darkcomet | ebb8382d407d4209132f5a7578fb823e3aceb365e31f63d2782d490cfc90777b

General

Target

06cfe3577f5346a9ddcbf8ad52ea9683_JaffaCakes118.exe
Size

333KB
MD5

06cfe3577f5346a9ddcbf8ad52ea9683
SHA1

2c303ac725fe2573839d20ac2b6802e4a0e67ca6
SHA256

ebb8382d407d4209132f5a7578fb823e3aceb365e31f63d2782d490cfc90777b
SHA512

023e5918ee363bce7f87d838018a6243c3be57512315f7359cb9838c3d01aea623bf56d0a0acdbe71dd9a587f4035d61f631fdef37fd2988c58e8d1171af2353
SSDEEP

6144:M2LEjyH8jI2GaegV8Xx70IBB7MdNa/whottJrVUGhBKdgMydR6:MPWcj11egV8Xt0yMm/wKJrVU4Kd/QR6

Score

10^/10

darkcomet z0mby evasion persistence rat trojan upx

Malware Config

Extracted

Family

darkcomet

Botnet

Z0mbY

C2

skekrlld66.zapto.org:1604

Mutex

DC_MUTEX-B3U22NR

Attributes

InstallPath
Microsoft\jusched.exe
gencode
fFyWeV9CgCDw
install
true
offline_keylogger
true
password
pankad12
persistence
true
reg_key
jusched

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

06cfe3577f5346a9ddcbf8ad52ea9683_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\jusched.exe"	06cfe3577f5346a9ddcbf8ad52ea9683_JaffaCakes118.exe

Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exeattrib.exe

pid process

2500 attrib.exe
1720 attrib.exe
Deletes itself 1 IoCs

Processes:

notepad.exe

pid process

2672 notepad.exe
Executes dropped EXE 2 IoCs

Processes:

jusched.exejusched.exe

pid process

2460 jusched.exe
2924 jusched.exe
Loads dropped DLL 2 IoCs

Processes:

06cfe3577f5346a9ddcbf8ad52ea9683_JaffaCakes118.exe

pid process

1252 06cfe3577f5346a9ddcbf8ad52ea9683_JaffaCakes118.exe
1252 06cfe3577f5346a9ddcbf8ad52ea9683_JaffaCakes118.exe

pid	process
2500	attrib.exe
1720	attrib.exe

pid	process
2672	notepad.exe

pid	process
2460	jusched.exe
2924	jusched.exe

pid	process
1252	06cfe3577f5346a9ddcbf8ad52ea9683_JaffaCakes118.exe
1252	06cfe3577f5346a9ddcbf8ad52ea9683_JaffaCakes118.exe

UPX packed file 20 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2548-0-0x0000000000400000-0x000000000047B000-memory.dmp	upx
behavioral1/memory/1252-5-0x0000000000400000-0x00000000004BA000-memory.dmp	upx
behavioral1/memory/1252-6-0x0000000000400000-0x00000000004BA000-memory.dmp	upx
behavioral1/memory/1252-10-0x0000000000400000-0x00000000004BA000-memory.dmp	upx
behavioral1/memory/1252-13-0x0000000000400000-0x00000000004BA000-memory.dmp	upx
behavioral1/memory/2548-12-0x0000000000400000-0x000000000047B000-memory.dmp	upx
behavioral1/memory/1252-16-0x0000000000400000-0x00000000004BA000-memory.dmp	upx
behavioral1/memory/1252-15-0x0000000000400000-0x00000000004BA000-memory.dmp	upx
behavioral1/memory/1252-14-0x0000000000400000-0x00000000004BA000-memory.dmp	upx
\Users\Admin\AppData\Roaming\Microsoft\jusched.exe	upx
behavioral1/memory/2460-51-0x0000000000400000-0x000000000047B000-memory.dmp	upx
behavioral1/memory/1252-47-0x0000000000400000-0x00000000004BA000-memory.dmp	upx
behavioral1/memory/1252-9-0x0000000000400000-0x00000000004BA000-memory.dmp	upx
behavioral1/memory/2924-66-0x0000000000400000-0x00000000004BA000-memory.dmp	upx
behavioral1/memory/2924-69-0x0000000000400000-0x00000000004BA000-memory.dmp	upx
behavioral1/memory/2924-68-0x0000000000400000-0x00000000004BA000-memory.dmp	upx
behavioral1/memory/2924-67-0x0000000000400000-0x00000000004BA000-memory.dmp	upx
behavioral1/memory/2460-64-0x0000000000400000-0x000000000047B000-memory.dmp	upx
behavioral1/memory/1252-113-0x00000000044A0000-0x000000000451B000-memory.dmp	upx
behavioral1/memory/2924-114-0x0000000000400000-0x00000000004BA000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

06cfe3577f5346a9ddcbf8ad52ea9683_JaffaCakes118.exejusched.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\jusched = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\jusched.exe"	06cfe3577f5346a9ddcbf8ad52ea9683_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\jusched = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\jusched.exe"	jusched.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

06cfe3577f5346a9ddcbf8ad52ea9683_JaffaCakes118.exejusched.exe

description	pid	process	target process
PID 2548 set thread context of 1252	2548	06cfe3577f5346a9ddcbf8ad52ea9683_JaffaCakes118.exe	06cfe3577f5346a9ddcbf8ad52ea9683_JaffaCakes118.exe
PID 2460 set thread context of 2924	2460	jusched.exe	jusched.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

jusched.exe

pid process

2924 jusched.exe

pid	process
2924	jusched.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

Processes:

06cfe3577f5346a9ddcbf8ad52ea9683_JaffaCakes118.exejusched.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	1252	06cfe3577f5346a9ddcbf8ad52ea9683_JaffaCakes118.exe
Token: SeSecurityPrivilege	1252	06cfe3577f5346a9ddcbf8ad52ea9683_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	1252	06cfe3577f5346a9ddcbf8ad52ea9683_JaffaCakes118.exe
Token: SeLoadDriverPrivilege	1252	06cfe3577f5346a9ddcbf8ad52ea9683_JaffaCakes118.exe
Token: SeSystemProfilePrivilege	1252	06cfe3577f5346a9ddcbf8ad52ea9683_JaffaCakes118.exe
Token: SeSystemtimePrivilege	1252	06cfe3577f5346a9ddcbf8ad52ea9683_JaffaCakes118.exe
Token: SeProfSingleProcessPrivilege	1252	06cfe3577f5346a9ddcbf8ad52ea9683_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	1252	06cfe3577f5346a9ddcbf8ad52ea9683_JaffaCakes118.exe
Token: SeCreatePagefilePrivilege	1252	06cfe3577f5346a9ddcbf8ad52ea9683_JaffaCakes118.exe
Token: SeBackupPrivilege	1252	06cfe3577f5346a9ddcbf8ad52ea9683_JaffaCakes118.exe
Token: SeRestorePrivilege	1252	06cfe3577f5346a9ddcbf8ad52ea9683_JaffaCakes118.exe
Token: SeShutdownPrivilege	1252	06cfe3577f5346a9ddcbf8ad52ea9683_JaffaCakes118.exe
Token: SeDebugPrivilege	1252	06cfe3577f5346a9ddcbf8ad52ea9683_JaffaCakes118.exe
Token: SeSystemEnvironmentPrivilege	1252	06cfe3577f5346a9ddcbf8ad52ea9683_JaffaCakes118.exe
Token: SeChangeNotifyPrivilege	1252	06cfe3577f5346a9ddcbf8ad52ea9683_JaffaCakes118.exe
Token: SeRemoteShutdownPrivilege	1252	06cfe3577f5346a9ddcbf8ad52ea9683_JaffaCakes118.exe
Token: SeUndockPrivilege	1252	06cfe3577f5346a9ddcbf8ad52ea9683_JaffaCakes118.exe
Token: SeManageVolumePrivilege	1252	06cfe3577f5346a9ddcbf8ad52ea9683_JaffaCakes118.exe
Token: SeImpersonatePrivilege	1252	06cfe3577f5346a9ddcbf8ad52ea9683_JaffaCakes118.exe
Token: SeCreateGlobalPrivilege	1252	06cfe3577f5346a9ddcbf8ad52ea9683_JaffaCakes118.exe
Token: 33	1252	06cfe3577f5346a9ddcbf8ad52ea9683_JaffaCakes118.exe
Token: 34	1252	06cfe3577f5346a9ddcbf8ad52ea9683_JaffaCakes118.exe
Token: 35	1252	06cfe3577f5346a9ddcbf8ad52ea9683_JaffaCakes118.exe
Token: SeIncreaseQuotaPrivilege	2924	jusched.exe
Token: SeSecurityPrivilege	2924	jusched.exe
Token: SeTakeOwnershipPrivilege	2924	jusched.exe
Token: SeLoadDriverPrivilege	2924	jusched.exe
Token: SeSystemProfilePrivilege	2924	jusched.exe
Token: SeSystemtimePrivilege	2924	jusched.exe
Token: SeProfSingleProcessPrivilege	2924	jusched.exe
Token: SeIncBasePriorityPrivilege	2924	jusched.exe
Token: SeCreatePagefilePrivilege	2924	jusched.exe
Token: SeBackupPrivilege	2924	jusched.exe
Token: SeRestorePrivilege	2924	jusched.exe
Token: SeShutdownPrivilege	2924	jusched.exe
Token: SeDebugPrivilege	2924	jusched.exe
Token: SeSystemEnvironmentPrivilege	2924	jusched.exe
Token: SeChangeNotifyPrivilege	2924	jusched.exe
Token: SeRemoteShutdownPrivilege	2924	jusched.exe
Token: SeUndockPrivilege	2924	jusched.exe
Token: SeManageVolumePrivilege	2924	jusched.exe
Token: SeImpersonatePrivilege	2924	jusched.exe
Token: SeCreateGlobalPrivilege	2924	jusched.exe
Token: 33	2924	jusched.exe
Token: 34	2924	jusched.exe
Token: 35	2924	jusched.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

06cfe3577f5346a9ddcbf8ad52ea9683_JaffaCakes118.exejusched.exejusched.exe

pid process

2548 06cfe3577f5346a9ddcbf8ad52ea9683_JaffaCakes118.exe
2460 jusched.exe
2924 jusched.exe

pid	process
2548	06cfe3577f5346a9ddcbf8ad52ea9683_JaffaCakes118.exe
2460	jusched.exe
2924	jusched.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

06cfe3577f5346a9ddcbf8ad52ea9683_JaffaCakes118.exe06cfe3577f5346a9ddcbf8ad52ea9683_JaffaCakes118.execmd.execmd.exejusched.exejusched.exe

description	pid	process	target process
PID 2548 wrote to memory of 1252	2548	06cfe3577f5346a9ddcbf8ad52ea9683_JaffaCakes118.exe	06cfe3577f5346a9ddcbf8ad52ea9683_JaffaCakes118.exe
PID 2548 wrote to memory of 1252	2548	06cfe3577f5346a9ddcbf8ad52ea9683_JaffaCakes118.exe	06cfe3577f5346a9ddcbf8ad52ea9683_JaffaCakes118.exe
PID 2548 wrote to memory of 1252	2548	06cfe3577f5346a9ddcbf8ad52ea9683_JaffaCakes118.exe	06cfe3577f5346a9ddcbf8ad52ea9683_JaffaCakes118.exe
PID 2548 wrote to memory of 1252	2548	06cfe3577f5346a9ddcbf8ad52ea9683_JaffaCakes118.exe	06cfe3577f5346a9ddcbf8ad52ea9683_JaffaCakes118.exe
PID 2548 wrote to memory of 1252	2548	06cfe3577f5346a9ddcbf8ad52ea9683_JaffaCakes118.exe	06cfe3577f5346a9ddcbf8ad52ea9683_JaffaCakes118.exe
PID 2548 wrote to memory of 1252	2548	06cfe3577f5346a9ddcbf8ad52ea9683_JaffaCakes118.exe	06cfe3577f5346a9ddcbf8ad52ea9683_JaffaCakes118.exe
PID 2548 wrote to memory of 1252	2548	06cfe3577f5346a9ddcbf8ad52ea9683_JaffaCakes118.exe	06cfe3577f5346a9ddcbf8ad52ea9683_JaffaCakes118.exe
PID 2548 wrote to memory of 1252	2548	06cfe3577f5346a9ddcbf8ad52ea9683_JaffaCakes118.exe	06cfe3577f5346a9ddcbf8ad52ea9683_JaffaCakes118.exe
PID 1252 wrote to memory of 1804	1252	06cfe3577f5346a9ddcbf8ad52ea9683_JaffaCakes118.exe	cmd.exe
PID 1252 wrote to memory of 1804	1252	06cfe3577f5346a9ddcbf8ad52ea9683_JaffaCakes118.exe	cmd.exe
PID 1252 wrote to memory of 1804	1252	06cfe3577f5346a9ddcbf8ad52ea9683_JaffaCakes118.exe	cmd.exe
PID 1252 wrote to memory of 1804	1252	06cfe3577f5346a9ddcbf8ad52ea9683_JaffaCakes118.exe	cmd.exe
PID 1252 wrote to memory of 2200	1252	06cfe3577f5346a9ddcbf8ad52ea9683_JaffaCakes118.exe	cmd.exe
PID 1252 wrote to memory of 2200	1252	06cfe3577f5346a9ddcbf8ad52ea9683_JaffaCakes118.exe	cmd.exe
PID 1252 wrote to memory of 2200	1252	06cfe3577f5346a9ddcbf8ad52ea9683_JaffaCakes118.exe	cmd.exe
PID 1252 wrote to memory of 2200	1252	06cfe3577f5346a9ddcbf8ad52ea9683_JaffaCakes118.exe	cmd.exe
PID 1252 wrote to memory of 2672	1252	06cfe3577f5346a9ddcbf8ad52ea9683_JaffaCakes118.exe	notepad.exe
PID 1252 wrote to memory of 2672	1252	06cfe3577f5346a9ddcbf8ad52ea9683_JaffaCakes118.exe	notepad.exe
PID 1252 wrote to memory of 2672	1252	06cfe3577f5346a9ddcbf8ad52ea9683_JaffaCakes118.exe	notepad.exe
PID 1252 wrote to memory of 2672	1252	06cfe3577f5346a9ddcbf8ad52ea9683_JaffaCakes118.exe	notepad.exe
PID 1252 wrote to memory of 2672	1252	06cfe3577f5346a9ddcbf8ad52ea9683_JaffaCakes118.exe	notepad.exe
PID 1252 wrote to memory of 2672	1252	06cfe3577f5346a9ddcbf8ad52ea9683_JaffaCakes118.exe	notepad.exe
PID 1252 wrote to memory of 2672	1252	06cfe3577f5346a9ddcbf8ad52ea9683_JaffaCakes118.exe	notepad.exe
PID 1252 wrote to memory of 2672	1252	06cfe3577f5346a9ddcbf8ad52ea9683_JaffaCakes118.exe	notepad.exe
PID 1252 wrote to memory of 2672	1252	06cfe3577f5346a9ddcbf8ad52ea9683_JaffaCakes118.exe	notepad.exe
PID 1252 wrote to memory of 2672	1252	06cfe3577f5346a9ddcbf8ad52ea9683_JaffaCakes118.exe	notepad.exe
PID 1252 wrote to memory of 2672	1252	06cfe3577f5346a9ddcbf8ad52ea9683_JaffaCakes118.exe	notepad.exe
PID 1252 wrote to memory of 2672	1252	06cfe3577f5346a9ddcbf8ad52ea9683_JaffaCakes118.exe	notepad.exe
PID 1252 wrote to memory of 2672	1252	06cfe3577f5346a9ddcbf8ad52ea9683_JaffaCakes118.exe	notepad.exe
PID 1252 wrote to memory of 2672	1252	06cfe3577f5346a9ddcbf8ad52ea9683_JaffaCakes118.exe	notepad.exe
PID 1252 wrote to memory of 2672	1252	06cfe3577f5346a9ddcbf8ad52ea9683_JaffaCakes118.exe	notepad.exe
PID 1252 wrote to memory of 2672	1252	06cfe3577f5346a9ddcbf8ad52ea9683_JaffaCakes118.exe	notepad.exe
PID 1252 wrote to memory of 2672	1252	06cfe3577f5346a9ddcbf8ad52ea9683_JaffaCakes118.exe	notepad.exe
PID 1252 wrote to memory of 2672	1252	06cfe3577f5346a9ddcbf8ad52ea9683_JaffaCakes118.exe	notepad.exe
PID 2200 wrote to memory of 2500	2200	cmd.exe	attrib.exe
PID 2200 wrote to memory of 2500	2200	cmd.exe	attrib.exe
PID 2200 wrote to memory of 2500	2200	cmd.exe	attrib.exe
PID 2200 wrote to memory of 2500	2200	cmd.exe	attrib.exe
PID 1804 wrote to memory of 1720	1804	cmd.exe	attrib.exe
PID 1804 wrote to memory of 1720	1804	cmd.exe	attrib.exe
PID 1804 wrote to memory of 1720	1804	cmd.exe	attrib.exe
PID 1804 wrote to memory of 1720	1804	cmd.exe	attrib.exe
PID 1252 wrote to memory of 2460	1252	06cfe3577f5346a9ddcbf8ad52ea9683_JaffaCakes118.exe	jusched.exe
PID 1252 wrote to memory of 2460	1252	06cfe3577f5346a9ddcbf8ad52ea9683_JaffaCakes118.exe	jusched.exe
PID 1252 wrote to memory of 2460	1252	06cfe3577f5346a9ddcbf8ad52ea9683_JaffaCakes118.exe	jusched.exe
PID 1252 wrote to memory of 2460	1252	06cfe3577f5346a9ddcbf8ad52ea9683_JaffaCakes118.exe	jusched.exe
PID 2460 wrote to memory of 2924	2460	jusched.exe	jusched.exe
PID 2460 wrote to memory of 2924	2460	jusched.exe	jusched.exe
PID 2460 wrote to memory of 2924	2460	jusched.exe	jusched.exe
PID 2460 wrote to memory of 2924	2460	jusched.exe	jusched.exe
PID 2460 wrote to memory of 2924	2460	jusched.exe	jusched.exe
PID 2460 wrote to memory of 2924	2460	jusched.exe	jusched.exe
PID 2460 wrote to memory of 2924	2460	jusched.exe	jusched.exe
PID 2460 wrote to memory of 2924	2460	jusched.exe	jusched.exe
PID 2924 wrote to memory of 2700	2924	jusched.exe	notepad.exe
PID 2924 wrote to memory of 2700	2924	jusched.exe	notepad.exe
PID 2924 wrote to memory of 2700	2924	jusched.exe	notepad.exe
PID 2924 wrote to memory of 2700	2924	jusched.exe	notepad.exe
PID 2924 wrote to memory of 2700	2924	jusched.exe	notepad.exe
PID 2924 wrote to memory of 2700	2924	jusched.exe	notepad.exe
PID 2924 wrote to memory of 2700	2924	jusched.exe	notepad.exe
PID 2924 wrote to memory of 2700	2924	jusched.exe	notepad.exe
PID 2924 wrote to memory of 2700	2924	jusched.exe	notepad.exe
PID 2924 wrote to memory of 2700	2924	jusched.exe	notepad.exe

Views/modifies file attributes 1 TTPs 2 IoCs
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exeattrib.exe

pid process

2500 attrib.exe
1720 attrib.exe

pid	process
2500	attrib.exe
1720	attrib.exe

C:\Users\Admin\AppData\Local\Temp\06cfe3577f5346a9ddcbf8ad52ea9683_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\06cfe3577f5346a9ddcbf8ad52ea9683_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2548

C:\Users\Admin\AppData\Local\Temp\06cfe3577f5346a9ddcbf8ad52ea9683_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\06cfe3577f5346a9ddcbf8ad52ea9683_JaffaCakes118.exe"
2⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1252

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\06cfe3577f5346a9ddcbf8ad52ea9683_JaffaCakes118.exe" +s +h
3⤵
- Suspicious use of WriteProcessMemory
PID:1804

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Users\Admin\AppData\Local\Temp\06cfe3577f5346a9ddcbf8ad52ea9683_JaffaCakes118.exe" +s +h
4⤵
- Sets file to hidden
- Views/modifies file attributes
PID:1720

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
3⤵
- Suspicious use of WriteProcessMemory
PID:2200

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
4⤵
- Sets file to hidden
- Views/modifies file attributes
PID:2500

C:\Windows\SysWOW64\notepad.exe
notepad
3⤵
- Deletes itself
PID:2672

C:\Users\Admin\AppData\Roaming\Microsoft\jusched.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\jusched.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2460

C:\Users\Admin\AppData\Roaming\Microsoft\jusched.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\jusched.exe"
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2924

C:\Windows\SysWOW64\notepad.exe
notepad
5⤵
PID:2700

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

2

T1112

Hide Artifacts

2

T1564

Hidden Files and Directories

2

T1564.001

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\Microsoft\jusched.exe
Filesize
333KB

MD5
06cfe3577f5346a9ddcbf8ad52ea9683

SHA1
2c303ac725fe2573839d20ac2b6802e4a0e67ca6

SHA256
ebb8382d407d4209132f5a7578fb823e3aceb365e31f63d2782d490cfc90777b

SHA512
023e5918ee363bce7f87d838018a6243c3be57512315f7359cb9838c3d01aea623bf56d0a0acdbe71dd9a587f4035d61f631fdef37fd2988c58e8d1171af2353

Download Submit
memory/1252-9-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/1252-5-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/1252-113-0x00000000044A0000-0x000000000451B000-memory.dmp

Filesize
492KB

Download
memory/1252-7-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1252-3-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/1252-13-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/1252-47-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/1252-16-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/1252-15-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/1252-17-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/1252-14-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/1252-48-0x00000000044A0000-0x000000000451B000-memory.dmp

Filesize
492KB

Download
memory/1252-6-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/1252-10-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/2460-51-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/2460-64-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/2548-12-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/2548-0-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/2672-36-0x0000000000190000-0x0000000000191000-memory.dmp

Filesize
4KB

Download
memory/2672-21-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/2924-66-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/2924-69-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/2924-68-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/2924-67-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/2924-114-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads