a8753e9751b32af2d8d5ee71435
MD5 SHA1 SHA512

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 88c2d732779c783cebc44ebaaa55ec8f5ab05e5ded2785381d1337cd36c2df15
MD5 042ccdca2962475fd1bc7e8a4b4b451a
SHA1 856ac73911915cc15af5001c15f76c660586be04
SHA512 f15029465306c81949b3060c392013d4256fa344fb37bde2b3f9cf79959686115dd28fc6bc994288fa7900a04d78231c2437a758d6f9486ce3bfa11545ea838f
MD5 SHA1 SHA512

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 2bfabe13158fe8a6689c4cc2d634475fb4e85e5aa2ba8d2eb1246f3deee4a4de
MD5 bb122c2305a19e51299ee9a8b7a9a2df
SHA1 75cafa2f072775f6f70e8dce0bc6b6a3fe611c8a
SHA512 fef90fa3306024c4beb9e7dad2bf88a4ae19660cbb7fe8c17d1c7f3a42d6532bb922cc31985f023e06396be3816a4c597ea51b168ceca7d3c796a253410b0b75
MD5 SHA1 SHA512

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 70ab029cf3bde8d002c858b80008ca5f61003310da41d58b6548426a3795e400
MD5 2d9864dd5ef84c6c2b2c06c0abd46339
SHA1 8884b02d25a84251a707096f278bd085387d0414
SHA512 71c4bb27b2b5278d39e44039b5d23d3986f41f951aac2d61420fa72f9e507d479c24b8e802d62aca87d38027bcc272d6d5cea008553c6248c4c31fe1c48d1810
MD5 SHA1 SHA512

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 002ba91992590a88a03b4ee616cb69d7def5825fd086c8f7b9268db96a9931a5
MD5 6c8147c55e3c1df759864c9681379c2f
SHA1 fb72e2b10605e6148e0fdeb6480f446da699c8d2
SHA512 feeddba7d039672b0f4e64b3d2054d3901bb5cee64af077aeadcd3efea2a8a93525873e21c720dc429a1151be25bf7c1cbc23d80919e42b60271bc6b57968553
MD5 SHA1 SHA512

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 9497bce09ebf478de7f2cb4903acc08dfe28804814d8f5f003cea5bbb46ee336
MD5 30ed3a0da738b22ed0736bf1d3d83d99
SHA1 14906c94dc35384f52ae997a7f907dfed45ad4e7
SHA512 ec34efcfe57461c2d3d2b874ac69736264c264b482e4b8ef917c75b8303729bfc57d560f95001e1db677023582fa69952a0a951396b9f1bf624aad3960b3b018
MD5 SHA1 SHA512

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 0fa90da28d647d74641d2fbcc3055d8f25dc37eae5a7695fb6bde31df9924a7a
MD5 d6d823cb0581853d2f838ed64435435f
SHA1 c96fb2c1b1d62e44a35efb23d09e6452499360c6
SHA512 9faca8804f5c1fede4b3fee1178650d08addfbad22c4f4899797644fcabdf3afc55e82b13c88a835de8ca51d9823b35c2cfb561fb8b3fad13e9124c91106916c
MD5 SHA1 SHA512

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 b1b14ed3480a870cf12ebd63d1d9bdf67d9e906063c279bd62957d249a474dcf
MD5 34ebfa6b50eeb5ff30dda4d15ed48a3b
SHA1 cb9b558671089642efcc1b04ddcc97e7ff73e485
SHA512 f5cb691bffde9264846e366d501a7a46df790b755975fc04c2b3f9079241f3be9ad6c09d8f63515211d4bd5dabf438720155d5a63e5be6df752631c66905fd0a
MD5 SHA1 SHA512

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 5da6356c5e89cf7cffefee41c69571a15a5f1b7233b18d6c23548fef1cbb7c12
MD5 dde2e3a3708dc9c68bc875e8b5becf28
SHA1 2aacfd95637d69ed01fc9867349ae1eae5830ebb
SHA512 3fd61e2c9ee469c07525e0022f94d4588d15ce6c69b84985a9633a3b0e41c6f40eb996fe8a5ed27c94663879e47c2f22b27c5123f70eb00d8828c13c6b072237
MD5 SHA1 SHA512

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 afb379b707ad8f3b5fb8338b5e4d26e74923ae7bcbda09b5a1e7a5c2a4ee2155
MD5 b9bf23eeb24bd5706b791ba6148bf17b
SHA1 70e98ae75f56bf3797e9bed45a7c0fa712b662f3
SHA512 cca07e8f2ccc9915b72062015f29e349f24dc462af1f5d1a513890985fed72da986560c835c4d31587dcd72c4023071759c583c2ac81d5907e51d870eba036ac
MD5 SHA1 SHA512

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 6912cf433b0cc98b73385d6fe6ad585d4a24a65840dccc030f17a77d5d45d05c
MD5 32ef7aa9f69649c7628bac299f58470a
SHA1 323ee9975ab736ffc8492a8eeae36efd94c14558
SHA512 73a934d58b5a8de03d31e6f4b08a2621d7285b865846faa5b994ff845c1ade01ac84c3133665eec7d5f70929a6e59fedd8208a4a27f892a498542995a1325067
MD5 SHA1 SHA512

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 7405dbc12df3ebd0f87af9c66b46ce848f3349ef7f9458d8ad7882374295698d
MD5 5746666433c35e37e29d113c7d3c62a6
SHA1 75ddf783afa6778dd599ade383e3d045d49f58b0
SHA512 aa32bc274c30cd809c451824edd19ed6b42f6197ca8b559a377a54e69690498a350b2c35fd3452b6f3acaf65df0b21cdc3a3d22c926d63bb2d8208d49285b354
MD5 SHA1 SHA512

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 8196c28c890eab7fcd97d6ed2faac1365ff83a064c27d4a06d9c83996f85fde7
MD5 6d3212c092503ae146b065b19e517ddc
SHA1 813b501f2d6da265965f0ee17f9885a0b6f96ad9
SHA512 344df6a6b5f11354cd0eade55320230d63361ab08f10e3aaca0fae54c18f019d69fda4f862f1f7be4b5a243b0131d113824a386d24937a345ba84e065a5dea66
MD5 SHA1 SHA512

Submit Download

memory/324-56-0x00000000007D0000-0x00000000007D1000-memory.dmp

Download

memory/324-60-0x0000000000400000-0x00000000004BD000-memory.dmp

Download

memory/1184-71-0x00000000008F0000-0x00000000008F1000-memory.dmp

Download

memory/1184-75-0x0000000000400000-0x00000000004BD000-memory.dmp

Download

memory/1320-126-0x0000000000690000-0x0000000000691000-memory.dmp

Download

memory/1320-130-0x0000000000400000-0x00000000004BD000-memory.dmp

Download

memory/1528-76-0x00000000021C0000-0x00000000021C1000-memory.dmp

Download

memory/1528-80-0x0000000000400000-0x00000000004BD000-memory.dmp

Download

memory/1564-136-0x00000000006D0000-0x00000000006D1000-memory.dmp

Download

memory/1564-140-0x0000000000400000-0x00000000004BD000-memory.dmp

Download

memory/1956-121-0x0000000000770000-0x0000000000771000-memory.dmp

Download

memory/1956-125-0x0000000000400000-0x00000000004BD000-memory.dmp

Download

memory/2096-0-0x0000000002850000-0x0000000002851000-memory.dmp

Download

memory/2096-35-0x0000000000400000-0x00000000004BD000-memory.dmp

Download

memory/2268-116-0x00000000023C0000-0x00000000023C1000-memory.dmp

Download

memory/2268-120-0x0000000000400000-0x00000000004BD000-memory.dmp

Download

memory/2324-70-0x0000000000400000-0x00000000004BD000-memory.dmp

Download

memory/2324-66-0x0000000002260000-0x0000000002261000-memory.dmp

Download

memory/3216-36-0x00000000022D0000-0x00000000022D1000-memory.dmp

Download

memory/3216-40-0x0000000000400000-0x00000000004BD000-memory.dmp

Download

memory/3220-106-0x0000000002040000-0x0000000002041000-memory.dmp

Download

memory/3220-110-0x0000000000400000-0x00000000004BD000-memory.dmp

Download

memory/3236-51-0x00000000021D0000-0x00000000021D1000-memory.dmp

Download

memory/3236-55-0x0000000000400000-0x00000000004BD000-memory.dmp

Download

memory/3244-115-0x0000000000400000-0x00000000004BD000-memory.dmp

Download

memory/3244-111-0x0000000002710000-0x0000000002711000-memory.dmp

Download

memory/3260-95-0x0000000000400000-0x00000000004BD000-memory.dmp

Download

memory/3260-91-0x00000000007D0000-0x00000000007D1000-memory.dmp

Download

memory/3352-135-0x0000000000400000-0x00000000004BD000-memory.dmp

Download

memory/3352-131-0x00000000009E0000-0x00000000009E1000-memory.dmp

Download

memory/3420-100-0x0000000000400000-0x00000000004BD000-memory.dmp

Download

memory/3420-96-0x0000000000980000-0x0000000000981000-memory.dmp

Download

memory/3936-86-0x00000000009B0000-0x00000000009B1000-memory.dmp

Download

memory/3936-90-0x0000000000400000-0x00000000004BD000-memory.dmp

Download

memory/4252-81-0x00000000009E0000-0x00000000009E1000-memory.dmp

Download

memory/4252-85-0x0000000000400000-0x00000000004BD000-memory.dmp

Download

memory/4504-101-0x0000000000840000-0x0000000000841000-memory.dmp

Download

memory/4504-105-0x0000000000400000-0x00000000004BD000-memory.dmp

Download

memory/4592-46-0x0000000002090000-0x0000000002091000-memory.dmp

Download

memory/4592-50-0x0000000000400000-0x00000000004BD000-memory.dmp

Download

memory/4792-45-0x0000000000400000-0x00000000004BD000-memory.dmp

Download

memory/4792-41-0x00000000006D0000-0x00000000006D1000-memory.dmp

Download

memory/4792-61-0x0000000002710000-0x0000000002711000-memory.dmp

Download

memory/4792-65-0x0000000000400000-0x00000000004BD000-memory.dmp

Download

memory/5144-141-0x0000000002190000-0x0000000002191000-memory.dmp

Download

memory/5144-144-0x0000000000400000-0x00000000004BD000-memory.dmp

Download

memory/5360-145-0x00000000007B0000-0x00000000007B1000-memory.dmp

Download

memory/5360-147-0x0000000000400000-0x00000000004BD000-memory.dmp

Download

memory/5792-148-0x0000000002090000-0x0000000002091000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads