darkcomet | f51a0aa16b0a033eaeb45e5bbea6b492b499a0af1404309882f333f18f4e890a

Analysis

max time kernel
150s
max time network
125s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
29-04-2024 02:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

06a15ab711359ca5c66335039793daaf_JaffaCakes118.exe
Size

770KB
MD5

06a15ab711359ca5c66335039793daaf
SHA1

95bd3194b060bc8e775e5bc0a76bc6dc0094a70b
SHA256

f51a0aa16b0a033eaeb45e5bbea6b492b499a0af1404309882f333f18f4e890a
SHA512

925fe2815b0ff212a26b1d1e63de27c44f83069c9a8b3643f114c28b9b6764ca867e5039324ca92174730f777dcd75e5f4f43b13583ff8ad599fbe810a58f998
SSDEEP

12288:P9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9EkNC/B:5Z1xuVVjfFoynPaVBUR8f+kN10EdB

Score

10^/10

darkcomet guest16 evasion persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

tihe17.zapto.org:8030

Mutex

DC_MUTEX-X1RN242

Attributes

InstallPath
MSDCSC\msdcsc.exe
gencode
umehiZR0cf0n
install
true
offline_keylogger
true
persistence
true
reg_key
MicroUpdate

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

06a15ab711359ca5c66335039793daaf_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	06a15ab711359ca5c66335039793daaf_JaffaCakes118.exe

Modifies firewall policy service 2 TTPs 3 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Processes:

msdcsc.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	msdcsc.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	msdcsc.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0"	msdcsc.exe

Modifies security service 2 TTPs 1 IoCs
evasion

Modify Registry
T1112

Windows Service
T1543.003

Processes:

msdcsc.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" msdcsc.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	msdcsc.exe

Windows security bypass 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

msdcsc.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	msdcsc.exe

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\13523 = "C:\\PROGRA~3\\LOCALS~1\\Temp\\msxiapaj.com"	svchost.exe

Disables RegEdit via registry modification 1 IoCs

evasion

Processes:

msdcsc.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	msdcsc.exe

Disables Task Manager via registry modification
evasion
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exeattrib.exe

pid process

2588 attrib.exe
2632 attrib.exe
Deletes itself 1 IoCs

Processes:

notepad.exe

pid process

2552 notepad.exe
Executes dropped EXE 3 IoCs

Processes:

1.EXEmsdcsc.exe1.EXE

pid process

2644 1.EXE
2492 msdcsc.exe
2940 1.EXE

pid	process
2588	attrib.exe
2632	attrib.exe

pid	process
2552	notepad.exe

pid	process
2644	1.EXE
2492	msdcsc.exe
2940	1.EXE

Loads dropped DLL 6 IoCs

Processes:

06a15ab711359ca5c66335039793daaf_JaffaCakes118.exemsdcsc.exe

pid	process
2040	06a15ab711359ca5c66335039793daaf_JaffaCakes118.exe
2040	06a15ab711359ca5c66335039793daaf_JaffaCakes118.exe
2040	06a15ab711359ca5c66335039793daaf_JaffaCakes118.exe
2040	06a15ab711359ca5c66335039793daaf_JaffaCakes118.exe
2492	msdcsc.exe
2492	msdcsc.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

msdcsc.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	msdcsc.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

06a15ab711359ca5c66335039793daaf_JaffaCakes118.exemsdcsc.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	06a15ab711359ca5c66335039793daaf_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	msdcsc.exe

Maps connected drives based on registry 3 TTPs 4 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

1.EXE1.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	1.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum	1.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	1.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum	1.EXE

Drops file in Program Files directory 1 IoCs

Processes:

svchost.exe

description ioc process

File created C:\PROGRA~3\LOCALS~1\Temp\msxiapaj.com svchost.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

1.EXE1.EXE

pid process

2644 1.EXE
2940 1.EXE
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

msdcsc.exe

pid process

2492 msdcsc.exe
Suspicious behavior: MapViewOfSection 4 IoCs

Processes:

1.EXE1.EXE

pid process

2644 1.EXE
2644 1.EXE
2940 1.EXE
2940 1.EXE

description	ioc	process
File created	C:\PROGRA~3\LOCALS~1\Temp\msxiapaj.com	svchost.exe

pid	process
2644	1.EXE
2940	1.EXE

pid	process
2492	msdcsc.exe

pid	process
2644	1.EXE
2644	1.EXE
2940	1.EXE
2940	1.EXE

Suspicious use of AdjustPrivilegeToken 46 IoCs

Processes:

06a15ab711359ca5c66335039793daaf_JaffaCakes118.exemsdcsc.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	2040	06a15ab711359ca5c66335039793daaf_JaffaCakes118.exe
Token: SeSecurityPrivilege	2040	06a15ab711359ca5c66335039793daaf_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	2040	06a15ab711359ca5c66335039793daaf_JaffaCakes118.exe
Token: SeLoadDriverPrivilege	2040	06a15ab711359ca5c66335039793daaf_JaffaCakes118.exe
Token: SeSystemProfilePrivilege	2040	06a15ab711359ca5c66335039793daaf_JaffaCakes118.exe
Token: SeSystemtimePrivilege	2040	06a15ab711359ca5c66335039793daaf_JaffaCakes118.exe
Token: SeProfSingleProcessPrivilege	2040	06a15ab711359ca5c66335039793daaf_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	2040	06a15ab711359ca5c66335039793daaf_JaffaCakes118.exe
Token: SeCreatePagefilePrivilege	2040	06a15ab711359ca5c66335039793daaf_JaffaCakes118.exe
Token: SeBackupPrivilege	2040	06a15ab711359ca5c66335039793daaf_JaffaCakes118.exe
Token: SeRestorePrivilege	2040	06a15ab711359ca5c66335039793daaf_JaffaCakes118.exe
Token: SeShutdownPrivilege	2040	06a15ab711359ca5c66335039793daaf_JaffaCakes118.exe
Token: SeDebugPrivilege	2040	06a15ab711359ca5c66335039793daaf_JaffaCakes118.exe
Token: SeSystemEnvironmentPrivilege	2040	06a15ab711359ca5c66335039793daaf_JaffaCakes118.exe
Token: SeChangeNotifyPrivilege	2040	06a15ab711359ca5c66335039793daaf_JaffaCakes118.exe
Token: SeRemoteShutdownPrivilege	2040	06a15ab711359ca5c66335039793daaf_JaffaCakes118.exe
Token: SeUndockPrivilege	2040	06a15ab711359ca5c66335039793daaf_JaffaCakes118.exe
Token: SeManageVolumePrivilege	2040	06a15ab711359ca5c66335039793daaf_JaffaCakes118.exe
Token: SeImpersonatePrivilege	2040	06a15ab711359ca5c66335039793daaf_JaffaCakes118.exe
Token: SeCreateGlobalPrivilege	2040	06a15ab711359ca5c66335039793daaf_JaffaCakes118.exe
Token: 33	2040	06a15ab711359ca5c66335039793daaf_JaffaCakes118.exe
Token: 34	2040	06a15ab711359ca5c66335039793daaf_JaffaCakes118.exe
Token: 35	2040	06a15ab711359ca5c66335039793daaf_JaffaCakes118.exe
Token: SeIncreaseQuotaPrivilege	2492	msdcsc.exe
Token: SeSecurityPrivilege	2492	msdcsc.exe
Token: SeTakeOwnershipPrivilege	2492	msdcsc.exe
Token: SeLoadDriverPrivilege	2492	msdcsc.exe
Token: SeSystemProfilePrivilege	2492	msdcsc.exe
Token: SeSystemtimePrivilege	2492	msdcsc.exe
Token: SeProfSingleProcessPrivilege	2492	msdcsc.exe
Token: SeIncBasePriorityPrivilege	2492	msdcsc.exe
Token: SeCreatePagefilePrivilege	2492	msdcsc.exe
Token: SeBackupPrivilege	2492	msdcsc.exe
Token: SeRestorePrivilege	2492	msdcsc.exe
Token: SeShutdownPrivilege	2492	msdcsc.exe
Token: SeDebugPrivilege	2492	msdcsc.exe
Token: SeSystemEnvironmentPrivilege	2492	msdcsc.exe
Token: SeChangeNotifyPrivilege	2492	msdcsc.exe
Token: SeRemoteShutdownPrivilege	2492	msdcsc.exe
Token: SeUndockPrivilege	2492	msdcsc.exe
Token: SeManageVolumePrivilege	2492	msdcsc.exe
Token: SeImpersonatePrivilege	2492	msdcsc.exe
Token: SeCreateGlobalPrivilege	2492	msdcsc.exe
Token: 33	2492	msdcsc.exe
Token: 34	2492	msdcsc.exe
Token: 35	2492	msdcsc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

msdcsc.exe

pid process

2492 msdcsc.exe

pid	process
2492	msdcsc.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

06a15ab711359ca5c66335039793daaf_JaffaCakes118.execmd.execmd.exe1.EXEmsdcsc.exe1.EXE

description	pid	process	target process
PID 2040 wrote to memory of 2028	2040	06a15ab711359ca5c66335039793daaf_JaffaCakes118.exe	cmd.exe
PID 2040 wrote to memory of 2028	2040	06a15ab711359ca5c66335039793daaf_JaffaCakes118.exe	cmd.exe
PID 2040 wrote to memory of 2028	2040	06a15ab711359ca5c66335039793daaf_JaffaCakes118.exe	cmd.exe
PID 2040 wrote to memory of 2028	2040	06a15ab711359ca5c66335039793daaf_JaffaCakes118.exe	cmd.exe
PID 2040 wrote to memory of 2168	2040	06a15ab711359ca5c66335039793daaf_JaffaCakes118.exe	cmd.exe
PID 2040 wrote to memory of 2168	2040	06a15ab711359ca5c66335039793daaf_JaffaCakes118.exe	cmd.exe
PID 2040 wrote to memory of 2168	2040	06a15ab711359ca5c66335039793daaf_JaffaCakes118.exe	cmd.exe
PID 2040 wrote to memory of 2168	2040	06a15ab711359ca5c66335039793daaf_JaffaCakes118.exe	cmd.exe
PID 2028 wrote to memory of 2632	2028	cmd.exe	attrib.exe
PID 2028 wrote to memory of 2632	2028	cmd.exe	attrib.exe
PID 2028 wrote to memory of 2632	2028	cmd.exe	attrib.exe
PID 2028 wrote to memory of 2632	2028	cmd.exe	attrib.exe
PID 2168 wrote to memory of 2588	2168	cmd.exe	attrib.exe
PID 2168 wrote to memory of 2588	2168	cmd.exe	attrib.exe
PID 2168 wrote to memory of 2588	2168	cmd.exe	attrib.exe
PID 2168 wrote to memory of 2588	2168	cmd.exe	attrib.exe
PID 2040 wrote to memory of 2644	2040	06a15ab711359ca5c66335039793daaf_JaffaCakes118.exe	1.EXE
PID 2040 wrote to memory of 2644	2040	06a15ab711359ca5c66335039793daaf_JaffaCakes118.exe	1.EXE
PID 2040 wrote to memory of 2644	2040	06a15ab711359ca5c66335039793daaf_JaffaCakes118.exe	1.EXE
PID 2040 wrote to memory of 2644	2040	06a15ab711359ca5c66335039793daaf_JaffaCakes118.exe	1.EXE
PID 2644 wrote to memory of 2276	2644	1.EXE	svchost.exe
PID 2644 wrote to memory of 2276	2644	1.EXE	svchost.exe
PID 2644 wrote to memory of 2276	2644	1.EXE	svchost.exe
PID 2644 wrote to memory of 2276	2644	1.EXE	svchost.exe
PID 2040 wrote to memory of 2552	2040	06a15ab711359ca5c66335039793daaf_JaffaCakes118.exe	notepad.exe
PID 2040 wrote to memory of 2552	2040	06a15ab711359ca5c66335039793daaf_JaffaCakes118.exe	notepad.exe
PID 2040 wrote to memory of 2552	2040	06a15ab711359ca5c66335039793daaf_JaffaCakes118.exe	notepad.exe
PID 2040 wrote to memory of 2552	2040	06a15ab711359ca5c66335039793daaf_JaffaCakes118.exe	notepad.exe
PID 2040 wrote to memory of 2552	2040	06a15ab711359ca5c66335039793daaf_JaffaCakes118.exe	notepad.exe
PID 2040 wrote to memory of 2552	2040	06a15ab711359ca5c66335039793daaf_JaffaCakes118.exe	notepad.exe
PID 2040 wrote to memory of 2552	2040	06a15ab711359ca5c66335039793daaf_JaffaCakes118.exe	notepad.exe
PID 2040 wrote to memory of 2552	2040	06a15ab711359ca5c66335039793daaf_JaffaCakes118.exe	notepad.exe
PID 2040 wrote to memory of 2552	2040	06a15ab711359ca5c66335039793daaf_JaffaCakes118.exe	notepad.exe
PID 2040 wrote to memory of 2552	2040	06a15ab711359ca5c66335039793daaf_JaffaCakes118.exe	notepad.exe
PID 2040 wrote to memory of 2552	2040	06a15ab711359ca5c66335039793daaf_JaffaCakes118.exe	notepad.exe
PID 2040 wrote to memory of 2552	2040	06a15ab711359ca5c66335039793daaf_JaffaCakes118.exe	notepad.exe
PID 2040 wrote to memory of 2552	2040	06a15ab711359ca5c66335039793daaf_JaffaCakes118.exe	notepad.exe
PID 2040 wrote to memory of 2552	2040	06a15ab711359ca5c66335039793daaf_JaffaCakes118.exe	notepad.exe
PID 2040 wrote to memory of 2552	2040	06a15ab711359ca5c66335039793daaf_JaffaCakes118.exe	notepad.exe
PID 2040 wrote to memory of 2552	2040	06a15ab711359ca5c66335039793daaf_JaffaCakes118.exe	notepad.exe
PID 2040 wrote to memory of 2552	2040	06a15ab711359ca5c66335039793daaf_JaffaCakes118.exe	notepad.exe
PID 2040 wrote to memory of 2552	2040	06a15ab711359ca5c66335039793daaf_JaffaCakes118.exe	notepad.exe
PID 2040 wrote to memory of 2492	2040	06a15ab711359ca5c66335039793daaf_JaffaCakes118.exe	msdcsc.exe
PID 2040 wrote to memory of 2492	2040	06a15ab711359ca5c66335039793daaf_JaffaCakes118.exe	msdcsc.exe
PID 2040 wrote to memory of 2492	2040	06a15ab711359ca5c66335039793daaf_JaffaCakes118.exe	msdcsc.exe
PID 2040 wrote to memory of 2492	2040	06a15ab711359ca5c66335039793daaf_JaffaCakes118.exe	msdcsc.exe
PID 2492 wrote to memory of 2940	2492	msdcsc.exe	1.EXE
PID 2492 wrote to memory of 2940	2492	msdcsc.exe	1.EXE
PID 2492 wrote to memory of 2940	2492	msdcsc.exe	1.EXE
PID 2492 wrote to memory of 2940	2492	msdcsc.exe	1.EXE
PID 2940 wrote to memory of 1768	2940	1.EXE	svchost.exe
PID 2940 wrote to memory of 1768	2940	1.EXE	svchost.exe
PID 2940 wrote to memory of 1768	2940	1.EXE	svchost.exe
PID 2940 wrote to memory of 1768	2940	1.EXE	svchost.exe
PID 2492 wrote to memory of 1960	2492	msdcsc.exe	iexplore.exe
PID 2492 wrote to memory of 1960	2492	msdcsc.exe	iexplore.exe
PID 2492 wrote to memory of 1960	2492	msdcsc.exe	iexplore.exe
PID 2492 wrote to memory of 1960	2492	msdcsc.exe	iexplore.exe
PID 2492 wrote to memory of 344	2492	msdcsc.exe	explorer.exe
PID 2492 wrote to memory of 344	2492	msdcsc.exe	explorer.exe
PID 2492 wrote to memory of 344	2492	msdcsc.exe	explorer.exe
PID 2492 wrote to memory of 344	2492	msdcsc.exe	explorer.exe
PID 2492 wrote to memory of 2332	2492	msdcsc.exe	notepad.exe
PID 2492 wrote to memory of 2332	2492	msdcsc.exe	notepad.exe

System policy modification 1 TTPs 3 IoCs

evasion

Modify Registry

T1112

Processes:

msdcsc.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion	msdcsc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern\NoControlPanel = "1"	msdcsc.exe

Views/modifies file attributes 1 TTPs 2 IoCs
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exeattrib.exe

pid process

2588 attrib.exe
2632 attrib.exe

pid	process
2588	attrib.exe
2632	attrib.exe

C:\Users\Admin\AppData\Local\Temp\06a15ab711359ca5c66335039793daaf_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\06a15ab711359ca5c66335039793daaf_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2040

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\06a15ab711359ca5c66335039793daaf_JaffaCakes118.exe" +s +h
2⤵
- Suspicious use of WriteProcessMemory
PID:2028

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Users\Admin\AppData\Local\Temp\06a15ab711359ca5c66335039793daaf_JaffaCakes118.exe" +s +h
3⤵
- Sets file to hidden
- Views/modifies file attributes
PID:2632

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
2⤵
- Suspicious use of WriteProcessMemory
PID:2168

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
3⤵
- Sets file to hidden
- Views/modifies file attributes
PID:2588

C:\Users\Admin\AppData\Local\Temp\1.EXE
"C:\Users\Admin\AppData\Local\Temp\1.EXE"
2⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2644

C:\Windows\syswow64\svchost.exe
C:\Windows\syswow64\svchost.exe
3⤵
- Adds policy Run key to start application
- Drops file in Program Files directory
PID:2276

C:\Windows\SysWOW64\notepad.exe
notepad
2⤵
- Deletes itself
PID:2552

C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"
2⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2492

C:\Users\Admin\AppData\Local\Temp\1.EXE
"C:\Users\Admin\AppData\Local\Temp\1.EXE"
3⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2940

C:\Windows\syswow64\svchost.exe
C:\Windows\syswow64\svchost.exe
4⤵
PID:1768

C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
3⤵
PID:1960

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
3⤵
PID:344

C:\Windows\SysWOW64\notepad.exe
notepad
3⤵
PID:2332

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\1.EXE
Filesize
13KB

MD5
95ff7bbd32e9002d393e056828187814

SHA1
68a9b42cc5a5fd10f3cd53baaacbb80646b0c057

SHA256
40999d697b90d2ef63889c53e00cc1be3f94d2a0581198ad6199ed2a29a14e94

SHA512
8bc2f53dab5afa0eeb577fa9521bea42ccf7b176a2733dd312779774b31bc9e65b4fac7942386e0af76fa5a7dcde5e5d401abc7befb16ffb8091befaf9cf2d77

Download Submit
\Users\Admin\Documents\MSDCSC\msdcsc.exe
Filesize
770KB

MD5
06a15ab711359ca5c66335039793daaf

SHA1
95bd3194b060bc8e775e5bc0a76bc6dc0094a70b

SHA256
f51a0aa16b0a033eaeb45e5bbea6b492b499a0af1404309882f333f18f4e890a

SHA512
925fe2815b0ff212a26b1d1e63de27c44f83069c9a8b3643f114c28b9b6764ca867e5039324ca92174730f777dcd75e5f4f43b13583ff8ad599fbe810a58f998

Download Submit
memory/2040-0-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/2040-7-0x0000000002600000-0x0000000002605000-memory.dmp

Filesize
20KB

Download
memory/2276-13-0x00000000001F0000-0x00000000001F8000-memory.dmp

Filesize
32KB

Download
memory/2492-62-0x0000000001E80000-0x0000000001E85000-memory.dmp

Filesize
20KB

Download
memory/2552-42-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/2552-14-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download