darkcomet | 9eea21de124f6cca492e675bd88c96edbc0685d772221d8d0b88dbb1967072f3

Processes:

msdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exe1f68ac4cea5976b8c89dbb2a6a16bf75_JaffaCakes118.exemsdcsc.exemsdcsc.exemsdcsc.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\avRlhtZvzGeQ\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\avRlhtZvzGeQ\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\avRlhtZvzGeQ\\avRlhtZvzGeQ\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\avRlhtZvzGeQ\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\avRlhtZvzGeQ\\avRlhtZvzGeQ\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\avRlhtZvzGeQ\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\avRlhtZvzGeQ\\avRlhtZvzGeQ\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\avRlhtZvzGeQ\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\avRlhtZvzGeQ\\avRlhtZvzGeQ\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\avRlhtZvzGeQ\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\avRlhtZvzGeQ\\avRlhtZvzGeQ\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\avRlhtZvzGeQ\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\avRlhtZvzGeQ\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\avRlhtZvzGeQ\\avRlhtZvzGeQ\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\avRlhtZvzGeQ\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\avRlhtZvzGeQ\\avRlhtZvzGeQ\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\avRlhtZvzGeQ\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\avRlhtZvzGeQ\\avRlhtZvzGeQ\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\avRlhtZvzGeQ\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\avRlhtZvzGeQ\\avRlhtZvzGeQ\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\avRlhtZvzGeQ\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\avRlhtZvzGeQ\\avRlhtZvzGeQ\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\avRlhtZvzGeQ\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\avRlhtZvzGeQ\\avRlhtZvzGeQ\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\avRlhtZvzGeQ\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	1f68ac4cea5976b8c89dbb2a6a16bf75_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\avRlhtZvzGeQ\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\avRlhtZvzGeQ\\avRlhtZvzGeQ\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\avRlhtZvzGeQ\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\avRlhtZvzGeQ\\avRlhtZvzGeQ\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\avRlhtZvzGeQ\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\avRlhtZvzGeQ\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\avRlhtZvzGeQ\\avRlhtZvzGeQ\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\avRlhtZvzGeQ\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\avRlhtZvzGeQ\\avRlhtZvzGeQ\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe

Modifies security service 2 TTPs 1 IoCs
evasion

Modify Registry
T1112

Windows Service
T1543.003

Processes:

msdcsc.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" msdcsc.exe
Windows security bypass 2 TTPs 1 IoCs
evasion trojan

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

msdcsc.exe

description ioc process

Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" msdcsc.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	msdcsc.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	msdcsc.exe

Disables RegEdit via registry modification 1 IoCs

Processes:

msdcsc.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	msdcsc.exe

Disables Task Manager via registry modification
evasion

Sets file to hidden 1 TTPs 20 IoCs

Modifies file attributes to stop it showing in Explorer etc.

Hidden Files and Directories

T1564.001

Processes:

attrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exe

pid	process
4080	attrib.exe
1380	attrib.exe
3208	attrib.exe
1364	attrib.exe
4648	attrib.exe
1740	attrib.exe
2624	attrib.exe
1148	attrib.exe
1064	attrib.exe
4512	attrib.exe
2176	attrib.exe
1140	attrib.exe
2032	attrib.exe
4316	attrib.exe
5076	attrib.exe
1740	attrib.exe
3036	attrib.exe
3908	attrib.exe
4408	attrib.exe
5016	attrib.exe

Checks computer location settings 2 TTPs 10 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

msdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exe1f68ac4cea5976b8c89dbb2a6a16bf75_JaffaCakes118.exemsdcsc.exemsdcsc.exemsdcsc.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	msdcsc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	msdcsc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	msdcsc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	msdcsc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	msdcsc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	msdcsc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	1f68ac4cea5976b8c89dbb2a6a16bf75_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	msdcsc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	msdcsc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	msdcsc.exe

Deletes itself 1 IoCs

Processes:

notepad.exe

pid process

3144 notepad.exe

pid	process
3144	notepad.exe

Executes dropped EXE 18 IoCs

Processes:

msdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exe

pid	process
2276	msdcsc.exe
3964	msdcsc.exe
2084	msdcsc.exe
596	msdcsc.exe
4056	msdcsc.exe
2096	msdcsc.exe
4144	msdcsc.exe
4620	msdcsc.exe
4124	msdcsc.exe
748	msdcsc.exe
2264	msdcsc.exe
2308	msdcsc.exe
3512	msdcsc.exe
3940	msdcsc.exe
1768	msdcsc.exe
5056	msdcsc.exe
4180	msdcsc.exe
1464	msdcsc.exe

Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

msdcsc.exe

description ioc process

Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" msdcsc.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	msdcsc.exe

Adds Run key to start application 2 TTPs 10 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

Processes:

msdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exe1f68ac4cea5976b8c89dbb2a6a16bf75_JaffaCakes118.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\avRlhtZvzGeQ\\avRlhtZvzGeQ\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\avRlhtZvzGeQ\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\avRlhtZvzGeQ\\avRlhtZvzGeQ\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\avRlhtZvzGeQ\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	1f68ac4cea5976b8c89dbb2a6a16bf75_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\avRlhtZvzGeQ\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\avRlhtZvzGeQ\\avRlhtZvzGeQ\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\avRlhtZvzGeQ\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe

Drops file in System32 directory 62 IoCs

Processes:

msdcsc.exeattrib.exemsdcsc.exemsdcsc.exemsdcsc.exeattrib.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exeattrib.exeattrib.exemsdcsc.exemsdcsc.exemsdcsc.exe1f68ac4cea5976b8c89dbb2a6a16bf75_JaffaCakes118.exemsdcsc.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exemsdcsc.exeattrib.exemsdcsc.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exemsdcsc.exemsdcsc.exemsdcsc.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\MSDCSC\avRlhtZvzGeQ\avRlhtZvzGeQ\	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\avRlhtZvzGeQ\msdcsc.exe	attrib.exe
File created	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File created	C:\Windows\SysWOW64\MSDCSC\avRlhtZvzGeQ\avRlhtZvzGeQ\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\avRlhtZvzGeQ\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\avRlhtZvzGeQ\avRlhtZvzGeQ\msdcsc.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\avRlhtZvzGeQ\avRlhtZvzGeQ\msdcsc.exe	msdcsc.exe
File created	C:\Windows\SysWOW64\MSDCSC\avRlhtZvzGeQ\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File created	C:\Windows\SysWOW64\MSDCSC\avRlhtZvzGeQ\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\avRlhtZvzGeQ\avRlhtZvzGeQ\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\avRlhtZvzGeQ\msdcsc.exe	msdcsc.exe
File created	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File created	C:\Windows\SysWOW64\MSDCSC\avRlhtZvzGeQ\msdcsc.exe	msdcsc.exe
File created	C:\Windows\SysWOW64\MSDCSC\avRlhtZvzGeQ\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\avRlhtZvzGeQ\msdcsc.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\avRlhtZvzGeQ\avRlhtZvzGeQ	attrib.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\avRlhtZvzGeQ\avRlhtZvzGeQ\	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\avRlhtZvzGeQ\avRlhtZvzGeQ\msdcsc.exe	msdcsc.exe
File created	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	1f68ac4cea5976b8c89dbb2a6a16bf75_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\avRlhtZvzGeQ\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\avRlhtZvzGeQ\avRlhtZvzGeQ	attrib.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\avRlhtZvzGeQ\avRlhtZvzGeQ\msdcsc.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\avRlhtZvzGeQ\	msdcsc.exe
File created	C:\Windows\SysWOW64\MSDCSC\avRlhtZvzGeQ\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\avRlhtZvzGeQ	attrib.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\avRlhtZvzGeQ\msdcsc.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\avRlhtZvzGeQ\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\avRlhtZvzGeQ\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\avRlhtZvzGeQ	attrib.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\avRlhtZvzGeQ\avRlhtZvzGeQ\msdcsc.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\avRlhtZvzGeQ\	msdcsc.exe
File created	C:\Windows\SysWOW64\MSDCSC\avRlhtZvzGeQ\avRlhtZvzGeQ\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC	attrib.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC	attrib.exe
File created	C:\Windows\SysWOW64\MSDCSC\avRlhtZvzGeQ\avRlhtZvzGeQ\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\avRlhtZvzGeQ\avRlhtZvzGeQ	attrib.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC	attrib.exe
File created	C:\Windows\SysWOW64\MSDCSC\avRlhtZvzGeQ\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\avRlhtZvzGeQ\avRlhtZvzGeQ\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\avRlhtZvzGeQ	attrib.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\avRlhtZvzGeQ\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\avRlhtZvzGeQ\	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\avRlhtZvzGeQ\	msdcsc.exe
File created	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	1f68ac4cea5976b8c89dbb2a6a16bf75_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File created	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\avRlhtZvzGeQ\avRlhtZvzGeQ\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\avRlhtZvzGeQ\avRlhtZvzGeQ\	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\	1f68ac4cea5976b8c89dbb2a6a16bf75_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\avRlhtZvzGeQ\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\avRlhtZvzGeQ\avRlhtZvzGeQ\msdcsc.exe	msdcsc.exe
File created	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe

Suspicious use of SetThreadContext 10 IoCs

Processes:

1f68ac4cea5976b8c89dbb2a6a16bf75_JaffaCakes118.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exe

description	pid	process	target process
PID 764 set thread context of 700	764	1f68ac4cea5976b8c89dbb2a6a16bf75_JaffaCakes118.exe	1f68ac4cea5976b8c89dbb2a6a16bf75_JaffaCakes118.exe
PID 2276 set thread context of 3964	2276	msdcsc.exe	msdcsc.exe
PID 2084 set thread context of 596	2084	msdcsc.exe	msdcsc.exe
PID 4056 set thread context of 2096	4056	msdcsc.exe	msdcsc.exe
PID 4144 set thread context of 4620	4144	msdcsc.exe	msdcsc.exe
PID 4124 set thread context of 748	4124	msdcsc.exe	msdcsc.exe
PID 2264 set thread context of 2308	2264	msdcsc.exe	msdcsc.exe
PID 3512 set thread context of 3940	3512	msdcsc.exe	msdcsc.exe
PID 1768 set thread context of 5056	1768	msdcsc.exe	msdcsc.exe
PID 4180 set thread context of 1464	4180	msdcsc.exe	msdcsc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

Processes:

msdcsc.exemsdcsc.exemsdcsc.exe1f68ac4cea5976b8c89dbb2a6a16bf75_JaffaCakes118.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msdcsc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msdcsc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msdcsc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	1f68ac4cea5976b8c89dbb2a6a16bf75_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msdcsc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msdcsc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msdcsc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msdcsc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msdcsc.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

1f68ac4cea5976b8c89dbb2a6a16bf75_JaffaCakes118.exemsdcsc.exemsdcsc.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	700	1f68ac4cea5976b8c89dbb2a6a16bf75_JaffaCakes118.exe
Token: SeSecurityPrivilege	700	1f68ac4cea5976b8c89dbb2a6a16bf75_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	700	1f68ac4cea5976b8c89dbb2a6a16bf75_JaffaCakes118.exe
Token: SeLoadDriverPrivilege	700	1f68ac4cea5976b8c89dbb2a6a16bf75_JaffaCakes118.exe
Token: SeSystemProfilePrivilege	700	1f68ac4cea5976b8c89dbb2a6a16bf75_JaffaCakes118.exe
Token: SeSystemtimePrivilege	700	1f68ac4cea5976b8c89dbb2a6a16bf75_JaffaCakes118.exe
Token: SeProfSingleProcessPrivilege	700	1f68ac4cea5976b8c89dbb2a6a16bf75_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	700	1f68ac4cea5976b8c89dbb2a6a16bf75_JaffaCakes118.exe
Token: SeCreatePagefilePrivilege	700	1f68ac4cea5976b8c89dbb2a6a16bf75_JaffaCakes118.exe
Token: SeBackupPrivilege	700	1f68ac4cea5976b8c89dbb2a6a16bf75_JaffaCakes118.exe
Token: SeRestorePrivilege	700	1f68ac4cea5976b8c89dbb2a6a16bf75_JaffaCakes118.exe
Token: SeShutdownPrivilege	700	1f68ac4cea5976b8c89dbb2a6a16bf75_JaffaCakes118.exe
Token: SeDebugPrivilege	700	1f68ac4cea5976b8c89dbb2a6a16bf75_JaffaCakes118.exe
Token: SeSystemEnvironmentPrivilege	700	1f68ac4cea5976b8c89dbb2a6a16bf75_JaffaCakes118.exe
Token: SeChangeNotifyPrivilege	700	1f68ac4cea5976b8c89dbb2a6a16bf75_JaffaCakes118.exe
Token: SeRemoteShutdownPrivilege	700	1f68ac4cea5976b8c89dbb2a6a16bf75_JaffaCakes118.exe
Token: SeUndockPrivilege	700	1f68ac4cea5976b8c89dbb2a6a16bf75_JaffaCakes118.exe
Token: SeManageVolumePrivilege	700	1f68ac4cea5976b8c89dbb2a6a16bf75_JaffaCakes118.exe
Token: SeImpersonatePrivilege	700	1f68ac4cea5976b8c89dbb2a6a16bf75_JaffaCakes118.exe
Token: SeCreateGlobalPrivilege	700	1f68ac4cea5976b8c89dbb2a6a16bf75_JaffaCakes118.exe
Token: 33	700	1f68ac4cea5976b8c89dbb2a6a16bf75_JaffaCakes118.exe
Token: 34	700	1f68ac4cea5976b8c89dbb2a6a16bf75_JaffaCakes118.exe
Token: 35	700	1f68ac4cea5976b8c89dbb2a6a16bf75_JaffaCakes118.exe
Token: 36	700	1f68ac4cea5976b8c89dbb2a6a16bf75_JaffaCakes118.exe
Token: SeIncreaseQuotaPrivilege	3964	msdcsc.exe
Token: SeSecurityPrivilege	3964	msdcsc.exe
Token: SeTakeOwnershipPrivilege	3964	msdcsc.exe
Token: SeLoadDriverPrivilege	3964	msdcsc.exe
Token: SeSystemProfilePrivilege	3964	msdcsc.exe
Token: SeSystemtimePrivilege	3964	msdcsc.exe
Token: SeProfSingleProcessPrivilege	3964	msdcsc.exe
Token: SeIncBasePriorityPrivilege	3964	msdcsc.exe
Token: SeCreatePagefilePrivilege	3964	msdcsc.exe
Token: SeBackupPrivilege	3964	msdcsc.exe
Token: SeRestorePrivilege	3964	msdcsc.exe
Token: SeShutdownPrivilege	3964	msdcsc.exe
Token: SeDebugPrivilege	3964	msdcsc.exe
Token: SeSystemEnvironmentPrivilege	3964	msdcsc.exe
Token: SeChangeNotifyPrivilege	3964	msdcsc.exe
Token: SeRemoteShutdownPrivilege	3964	msdcsc.exe
Token: SeUndockPrivilege	3964	msdcsc.exe
Token: SeManageVolumePrivilege	3964	msdcsc.exe
Token: SeImpersonatePrivilege	3964	msdcsc.exe
Token: SeCreateGlobalPrivilege	3964	msdcsc.exe
Token: 33	3964	msdcsc.exe
Token: 34	3964	msdcsc.exe
Token: 35	3964	msdcsc.exe
Token: 36	3964	msdcsc.exe
Token: SeIncreaseQuotaPrivilege	596	msdcsc.exe
Token: SeSecurityPrivilege	596	msdcsc.exe
Token: SeTakeOwnershipPrivilege	596	msdcsc.exe
Token: SeLoadDriverPrivilege	596	msdcsc.exe
Token: SeSystemProfilePrivilege	596	msdcsc.exe
Token: SeSystemtimePrivilege	596	msdcsc.exe
Token: SeProfSingleProcessPrivilege	596	msdcsc.exe
Token: SeIncBasePriorityPrivilege	596	msdcsc.exe
Token: SeCreatePagefilePrivilege	596	msdcsc.exe
Token: SeBackupPrivilege	596	msdcsc.exe
Token: SeRestorePrivilege	596	msdcsc.exe
Token: SeShutdownPrivilege	596	msdcsc.exe
Token: SeDebugPrivilege	596	msdcsc.exe
Token: SeSystemEnvironmentPrivilege	596	msdcsc.exe
Token: SeChangeNotifyPrivilege	596	msdcsc.exe
Token: SeRemoteShutdownPrivilege	596	msdcsc.exe

Suspicious use of SetWindowsHookEx 11 IoCs

Processes:

1f68ac4cea5976b8c89dbb2a6a16bf75_JaffaCakes118.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exe

pid	process
764	1f68ac4cea5976b8c89dbb2a6a16bf75_JaffaCakes118.exe
2276	msdcsc.exe
2084	msdcsc.exe
4056	msdcsc.exe
4144	msdcsc.exe
4124	msdcsc.exe
2264	msdcsc.exe
3512	msdcsc.exe
1768	msdcsc.exe
4180	msdcsc.exe
1464	msdcsc.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

1f68ac4cea5976b8c89dbb2a6a16bf75_JaffaCakes118.exe1f68ac4cea5976b8c89dbb2a6a16bf75_JaffaCakes118.execmd.execmd.exemsdcsc.exemsdcsc.exe

description	pid	process	target process
PID 764 wrote to memory of 700	764	1f68ac4cea5976b8c89dbb2a6a16bf75_JaffaCakes118.exe	1f68ac4cea5976b8c89dbb2a6a16bf75_JaffaCakes118.exe
PID 764 wrote to memory of 700	764	1f68ac4cea5976b8c89dbb2a6a16bf75_JaffaCakes118.exe	1f68ac4cea5976b8c89dbb2a6a16bf75_JaffaCakes118.exe
PID 764 wrote to memory of 700	764	1f68ac4cea5976b8c89dbb2a6a16bf75_JaffaCakes118.exe	1f68ac4cea5976b8c89dbb2a6a16bf75_JaffaCakes118.exe
PID 764 wrote to memory of 700	764	1f68ac4cea5976b8c89dbb2a6a16bf75_JaffaCakes118.exe	1f68ac4cea5976b8c89dbb2a6a16bf75_JaffaCakes118.exe
PID 764 wrote to memory of 700	764	1f68ac4cea5976b8c89dbb2a6a16bf75_JaffaCakes118.exe	1f68ac4cea5976b8c89dbb2a6a16bf75_JaffaCakes118.exe
PID 764 wrote to memory of 700	764	1f68ac4cea5976b8c89dbb2a6a16bf75_JaffaCakes118.exe	1f68ac4cea5976b8c89dbb2a6a16bf75_JaffaCakes118.exe
PID 764 wrote to memory of 700	764	1f68ac4cea5976b8c89dbb2a6a16bf75_JaffaCakes118.exe	1f68ac4cea5976b8c89dbb2a6a16bf75_JaffaCakes118.exe
PID 764 wrote to memory of 700	764	1f68ac4cea5976b8c89dbb2a6a16bf75_JaffaCakes118.exe	1f68ac4cea5976b8c89dbb2a6a16bf75_JaffaCakes118.exe
PID 764 wrote to memory of 700	764	1f68ac4cea5976b8c89dbb2a6a16bf75_JaffaCakes118.exe	1f68ac4cea5976b8c89dbb2a6a16bf75_JaffaCakes118.exe
PID 764 wrote to memory of 700	764	1f68ac4cea5976b8c89dbb2a6a16bf75_JaffaCakes118.exe	1f68ac4cea5976b8c89dbb2a6a16bf75_JaffaCakes118.exe
PID 764 wrote to memory of 700	764	1f68ac4cea5976b8c89dbb2a6a16bf75_JaffaCakes118.exe	1f68ac4cea5976b8c89dbb2a6a16bf75_JaffaCakes118.exe
PID 764 wrote to memory of 700	764	1f68ac4cea5976b8c89dbb2a6a16bf75_JaffaCakes118.exe	1f68ac4cea5976b8c89dbb2a6a16bf75_JaffaCakes118.exe
PID 764 wrote to memory of 700	764	1f68ac4cea5976b8c89dbb2a6a16bf75_JaffaCakes118.exe	1f68ac4cea5976b8c89dbb2a6a16bf75_JaffaCakes118.exe
PID 764 wrote to memory of 700	764	1f68ac4cea5976b8c89dbb2a6a16bf75_JaffaCakes118.exe	1f68ac4cea5976b8c89dbb2a6a16bf75_JaffaCakes118.exe
PID 700 wrote to memory of 5024	700	1f68ac4cea5976b8c89dbb2a6a16bf75_JaffaCakes118.exe	cmd.exe
PID 700 wrote to memory of 5024	700	1f68ac4cea5976b8c89dbb2a6a16bf75_JaffaCakes118.exe	cmd.exe
PID 700 wrote to memory of 5024	700	1f68ac4cea5976b8c89dbb2a6a16bf75_JaffaCakes118.exe	cmd.exe
PID 700 wrote to memory of 2444	700	1f68ac4cea5976b8c89dbb2a6a16bf75_JaffaCakes118.exe	cmd.exe
PID 700 wrote to memory of 2444	700	1f68ac4cea5976b8c89dbb2a6a16bf75_JaffaCakes118.exe	cmd.exe
PID 700 wrote to memory of 2444	700	1f68ac4cea5976b8c89dbb2a6a16bf75_JaffaCakes118.exe	cmd.exe
PID 700 wrote to memory of 3144	700	1f68ac4cea5976b8c89dbb2a6a16bf75_JaffaCakes118.exe	notepad.exe
PID 700 wrote to memory of 3144	700	1f68ac4cea5976b8c89dbb2a6a16bf75_JaffaCakes118.exe	notepad.exe
PID 700 wrote to memory of 3144	700	1f68ac4cea5976b8c89dbb2a6a16bf75_JaffaCakes118.exe	notepad.exe
PID 700 wrote to memory of 3144	700	1f68ac4cea5976b8c89dbb2a6a16bf75_JaffaCakes118.exe	notepad.exe
PID 700 wrote to memory of 3144	700	1f68ac4cea5976b8c89dbb2a6a16bf75_JaffaCakes118.exe	notepad.exe
PID 700 wrote to memory of 3144	700	1f68ac4cea5976b8c89dbb2a6a16bf75_JaffaCakes118.exe	notepad.exe
PID 700 wrote to memory of 3144	700	1f68ac4cea5976b8c89dbb2a6a16bf75_JaffaCakes118.exe	notepad.exe
PID 700 wrote to memory of 3144	700	1f68ac4cea5976b8c89dbb2a6a16bf75_JaffaCakes118.exe	notepad.exe
PID 700 wrote to memory of 3144	700	1f68ac4cea5976b8c89dbb2a6a16bf75_JaffaCakes118.exe	notepad.exe
PID 700 wrote to memory of 3144	700	1f68ac4cea5976b8c89dbb2a6a16bf75_JaffaCakes118.exe	notepad.exe
PID 700 wrote to memory of 3144	700	1f68ac4cea5976b8c89dbb2a6a16bf75_JaffaCakes118.exe	notepad.exe
PID 700 wrote to memory of 3144	700	1f68ac4cea5976b8c89dbb2a6a16bf75_JaffaCakes118.exe	notepad.exe
PID 700 wrote to memory of 3144	700	1f68ac4cea5976b8c89dbb2a6a16bf75_JaffaCakes118.exe	notepad.exe
PID 700 wrote to memory of 3144	700	1f68ac4cea5976b8c89dbb2a6a16bf75_JaffaCakes118.exe	notepad.exe
PID 700 wrote to memory of 3144	700	1f68ac4cea5976b8c89dbb2a6a16bf75_JaffaCakes118.exe	notepad.exe
PID 700 wrote to memory of 3144	700	1f68ac4cea5976b8c89dbb2a6a16bf75_JaffaCakes118.exe	notepad.exe
PID 700 wrote to memory of 3144	700	1f68ac4cea5976b8c89dbb2a6a16bf75_JaffaCakes118.exe	notepad.exe
PID 5024 wrote to memory of 5076	5024	cmd.exe	attrib.exe
PID 5024 wrote to memory of 5076	5024	cmd.exe	attrib.exe
PID 5024 wrote to memory of 5076	5024	cmd.exe	attrib.exe
PID 2444 wrote to memory of 1148	2444	cmd.exe	attrib.exe
PID 2444 wrote to memory of 1148	2444	cmd.exe	attrib.exe
PID 2444 wrote to memory of 1148	2444	cmd.exe	attrib.exe
PID 700 wrote to memory of 2276	700	1f68ac4cea5976b8c89dbb2a6a16bf75_JaffaCakes118.exe	msdcsc.exe
PID 700 wrote to memory of 2276	700	1f68ac4cea5976b8c89dbb2a6a16bf75_JaffaCakes118.exe	msdcsc.exe
PID 700 wrote to memory of 2276	700	1f68ac4cea5976b8c89dbb2a6a16bf75_JaffaCakes118.exe	msdcsc.exe
PID 2276 wrote to memory of 3964	2276	msdcsc.exe	msdcsc.exe
PID 2276 wrote to memory of 3964	2276	msdcsc.exe	msdcsc.exe
PID 2276 wrote to memory of 3964	2276	msdcsc.exe	msdcsc.exe
PID 2276 wrote to memory of 3964	2276	msdcsc.exe	msdcsc.exe
PID 2276 wrote to memory of 3964	2276	msdcsc.exe	msdcsc.exe
PID 2276 wrote to memory of 3964	2276	msdcsc.exe	msdcsc.exe
PID 2276 wrote to memory of 3964	2276	msdcsc.exe	msdcsc.exe
PID 2276 wrote to memory of 3964	2276	msdcsc.exe	msdcsc.exe
PID 2276 wrote to memory of 3964	2276	msdcsc.exe	msdcsc.exe
PID 2276 wrote to memory of 3964	2276	msdcsc.exe	msdcsc.exe
PID 2276 wrote to memory of 3964	2276	msdcsc.exe	msdcsc.exe
PID 2276 wrote to memory of 3964	2276	msdcsc.exe	msdcsc.exe
PID 2276 wrote to memory of 3964	2276	msdcsc.exe	msdcsc.exe
PID 2276 wrote to memory of 3964	2276	msdcsc.exe	msdcsc.exe
PID 3964 wrote to memory of 1088	3964	msdcsc.exe	cmd.exe
PID 3964 wrote to memory of 1088	3964	msdcsc.exe	cmd.exe
PID 3964 wrote to memory of 1088	3964	msdcsc.exe	cmd.exe
PID 3964 wrote to memory of 4912	3964	msdcsc.exe	cmd.exe

System policy modification 1 TTPs 3 IoCs

Modify Registry

Processes:

msdcsc.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern\NoControlPanel = "1"	msdcsc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion	msdcsc.exe

Views/modifies file attributes 1 TTPs 20 IoCs

Hidden Files and Directories

T1564.001

Processes:

attrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exe

pid	process
1740	attrib.exe
2032	attrib.exe
3908	attrib.exe
4316	attrib.exe
4080	attrib.exe
1380	attrib.exe
3036	attrib.exe
4512	attrib.exe
2176	attrib.exe
1140	attrib.exe
1364	attrib.exe
4648	attrib.exe
1064	attrib.exe
1740	attrib.exe
3208	attrib.exe
2624	attrib.exe
4408	attrib.exe
5016	attrib.exe
5076	attrib.exe
1148	attrib.exe

C:\Users\Admin\AppData\Local\Temp\1f68ac4cea5976b8c89dbb2a6a16bf75_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1f68ac4cea5976b8c89dbb2a6a16bf75_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:764

C:\Users\Admin\AppData\Local\Temp\1f68ac4cea5976b8c89dbb2a6a16bf75_JaffaCakes118.exe
C:\Users\Admin\AppData\Local\Temp\1f68ac4cea5976b8c89dbb2a6a16bf75_JaffaCakes118.exe
2⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:700

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\1f68ac4cea5976b8c89dbb2a6a16bf75_JaffaCakes118.exe" +s +h
3⤵
- Suspicious use of WriteProcessMemory
PID:5024

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Users\Admin\AppData\Local\Temp\1f68ac4cea5976b8c89dbb2a6a16bf75_JaffaCakes118.exe" +s +h
4⤵
- Sets file to hidden
- Views/modifies file attributes
PID:5076

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
3⤵
- Suspicious use of WriteProcessMemory
PID:2444

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
4⤵
- Sets file to hidden
- Views/modifies file attributes
PID:1148

C:\Windows\SysWOW64\notepad.exe
notepad
3⤵
- Deletes itself
PID:3144

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2276

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
4⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3964

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h
5⤵
PID:1088

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h
6⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:1364

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
5⤵
PID:4912

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
6⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:4080

C:\Windows\SysWOW64\notepad.exe
notepad
5⤵
PID:2024

C:\Windows\SysWOW64\MSDCSC\avRlhtZvzGeQ\msdcsc.exe
"C:\Windows\system32\MSDCSC\avRlhtZvzGeQ\msdcsc.exe"
5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2084

C:\Windows\SysWOW64\MSDCSC\avRlhtZvzGeQ\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\avRlhtZvzGeQ\msdcsc.exe
6⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:596

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\avRlhtZvzGeQ\msdcsc.exe" +s +h
7⤵
PID:4996

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\MSDCSC\avRlhtZvzGeQ\msdcsc.exe" +s +h
8⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:1064

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\avRlhtZvzGeQ" +s +h
7⤵
PID:4656

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\MSDCSC\avRlhtZvzGeQ" +s +h
8⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:4648

C:\Windows\SysWOW64\notepad.exe
notepad
7⤵
PID:2168

C:\Windows\SysWOW64\MSDCSC\avRlhtZvzGeQ\avRlhtZvzGeQ\msdcsc.exe
"C:\Windows\system32\MSDCSC\avRlhtZvzGeQ\avRlhtZvzGeQ\msdcsc.exe"
7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:4056

C:\Windows\SysWOW64\MSDCSC\avRlhtZvzGeQ\avRlhtZvzGeQ\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\avRlhtZvzGeQ\avRlhtZvzGeQ\msdcsc.exe
8⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
PID:2096

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\avRlhtZvzGeQ\avRlhtZvzGeQ\msdcsc.exe" +s +h
9⤵
PID:1284

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\MSDCSC\avRlhtZvzGeQ\avRlhtZvzGeQ\msdcsc.exe" +s +h
10⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:4512

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\avRlhtZvzGeQ\avRlhtZvzGeQ" +s +h
9⤵
PID:5060

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\MSDCSC\avRlhtZvzGeQ\avRlhtZvzGeQ" +s +h
10⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:1740

C:\Windows\SysWOW64\notepad.exe
notepad
9⤵
PID:4692

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:4144

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
10⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
PID:4620

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h
11⤵
PID:3040

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h
12⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:2176

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
11⤵
PID:4884

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
12⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:1380

C:\Windows\SysWOW64\notepad.exe
notepad
11⤵
PID:1080

C:\Windows\SysWOW64\MSDCSC\avRlhtZvzGeQ\msdcsc.exe
"C:\Windows\system32\MSDCSC\avRlhtZvzGeQ\msdcsc.exe"
11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:4124

C:\Windows\SysWOW64\MSDCSC\avRlhtZvzGeQ\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\avRlhtZvzGeQ\msdcsc.exe
12⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
PID:748

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\avRlhtZvzGeQ\msdcsc.exe" +s +h
13⤵
PID:3416

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\MSDCSC\avRlhtZvzGeQ\msdcsc.exe" +s +h
14⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:3208

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\avRlhtZvzGeQ" +s +h
13⤵
PID:2856

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\MSDCSC\avRlhtZvzGeQ" +s +h
14⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:1140

C:\Windows\SysWOW64\notepad.exe
notepad
13⤵
PID:428

C:\Windows\SysWOW64\MSDCSC\avRlhtZvzGeQ\avRlhtZvzGeQ\msdcsc.exe
"C:\Windows\system32\MSDCSC\avRlhtZvzGeQ\avRlhtZvzGeQ\msdcsc.exe"
13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2264

C:\Windows\SysWOW64\MSDCSC\avRlhtZvzGeQ\avRlhtZvzGeQ\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\avRlhtZvzGeQ\avRlhtZvzGeQ\msdcsc.exe
14⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
PID:2308

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\avRlhtZvzGeQ\avRlhtZvzGeQ\msdcsc.exe" +s +h
15⤵
PID:3620

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\MSDCSC\avRlhtZvzGeQ\avRlhtZvzGeQ\msdcsc.exe" +s +h
16⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:1740

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\avRlhtZvzGeQ\avRlhtZvzGeQ" +s +h
15⤵
PID:4056

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\MSDCSC\avRlhtZvzGeQ\avRlhtZvzGeQ" +s +h
16⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:3036

C:\Windows\SysWOW64\notepad.exe
notepad
15⤵
PID:1984

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
15⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:3512

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
16⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
PID:3940

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h
17⤵
PID:4844

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
18⤵
PID:4692

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h
18⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:2032

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
17⤵
PID:4364

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
18⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:3908

C:\Windows\SysWOW64\notepad.exe
notepad
17⤵
PID:4540

C:\Windows\SysWOW64\MSDCSC\avRlhtZvzGeQ\msdcsc.exe
"C:\Windows\system32\MSDCSC\avRlhtZvzGeQ\msdcsc.exe"
17⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1768

C:\Windows\SysWOW64\MSDCSC\avRlhtZvzGeQ\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\avRlhtZvzGeQ\msdcsc.exe
18⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
PID:5056

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\avRlhtZvzGeQ\msdcsc.exe" +s +h
19⤵
PID:4696

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\MSDCSC\avRlhtZvzGeQ\msdcsc.exe" +s +h
20⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:2624

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\avRlhtZvzGeQ" +s +h
19⤵
PID:2968

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\MSDCSC\avRlhtZvzGeQ" +s +h
20⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:4408

C:\Windows\SysWOW64\notepad.exe
notepad
19⤵
PID:4172

C:\Windows\SysWOW64\MSDCSC\avRlhtZvzGeQ\avRlhtZvzGeQ\msdcsc.exe
"C:\Windows\system32\MSDCSC\avRlhtZvzGeQ\avRlhtZvzGeQ\msdcsc.exe"
19⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:4180

C:\Windows\SysWOW64\MSDCSC\avRlhtZvzGeQ\avRlhtZvzGeQ\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\avRlhtZvzGeQ\avRlhtZvzGeQ\msdcsc.exe
20⤵
- Modifies WinLogon for persistence
- Modifies security service
- Windows security bypass
- Disables RegEdit via registry modification
- Checks computer location settings
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1464

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\avRlhtZvzGeQ\avRlhtZvzGeQ\msdcsc.exe" +s +h
21⤵
PID:4388

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\MSDCSC\avRlhtZvzGeQ\avRlhtZvzGeQ\msdcsc.exe" +s +h
22⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:4316

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\avRlhtZvzGeQ\avRlhtZvzGeQ" +s +h
21⤵
PID:4360

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\MSDCSC\avRlhtZvzGeQ\avRlhtZvzGeQ" +s +h
22⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:5016

C:\Windows\SysWOW64\notepad.exe
notepad
21⤵
PID:5092

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

6

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Query Registry

T1012

System Information Discovery