luminosity | e3cab08c80b5ca08d9b65e2fbde171b5c386f45b95b0863e7ec019eca07a43aa

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 12:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6af87a9e7baeb38bc0aee84fb505a53f_JaffaCakes118.exe
Size

1.0MB
MD5

6af87a9e7baeb38bc0aee84fb505a53f
SHA1

afe6ee7d43cbc89bdf416fbd96d43ac0883d6f6a
SHA256

e3cab08c80b5ca08d9b65e2fbde171b5c386f45b95b0863e7ec019eca07a43aa
SHA512

27cde2c1b1150d0c7294bc7aa1eba1ed6e32e8341bda162f050a2cfbfe84040d9587399c7d31c41fa38ee0d076610d6cad6d77f7dbbf6adf2eb0c47a99ac5a60
SSDEEP

12288:4P4wN/lTUyEs2t4/3VwcBXDxFFpZwCCUOkr77s7Cgrd+OJTK/f70WdqKxPvz7Cs/:W/a4fjdDHZp77QrIITKfguz7Csblia

Score

10^/10

luminosity persistence rat

Malware Config

Signatures

Luminosity 2 IoCs

Luminosity is a RAT family that was on sale, while claiming to be a system administration utility.

rat luminosity

Processes:

6af87a9e7baeb38bc0aee84fb505a53f_JaffaCakes118.exeschtasks.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\SystemCertificates\CA	6af87a9e7baeb38bc0aee84fb505a53f_JaffaCakes118.exe
1716	schtasks.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

6af87a9e7baeb38bc0aee84fb505a53f_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	6af87a9e7baeb38bc0aee84fb505a53f_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

Processes:

d_update.exe

pid process

2368 d_update.exe

Adds Run key to start application 2 TTPs 25 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

REG.exeREG.exeREG.exed_update.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\""	REG.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\""	REG.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\""	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "C:\\Users\\Admin\\AppData\\Roaming\\d_update.exe"	d_update.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Update = "C:\\Users\\Admin\\AppData\\Roaming\\d_update.exe"	d_update.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\""	REG.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\""	REG.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\""	REG.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\""	REG.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\""	REG.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\""	REG.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\""	REG.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\""	REG.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\""	REG.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\""	REG.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\""	REG.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\""	REG.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\""	REG.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\""	REG.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\""	REG.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\""	REG.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\""	REG.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\""	REG.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\""	REG.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\""	REG.exe

Drops file in Program Files directory 2 IoCs

Processes:

d_update.exe

description	ioc	process
File created	C:\Program Files (x86)\Client\client.exe	d_update.exe
File opened for modification	C:\Program Files (x86)\Client\client.exe	d_update.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

1716 schtasks.exe

pid	process
1716	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

d_update.exe

pid	process
2368	d_update.exe
2368	d_update.exe
2368	d_update.exe
2368	d_update.exe
2368	d_update.exe
2368	d_update.exe
2368	d_update.exe
2368	d_update.exe
2368	d_update.exe
2368	d_update.exe
2368	d_update.exe
2368	d_update.exe
2368	d_update.exe
2368	d_update.exe
2368	d_update.exe
2368	d_update.exe
2368	d_update.exe
2368	d_update.exe
2368	d_update.exe
2368	d_update.exe
2368	d_update.exe
2368	d_update.exe
2368	d_update.exe
2368	d_update.exe
2368	d_update.exe
2368	d_update.exe
2368	d_update.exe
2368	d_update.exe
2368	d_update.exe
2368	d_update.exe
2368	d_update.exe
2368	d_update.exe
2368	d_update.exe
2368	d_update.exe
2368	d_update.exe
2368	d_update.exe
2368	d_update.exe
2368	d_update.exe
2368	d_update.exe
2368	d_update.exe
2368	d_update.exe
2368	d_update.exe
2368	d_update.exe
2368	d_update.exe
2368	d_update.exe
2368	d_update.exe
2368	d_update.exe
2368	d_update.exe
2368	d_update.exe
2368	d_update.exe
2368	d_update.exe
2368	d_update.exe
2368	d_update.exe
2368	d_update.exe
2368	d_update.exe
2368	d_update.exe
2368	d_update.exe
2368	d_update.exe
2368	d_update.exe
2368	d_update.exe
2368	d_update.exe
2368	d_update.exe
2368	d_update.exe
2368	d_update.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

6af87a9e7baeb38bc0aee84fb505a53f_JaffaCakes118.exed_update.exe

description pid process

Token: SeDebugPrivilege 2868 6af87a9e7baeb38bc0aee84fb505a53f_JaffaCakes118.exe
Token: SeDebugPrivilege 2368 d_update.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

d_update.exe

pid process

2368 d_update.exe

description	pid	process
Token: SeDebugPrivilege	2868	6af87a9e7baeb38bc0aee84fb505a53f_JaffaCakes118.exe
Token: SeDebugPrivilege	2368	d_update.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

6af87a9e7baeb38bc0aee84fb505a53f_JaffaCakes118.exed_update.exe

description	pid	process	target process
PID 2868 wrote to memory of 2368	2868	6af87a9e7baeb38bc0aee84fb505a53f_JaffaCakes118.exe	d_update.exe
PID 2868 wrote to memory of 2368	2868	6af87a9e7baeb38bc0aee84fb505a53f_JaffaCakes118.exe	d_update.exe
PID 2868 wrote to memory of 2368	2868	6af87a9e7baeb38bc0aee84fb505a53f_JaffaCakes118.exe	d_update.exe
PID 2368 wrote to memory of 4556	2368	d_update.exe	REG.exe
PID 2368 wrote to memory of 4556	2368	d_update.exe	REG.exe
PID 2368 wrote to memory of 4556	2368	d_update.exe	REG.exe
PID 2368 wrote to memory of 1716	2368	d_update.exe	schtasks.exe
PID 2368 wrote to memory of 1716	2368	d_update.exe	schtasks.exe
PID 2368 wrote to memory of 1716	2368	d_update.exe	schtasks.exe
PID 2368 wrote to memory of 3152	2368	d_update.exe	REG.exe
PID 2368 wrote to memory of 3152	2368	d_update.exe	REG.exe
PID 2368 wrote to memory of 3152	2368	d_update.exe	REG.exe
PID 2368 wrote to memory of 4760	2368	d_update.exe	REG.exe
PID 2368 wrote to memory of 4760	2368	d_update.exe	REG.exe
PID 2368 wrote to memory of 4760	2368	d_update.exe	REG.exe
PID 2368 wrote to memory of 1564	2368	d_update.exe	REG.exe
PID 2368 wrote to memory of 1564	2368	d_update.exe	REG.exe
PID 2368 wrote to memory of 1564	2368	d_update.exe	REG.exe
PID 2368 wrote to memory of 2232	2368	d_update.exe	REG.exe
PID 2368 wrote to memory of 2232	2368	d_update.exe	REG.exe
PID 2368 wrote to memory of 2232	2368	d_update.exe	REG.exe
PID 2368 wrote to memory of 2960	2368	d_update.exe	REG.exe
PID 2368 wrote to memory of 2960	2368	d_update.exe	REG.exe
PID 2368 wrote to memory of 2960	2368	d_update.exe	REG.exe
PID 2368 wrote to memory of 1088	2368	d_update.exe	REG.exe
PID 2368 wrote to memory of 1088	2368	d_update.exe	REG.exe
PID 2368 wrote to memory of 1088	2368	d_update.exe	REG.exe
PID 2368 wrote to memory of 3196	2368	d_update.exe	REG.exe
PID 2368 wrote to memory of 3196	2368	d_update.exe	REG.exe
PID 2368 wrote to memory of 3196	2368	d_update.exe	REG.exe
PID 2368 wrote to memory of 4384	2368	d_update.exe	REG.exe
PID 2368 wrote to memory of 4384	2368	d_update.exe	REG.exe
PID 2368 wrote to memory of 4384	2368	d_update.exe	REG.exe
PID 2368 wrote to memory of 5024	2368	d_update.exe	REG.exe
PID 2368 wrote to memory of 5024	2368	d_update.exe	REG.exe
PID 2368 wrote to memory of 5024	2368	d_update.exe	REG.exe
PID 2368 wrote to memory of 4200	2368	d_update.exe	REG.exe
PID 2368 wrote to memory of 4200	2368	d_update.exe	REG.exe
PID 2368 wrote to memory of 4200	2368	d_update.exe	REG.exe
PID 2368 wrote to memory of 1420	2368	d_update.exe	REG.exe
PID 2368 wrote to memory of 1420	2368	d_update.exe	REG.exe
PID 2368 wrote to memory of 1420	2368	d_update.exe	REG.exe
PID 2368 wrote to memory of 224	2368	d_update.exe	REG.exe
PID 2368 wrote to memory of 224	2368	d_update.exe	REG.exe
PID 2368 wrote to memory of 224	2368	d_update.exe	REG.exe
PID 2368 wrote to memory of 2204	2368	d_update.exe	REG.exe
PID 2368 wrote to memory of 2204	2368	d_update.exe	REG.exe
PID 2368 wrote to memory of 2204	2368	d_update.exe	REG.exe
PID 2368 wrote to memory of 1660	2368	d_update.exe	REG.exe
PID 2368 wrote to memory of 1660	2368	d_update.exe	REG.exe
PID 2368 wrote to memory of 1660	2368	d_update.exe	REG.exe
PID 2368 wrote to memory of 1616	2368	d_update.exe	REG.exe
PID 2368 wrote to memory of 1616	2368	d_update.exe	REG.exe
PID 2368 wrote to memory of 1616	2368	d_update.exe	REG.exe
PID 2368 wrote to memory of 3100	2368	d_update.exe	REG.exe
PID 2368 wrote to memory of 3100	2368	d_update.exe	REG.exe
PID 2368 wrote to memory of 3100	2368	d_update.exe	REG.exe
PID 2368 wrote to memory of 3756	2368	d_update.exe	REG.exe
PID 2368 wrote to memory of 3756	2368	d_update.exe	REG.exe
PID 2368 wrote to memory of 3756	2368	d_update.exe	REG.exe
PID 2368 wrote to memory of 3344	2368	d_update.exe	REG.exe
PID 2368 wrote to memory of 3344	2368	d_update.exe	REG.exe
PID 2368 wrote to memory of 3344	2368	d_update.exe	REG.exe
PID 2368 wrote to memory of 3180	2368	d_update.exe	REG.exe

C:\Users\Admin\AppData\Local\Temp\6af87a9e7baeb38bc0aee84fb505a53f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6af87a9e7baeb38bc0aee84fb505a53f_JaffaCakes118.exe"
1⤵
- Luminosity
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Users\Admin\AppData\Roaming\d_update.exe
  "C:\Users\Admin\AppData\Roaming\d_update.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2368
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:64
    3⤵
    - Adds Run key to start application
    PID:4556
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /NP /sc onlogon /tn "Client Monitor" /rl highest /tr "'C:\Program Files (x86)\Client\client.exe' /startup" /f
    3⤵
    - Luminosity
    - Creates scheduled task(s)
    PID:1716
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:64
    3⤵
    - Adds Run key to start application
    PID:3152
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:64
    3⤵
    - Adds Run key to start application
    PID:4760
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:64
    3⤵
    - Adds Run key to start application
    PID:1564
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:64
    3⤵
    - Adds Run key to start application
    PID:2232
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:64
    3⤵
    - Adds Run key to start application
    PID:2960
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:64
    3⤵
    - Adds Run key to start application
    PID:1088
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:64
    3⤵
    - Adds Run key to start application
    PID:3196
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:64
    3⤵
    - Adds Run key to start application
    PID:4384
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:64
    3⤵
    - Adds Run key to start application
    PID:5024
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:64
    3⤵
    - Adds Run key to start application
    PID:4200
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:64
    3⤵
    - Adds Run key to start application
    PID:1420
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:64
    3⤵
    - Adds Run key to start application
    PID:224
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:64
    3⤵
    - Adds Run key to start application
    PID:2204
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:64
    3⤵
    - Adds Run key to start application
    PID:1660
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:64
    3⤵
    - Adds Run key to start application
    PID:1616
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:64
    3⤵
    - Adds Run key to start application
    PID:3100
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:64
    3⤵
    - Adds Run key to start application
    PID:3756
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:64
    3⤵
    - Adds Run key to start application
    PID:3344
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:64
    3⤵
    - Adds Run key to start application
    PID:3180
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:64
    3⤵
    - Adds Run key to start application
    PID:4928
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:64
    3⤵
    - Adds Run key to start application
    PID:1120
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:64
    3⤵
    - Adds Run key to start application
    PID:2724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5

Filesize
471B

MD5
4b376095237f75073a2a247e1518433f

SHA1
ad7571886ccf7fcf34b7f18694a5b6fc8d65da1a

SHA256
28aec2ad57d12b8dccf2c48e9cad64382c027ed9b8e5120cec6d9c93c30fe297

SHA512
3f470e948382eaf5b35a5c10c005ff44416e7bc3bd7b8138f38358a1899cb4c9bb1914b7860c2645f5beee5254d1bb4ab6d7aacc03f9d4f4e48abd76be41b6ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66AE3BFDF94A732B262342AD2154B86E_108A7991F73F2B507007C35661993162

Filesize
471B

MD5
445c78b1decc260cf7cb9efdaa43a6ad

SHA1
d59a3caed612cf12831e0baa925728b1b1c99523

SHA256
5b8dae610070c323229f4e5494902c28d4712e793a45da48062760cd3d495a4d

SHA512
4c4b10ffbdce024ad00b0bfb21b1679443d172435ee4d5a9e12b66300db0485b5e7e69972790d1161fdb06f25aaa034b9f6733aa72b70dbd9ddca94cc4d10806

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5

Filesize
404B

MD5
c02ea0f4460c542f46b0d4ae20060234

SHA1
e49b2b46b97059d0e8a55156a56a5f62dc3f8168

SHA256
475528fdfbbadb2c5bc7b1f33a8d5e90e4d6ae9276d33183bf6aa855666d850a

SHA512
cb3bebc43328c9324fcbfc2a77b5d5520308c382a5c1a56d9c9c8a86fdf9685f5ea115f86fa70857c001d49a2ea8e2d1503f6974bdde6e43c079bd003e725665

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66AE3BFDF94A732B262342AD2154B86E_108A7991F73F2B507007C35661993162

Filesize
400B

MD5
fbdd14b48f401a7461aa8acdfa8d979e

SHA1
baa6a840ed5191d9d7e387c97ed0c57ded7daf84

SHA256
f046a494826af7e116693b66cc6811dcb33e6e8bbfc43eb4f63103114a531891

SHA512
be6b4149b5529347d0949e8d73b3b68045a3fa0921b288da94dbf9f03167aef15d6d8c5dba1a7806a483d6a87598276167716569fdfa8b5110d152addcaeb67b

Download Submit
C:\Users\Admin\AppData\Roaming\d_update.exe

Filesize
1.0MB

MD5
6af87a9e7baeb38bc0aee84fb505a53f

SHA1
afe6ee7d43cbc89bdf416fbd96d43ac0883d6f6a

SHA256
e3cab08c80b5ca08d9b65e2fbde171b5c386f45b95b0863e7ec019eca07a43aa

SHA512
27cde2c1b1150d0c7294bc7aa1eba1ed6e32e8341bda162f050a2cfbfe84040d9587399c7d31c41fa38ee0d076610d6cad6d77f7dbbf6adf2eb0c47a99ac5a60

Download Submit
memory/2368-29-0x00000000748C0000-0x0000000074E71000-memory.dmp

Filesize
5.7MB

Download
memory/2368-28-0x00000000748C0000-0x0000000074E71000-memory.dmp

Filesize
5.7MB

Download
memory/2368-35-0x00000000748C0000-0x0000000074E71000-memory.dmp

Filesize
5.7MB

Download
memory/2868-0-0x00000000748C2000-0x00000000748C3000-memory.dmp

Filesize
4KB

Download
memory/2868-1-0x00000000748C0000-0x0000000074E71000-memory.dmp

Filesize
5.7MB

Download
memory/2868-2-0x00000000748C0000-0x0000000074E71000-memory.dmp

Filesize
5.7MB

Download
memory/2868-23-0x00000000748C0000-0x0000000074E71000-memory.dmp

Filesize
5.7MB

Download