darkcomet | 527acddaab3715206424c16698f405766278f3a2cbc88f9c37a8adc2db211b4c

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24/06/2024, 16:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
09a418b391da18934d5efb9857513f0a_JaffaCakes118.exe
Size 1009KB
Sample240624-t5h1fssbrb
SHA256 527acddaab3715206424c16698f405766278f3a2cbc88f9c37a8adc2db211b4c
MD5 09a418b391da18934d5efb9857513f0a
SHA1 63dc8507fd0c2fddc485cda2152253ec05f698d3
SHA512 64d5478fa147686d66ca48158038247ac3fdb748218ecce6e8ceb263b89ad91665bd5e1b8e849059170b5153139b6608ab957beb3b0655b3dac581668ce7d602
SSDEEP 12288:zI4nFUnTcMyKiOsY0V2rNrO8iLva87LlNatN0LwS3h9KrvDf+u+jBqRcw:zIE2S+08prO/a87hWNej3heDWu4ERf
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

darkcomet victim rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

victim

anobs.zapto.org:1604

Mutex

DC_MUTEX-4U49DAD

Attributes

gencode
2EzqVmS8GEe8
install
false
offline_keylogger
true
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	09a418b391da18934d5efb9857513f0a_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
3488	svchost.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3592 set thread context of 3488	3592	09a418b391da18934d5efb9857513f0a_JaffaCakes118.exe	80

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings	09a418b391da18934d5efb9857513f0a_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 25 IoCs

description	pid	Process
Token: SeDebugPrivilege	3592	09a418b391da18934d5efb9857513f0a_JaffaCakes118.exe
Token: SeIncreaseQuotaPrivilege	3488	svchost.exe
Token: SeSecurityPrivilege	3488	svchost.exe
Token: SeTakeOwnershipPrivilege	3488	svchost.exe
Token: SeLoadDriverPrivilege	3488	svchost.exe
Token: SeSystemProfilePrivilege	3488	svchost.exe
Token: SeSystemtimePrivilege	3488	svchost.exe
Token: SeProfSingleProcessPrivilege	3488	svchost.exe
Token: SeIncBasePriorityPrivilege	3488	svchost.exe
Token: SeCreatePagefilePrivilege	3488	svchost.exe
Token: SeBackupPrivilege	3488	svchost.exe
Token: SeRestorePrivilege	3488	svchost.exe
Token: SeShutdownPrivilege	3488	svchost.exe
Token: SeDebugPrivilege	3488	svchost.exe
Token: SeSystemEnvironmentPrivilege	3488	svchost.exe
Token: SeChangeNotifyPrivilege	3488	svchost.exe
Token: SeRemoteShutdownPrivilege	3488	svchost.exe
Token: SeUndockPrivilege	3488	svchost.exe
Token: SeManageVolumePrivilege	3488	svchost.exe
Token: SeImpersonatePrivilege	3488	svchost.exe
Token: SeCreateGlobalPrivilege	3488	svchost.exe
Token: 33	3488	svchost.exe
Token: 34	3488	svchost.exe
Token: 35	3488	svchost.exe
Token: 36	3488	svchost.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2596	AcroRd32.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
3488	svchost.exe
2596	AcroRd32.exe
2596	AcroRd32.exe
2596	AcroRd32.exe
2596	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3592 wrote to memory of 3488	3592	09a418b391da18934d5efb9857513f0a_JaffaCakes118.exe	80
PID 3592 wrote to memory of 3488	3592	09a418b391da18934d5efb9857513f0a_JaffaCakes118.exe	80
PID 3592 wrote to memory of 3488	3592	09a418b391da18934d5efb9857513f0a_JaffaCakes118.exe	80
PID 3592 wrote to memory of 3488	3592	09a418b391da18934d5efb9857513f0a_JaffaCakes118.exe	80
PID 3592 wrote to memory of 3488	3592	09a418b391da18934d5efb9857513f0a_JaffaCakes118.exe	80
PID 3592 wrote to memory of 3488	3592	09a418b391da18934d5efb9857513f0a_JaffaCakes118.exe	80
PID 3592 wrote to memory of 3488	3592	09a418b391da18934d5efb9857513f0a_JaffaCakes118.exe	80
PID 3592 wrote to memory of 3488	3592	09a418b391da18934d5efb9857513f0a_JaffaCakes118.exe	80
PID 3592 wrote to memory of 3488	3592	09a418b391da18934d5efb9857513f0a_JaffaCakes118.exe	80
PID 3592 wrote to memory of 3488	3592	09a418b391da18934d5efb9857513f0a_JaffaCakes118.exe	80
PID 3592 wrote to memory of 3488	3592	09a418b391da18934d5efb9857513f0a_JaffaCakes118.exe	80
PID 3592 wrote to memory of 3488	3592	09a418b391da18934d5efb9857513f0a_JaffaCakes118.exe	80
PID 3592 wrote to memory of 3488	3592	09a418b391da18934d5efb9857513f0a_JaffaCakes118.exe	80
PID 3592 wrote to memory of 3488	3592	09a418b391da18934d5efb9857513f0a_JaffaCakes118.exe	80
PID 3592 wrote to memory of 2596	3592	09a418b391da18934d5efb9857513f0a_JaffaCakes118.exe	81
PID 3592 wrote to memory of 2596	3592	09a418b391da18934d5efb9857513f0a_JaffaCakes118.exe	81
PID 3592 wrote to memory of 2596	3592	09a418b391da18934d5efb9857513f0a_JaffaCakes118.exe	81
PID 3592 wrote to memory of 4128	3592	09a418b391da18934d5efb9857513f0a_JaffaCakes118.exe	82
PID 3592 wrote to memory of 4128	3592	09a418b391da18934d5efb9857513f0a_JaffaCakes118.exe	82
PID 3592 wrote to memory of 4128	3592	09a418b391da18934d5efb9857513f0a_JaffaCakes118.exe	82
PID 2596 wrote to memory of 1088	2596	AcroRd32.exe	84
PID 2596 wrote to memory of 1088	2596	AcroRd32.exe	84
PID 2596 wrote to memory of 1088	2596	AcroRd32.exe	84
PID 1088 wrote to memory of 492	1088	RdrCEF.exe	85
PID 1088 wrote to memory of 492	1088	RdrCEF.exe	85
PID 1088 wrote to memory of 492	1088	RdrCEF.exe	85
PID 1088 wrote to memory of 492	1088	RdrCEF.exe	85
PID 1088 wrote to memory of 492	1088	RdrCEF.exe	85
PID 1088 wrote to memory of 492	1088	RdrCEF.exe	85
PID 1088 wrote to memory of 492	1088	RdrCEF.exe	85
PID 1088 wrote to memory of 492	1088	RdrCEF.exe	85
PID 1088 wrote to memory of 492	1088	RdrCEF.exe	85
PID 1088 wrote to memory of 492	1088	RdrCEF.exe	85
PID 1088 wrote to memory of 492	1088	RdrCEF.exe	85
PID 1088 wrote to memory of 492	1088	RdrCEF.exe	85
PID 1088 wrote to memory of 492	1088	RdrCEF.exe	85
PID 1088 wrote to memory of 492	1088	RdrCEF.exe	85
PID 1088 wrote to memory of 492	1088	RdrCEF.exe	85
PID 1088 wrote to memory of 492	1088	RdrCEF.exe	85
PID 1088 wrote to memory of 492	1088	RdrCEF.exe	85
PID 1088 wrote to memory of 492	1088	RdrCEF.exe	85
PID 1088 wrote to memory of 492	1088	RdrCEF.exe	85
PID 1088 wrote to memory of 492	1088	RdrCEF.exe	85
PID 1088 wrote to memory of 492	1088	RdrCEF.exe	85
PID 1088 wrote to memory of 492	1088	RdrCEF.exe	85
PID 1088 wrote to memory of 492	1088	RdrCEF.exe	85
PID 1088 wrote to memory of 492	1088	RdrCEF.exe	85
PID 1088 wrote to memory of 492	1088	RdrCEF.exe	85
PID 1088 wrote to memory of 492	1088	RdrCEF.exe	85
PID 1088 wrote to memory of 492	1088	RdrCEF.exe	85
PID 1088 wrote to memory of 492	1088	RdrCEF.exe	85
PID 1088 wrote to memory of 492	1088	RdrCEF.exe	85
PID 1088 wrote to memory of 492	1088	RdrCEF.exe	85
PID 1088 wrote to memory of 492	1088	RdrCEF.exe	85
PID 1088 wrote to memory of 492	1088	RdrCEF.exe	85
PID 1088 wrote to memory of 492	1088	RdrCEF.exe	85
PID 1088 wrote to memory of 492	1088	RdrCEF.exe	85
PID 1088 wrote to memory of 492	1088	RdrCEF.exe	85
PID 1088 wrote to memory of 492	1088	RdrCEF.exe	85
PID 1088 wrote to memory of 492	1088	RdrCEF.exe	85
PID 1088 wrote to memory of 492	1088	RdrCEF.exe	85
PID 1088 wrote to memory of 492	1088	RdrCEF.exe	85
PID 1088 wrote to memory of 492	1088	RdrCEF.exe	85
PID 1088 wrote to memory of 492	1088	RdrCEF.exe	85

C:\Users\Admin\AppData\Local\Temp\09a418b391da18934d5efb9857513f0a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\09a418b391da18934d5efb9857513f0a_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3592
- C:\Users\Admin\AppData\Local\Temp\svchost.exe
  C:\Users\Admin\AppData\Local\Temp\svchost.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3488
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\ShanghaiGoodWTConf04-24-12.pdf"
  2⤵
  - Checks processor information in registry
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2596
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1088
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=0A095BF1798DACE4334F3285831F6794 --mojo-platform-channel-handle=1732 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      PID:492
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=3EDAC1D5E1E0CAD9A4A5FAA1B76856A4 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=3EDAC1D5E1E0CAD9A4A5FAA1B76856A4 --renderer-client-id=2 --mojo-platform-channel-handle=1744 --allow-no-sandbox-job /prefetch:1
      4⤵
      PID:2292
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=86C97265161AF627FF0A0015B0C3778C --mojo-platform-channel-handle=2300 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      PID:2060
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=42BFB1E0FCE60A4F8E611E1F38473ECD --mojo-platform-channel-handle=1736 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      PID:320
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=D22ADCAE1FC15654E5F3D47641EBB8EF --mojo-platform-channel-handle=2316 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      PID:2944
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=FF9B0D30D993C70FD71FB813D8B7E1CC --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=FF9B0D30D993C70FD71FB813D8B7E1CC --renderer-client-id=7 --mojo-platform-channel-handle=1720 --allow-no-sandbox-job /prefetch:1
      4⤵
      PID:4456
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\j.vbs"
  2⤵
  PID:4128

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 36KB
SHA256 b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3
MD5 b30d3becc8731792523d599d949e63f5
SHA1 19350257e42d7aee17fb3bf139a9d3adb330fad4
SHA512 523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e
SSDEEP 24:TLiXlzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9Mzm+Zs3tGl:TqlmFTIF3XmHjBoGGR+jMz+LhT
MD5 SHA1 SHA512 SSDEEP

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 56KB
SHA256 111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131
MD5 752a1f26b18748311b691c7d8fc20633
SHA1 c1f8e83eebc1cc1e9b88c773338eb09ff82ab862
SHA512 a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5
SSDEEP 192:wedRBvVrThe4p4/KhTB4p4CitZtkZsLRGVDbw6H3ph+v3YQa9:weZdThkKhBvkZsLRGlzh+vS9
MD5 SHA1 SHA512 SSDEEP

Submit Download

ShanghaiGoodWTConf04-24-12.pdf

Path C:\Users\Admin\AppData\Local\Temp\ShanghaiGoodWTConf04-24-12.pdf
Size 74KB
SHA256 a02b2bf0dbac6c49bb5708bb826d95887f41bce7756ca2187ac5386200532bba
MD5 e6a2db77b1481736bef195460b6a1efb
SHA1 d5836b54bc2d725b2acd1cdf1720d9e4b2112983
SHA512 522f16f88ea96db5c0159d586ac8b5601c0bcdaea7b780f225e05ed18f637191913fe7660f990548f815daf28b7a961eb008a05874a3ee2f65d26a673a236857
SSDEEP 1536:4VufLnJuX+rHGFOUNOf1spKT8lp3Qd1f5lionjgtTG+3u0KcW8BR:ZJVGFOYOf1s4TSpAd1f5lioj32JBR
MD5 SHA1 SHA512 SSDEEP

Submit Download

j.vbs

Path C:\Users\Admin\AppData\Local\Temp\j.vbs
Size 343B
SHA256 a8fd3a5c18a3ba04d4634974ad524c9283089148cc677fee58d311a0aa6b950b
MD5 65f94bdf37000c4e117754678961b3df
SHA1 1c923def5d3198b49e4ace9c5054d1a41324d43a
SHA512 f21526e5ccb670e38a18bdd4dd49ca595569df5e0d83a3da2c5853205de440c81724409f84017132df4bb06e1d5e3604b7853669169238bc0a60610eab31dd05
MD5 SHA1 SHA512

Submit Download

svchost.exe

Path C:\Users\Admin\AppData\Local\Temp\svchost.exe
Size 34KB
SHA256 3a0f2936b8c45e8ba3458d69d7859a63844469e698652e15fb56639d32f40cc9
MD5 e118330b4629b12368d91b9df6488be0
SHA1 ce90218c7e3b90df2a3409ec253048bb6472c2fd
SHA512 ac91c04cb20223dbaaf594440cb778dff36e857921be427c8528ba4c6cdb3e8bf8e71e1ae8af7bde9c04ff5b97b379231625bc1a2b66aba2f98cd340cd8a94b0
SSDEEP 768:Paq4bp49YK+2Cza0pS6icHmMl9CvwOElkn3yKdn5y85p3:ud4+KTMVJHmMsEBKdn5vj
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3488-12-0x0000000000400000-0x00000000004B5000-memory.dmp

Download

memory/3488-68-0x0000000000400000-0x00000000004B5000-memory.dmp

Download

memory/3488-80-0x0000000000400000-0x00000000004B5000-memory.dmp

Download

memory/3488-15-0x00000000025C0000-0x00000000025C1000-memory.dmp

Download

memory/3488-14-0x0000000000400000-0x00000000004B5000-memory.dmp

Download

memory/3488-13-0x0000000000400000-0x00000000004B5000-memory.dmp

Download

memory/3488-79-0x0000000000400000-0x00000000004B5000-memory.dmp

Download

memory/3488-9-0x0000000000400000-0x00000000004B5000-memory.dmp

Download

memory/3488-78-0x0000000000400000-0x00000000004B5000-memory.dmp

Download

memory/3488-5-0x0000000000400000-0x00000000004B5000-memory.dmp

Download

memory/3488-53-0x0000000000400000-0x00000000004B5000-memory.dmp

Download

memory/3488-77-0x0000000000400000-0x00000000004B5000-memory.dmp

Download

memory/3488-76-0x0000000000400000-0x00000000004B5000-memory.dmp

Download

memory/3488-10-0x0000000000400000-0x00000000004B5000-memory.dmp

Download

memory/3488-69-0x0000000000400000-0x00000000004B5000-memory.dmp

Download

memory/3488-70-0x0000000000400000-0x00000000004B5000-memory.dmp

Download

memory/3488-71-0x0000000000400000-0x00000000004B5000-memory.dmp

Download

memory/3488-72-0x0000000000400000-0x00000000004B5000-memory.dmp

Download

memory/3488-73-0x0000000000400000-0x00000000004B5000-memory.dmp

Download

memory/3488-74-0x0000000000400000-0x00000000004B5000-memory.dmp

Download

memory/3488-75-0x0000000000400000-0x00000000004B5000-memory.dmp

Download

memory/3592-1-0x0000000074D10000-0x00000000752C1000-memory.dmp

Download

memory/3592-2-0x0000000074D10000-0x00000000752C1000-memory.dmp

Download

memory/3592-24-0x0000000074D10000-0x00000000752C1000-memory.dmp

Download

memory/3592-21-0x0000000000CC0000-0x0000000000CD0000-memory.dmp

Download

memory/3592-0-0x0000000074D12000-0x0000000074D13000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads