darkcomet | 718208741ba5d91b828e357adeb9622f9710c0d422f14846fce044c43adbfbf3

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\u84K4144AzcZ\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\u84K4144AzcZ\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\u84K4144AzcZ\\u84K4144AzcZ\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\u84K4144AzcZ\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\u84K4144AzcZ\\u84K4144AzcZ\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\u84K4144AzcZ\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\u84K4144AzcZ\\u84K4144AzcZ\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\u84K4144AzcZ\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\u84K4144AzcZ\\u84K4144AzcZ\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\u84K4144AzcZ\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\u84K4144AzcZ\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\u84K4144AzcZ\\u84K4144AzcZ\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\u84K4144AzcZ\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\u84K4144AzcZ\\u84K4144AzcZ\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\u84K4144AzcZ\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\u84K4144AzcZ\\u84K4144AzcZ\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\u84K4144AzcZ\\u84K4144AzcZ\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\u84K4144AzcZ\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	4819ac7420498073e2f939de3bdcf120_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\u84K4144AzcZ\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\u84K4144AzcZ\\u84K4144AzcZ\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\u84K4144AzcZ\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\u84K4144AzcZ\\u84K4144AzcZ\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\u84K4144AzcZ\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\u84K4144AzcZ\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\u84K4144AzcZ\\u84K4144AzcZ\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\u84K4144AzcZ\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\u84K4144AzcZ\\u84K4144AzcZ\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\u84K4144AzcZ\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\u84K4144AzcZ\\u84K4144AzcZ\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\u84K4144AzcZ\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\u84K4144AzcZ\\u84K4144AzcZ\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\u84K4144AzcZ\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\u84K4144AzcZ\\u84K4144AzcZ\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\u84K4144AzcZ\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\u84K4144AzcZ\\u84K4144AzcZ\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\u84K4144AzcZ\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\u84K4144AzcZ\\u84K4144AzcZ\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\u84K4144AzcZ\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\u84K4144AzcZ\\u84K4144AzcZ\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\u84K4144AzcZ\\u84K4144AzcZ\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\u84K4144AzcZ\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\u84K4144AzcZ\\u84K4144AzcZ\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\u84K4144AzcZ\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\u84K4144AzcZ\\u84K4144AzcZ\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\u84K4144AzcZ\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\u84K4144AzcZ\\u84K4144AzcZ\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\u84K4144AzcZ\\u84K4144AzcZ\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\u84K4144AzcZ\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\u84K4144AzcZ\\u84K4144AzcZ\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\u84K4144AzcZ\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\u84K4144AzcZ\\u84K4144AzcZ\\msdcsc.exe"	msdcsc.exe

Modifies firewall policy service 3 TTPs 3 IoCs

Modify Registry

Windows Service

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	msdcsc.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	msdcsc.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0"	msdcsc.exe

Modifies security service 2 TTPs 1 IoCs

Modify Registry

Windows Service

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	msdcsc.exe

Windows security bypass 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	msdcsc.exe

Sets file to hidden 1 TTPs 24 IoCs

Modifies file attributes to stop it showing in Explorer etc.

Hidden Files and Directories

T1564.001

pid	Process
4676	attrib.exe
4936	attrib.exe
2864	attrib.exe
1908	attrib.exe
3432	attrib.exe
4912	attrib.exe
3624	attrib.exe
660	attrib.exe
4440	attrib.exe
64	attrib.exe
4304	attrib.exe
3468	attrib.exe
3312	attrib.exe
3468	attrib.exe
1648	attrib.exe
1288	attrib.exe
3608	attrib.exe
2484	attrib.exe
1500	attrib.exe
5104	attrib.exe
3392	attrib.exe
2664	attrib.exe
2784	attrib.exe
872	attrib.exe

Checks computer location settings 2 TTPs 12 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation	4819ac7420498073e2f939de3bdcf120_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation	msdcsc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation	msdcsc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation	msdcsc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation	msdcsc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation	msdcsc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation	msdcsc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation	msdcsc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation	msdcsc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation	msdcsc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation	msdcsc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation	msdcsc.exe

Deletes itself 1 IoCs

pid	Process
4924	notepad.exe

Executes dropped EXE 11 IoCs

pid	Process
3976	msdcsc.exe
4116	msdcsc.exe
2788	msdcsc.exe
2584	msdcsc.exe
4380	msdcsc.exe
3912	msdcsc.exe
1076	msdcsc.exe
3472	msdcsc.exe
1832	msdcsc.exe
5116	msdcsc.exe
920	msdcsc.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	msdcsc.exe

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\u84K4144AzcZ\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\u84K4144AzcZ\\u84K4144AzcZ\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\u84K4144AzcZ\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\u84K4144AzcZ\\u84K4144AzcZ\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\u84K4144AzcZ\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\u84K4144AzcZ\\u84K4144AzcZ\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	4819ac7420498073e2f939de3bdcf120_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\u84K4144AzcZ\\u84K4144AzcZ\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\u84K4144AzcZ\\u84K4144AzcZ\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\u84K4144AzcZ\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\MSDCSC\	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\u84K4144AzcZ\msdcsc.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\u84K4144AzcZ\u84K4144AzcZ\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\u84K4144AzcZ\u84K4144AzcZ\	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\u84K4144AzcZ\u84K4144AzcZ\msdcsc.exe	attrib.exe
File created	C:\Windows\SysWOW64\MSDCSC\u84K4144AzcZ\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\u84K4144AzcZ\u84K4144AzcZ	attrib.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\u84K4144AzcZ	attrib.exe
File created	C:\Windows\SysWOW64\MSDCSC\u84K4144AzcZ\u84K4144AzcZ\msdcsc.exe	msdcsc.exe
File created	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File created	C:\Windows\SysWOW64\MSDCSC\u84K4144AzcZ\msdcsc.exe	msdcsc.exe
File created	C:\Windows\SysWOW64\MSDCSC\u84K4144AzcZ\u84K4144AzcZ\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\u84K4144AzcZ	attrib.exe
File created	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File created	C:\Windows\SysWOW64\MSDCSC\u84K4144AzcZ\u84K4144AzcZ\msdcsc.exe	msdcsc.exe
File created	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	attrib.exe
File created	C:\Windows\SysWOW64\MSDCSC\u84K4144AzcZ\u84K4144AzcZ\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\u84K4144AzcZ	attrib.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\u84K4144AzcZ\u84K4144AzcZ\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\u84K4144AzcZ\u84K4144AzcZ\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	attrib.exe
File created	C:\Windows\SysWOW64\MSDCSC\u84K4144AzcZ\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\u84K4144AzcZ\	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC	attrib.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\u84K4144AzcZ\msdcsc.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\u84K4144AzcZ\u84K4144AzcZ\msdcsc.exe	attrib.exe
File created	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\u84K4144AzcZ\u84K4144AzcZ\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\u84K4144AzcZ\u84K4144AzcZ	attrib.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\u84K4144AzcZ\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC	attrib.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\u84K4144AzcZ\u84K4144AzcZ\	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\u84K4144AzcZ\u84K4144AzcZ	attrib.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\u84K4144AzcZ\u84K4144AzcZ	attrib.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\u84K4144AzcZ\	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\u84K4144AzcZ\u84K4144AzcZ\	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\u84K4144AzcZ\msdcsc.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	4819ac7420498073e2f939de3bdcf120_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\u84K4144AzcZ	attrib.exe
File created	C:\Windows\SysWOW64\MSDCSC\u84K4144AzcZ\u84K4144AzcZ\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\u84K4144AzcZ\msdcsc.exe	msdcsc.exe
File created	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\u84K4144AzcZ\u84K4144AzcZ\msdcsc.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\u84K4144AzcZ\u84K4144AzcZ\	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\u84K4144AzcZ\	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\u84K4144AzcZ\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC	attrib.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\u84K4144AzcZ\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\u84K4144AzcZ\u84K4144AzcZ\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\u84K4144AzcZ\u84K4144AzcZ\	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\u84K4144AzcZ\msdcsc.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File created	C:\Windows\SysWOW64\MSDCSC\u84K4144AzcZ\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\	4819ac7420498073e2f939de3bdcf120_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\MSDCSC\u84K4144AzcZ\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\u84K4144AzcZ\	msdcsc.exe
File created	C:\Windows\SysWOW64\MSDCSC\u84K4144AzcZ\msdcsc.exe	msdcsc.exe
File created	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	4819ac7420498073e2f939de3bdcf120_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\u84K4144AzcZ\u84K4144AzcZ\msdcsc.exe	attrib.exe
File created	C:\Windows\SysWOW64\MSDCSC\u84K4144AzcZ\msdcsc.exe	msdcsc.exe
File created	C:\Windows\SysWOW64\MSDCSC\u84K4144AzcZ\msdcsc.exe	msdcsc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 3 IoCs

pid	pid_target	Process	procid_target
3944	1408	WerFault.exe	123
3868	4060	WerFault.exe	159
1632	3528	WerFault.exe	185

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msdcsc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msdcsc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msdcsc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msdcsc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msdcsc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msdcsc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msdcsc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msdcsc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msdcsc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	4819ac7420498073e2f939de3bdcf120_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msdcsc.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
920	msdcsc.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	1828	4819ac7420498073e2f939de3bdcf120_JaffaCakes118.exe
Token: SeSecurityPrivilege	1828	4819ac7420498073e2f939de3bdcf120_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	1828	4819ac7420498073e2f939de3bdcf120_JaffaCakes118.exe
Token: SeLoadDriverPrivilege	1828	4819ac7420498073e2f939de3bdcf120_JaffaCakes118.exe
Token: SeSystemProfilePrivilege	1828	4819ac7420498073e2f939de3bdcf120_JaffaCakes118.exe
Token: SeSystemtimePrivilege	1828	4819ac7420498073e2f939de3bdcf120_JaffaCakes118.exe
Token: SeProfSingleProcessPrivilege	1828	4819ac7420498073e2f939de3bdcf120_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	1828	4819ac7420498073e2f939de3bdcf120_JaffaCakes118.exe
Token: SeCreatePagefilePrivilege	1828	4819ac7420498073e2f939de3bdcf120_JaffaCakes118.exe
Token: SeBackupPrivilege	1828	4819ac7420498073e2f939de3bdcf120_JaffaCakes118.exe
Token: SeRestorePrivilege	1828	4819ac7420498073e2f939de3bdcf120_JaffaCakes118.exe
Token: SeShutdownPrivilege	1828	4819ac7420498073e2f939de3bdcf120_JaffaCakes118.exe
Token: SeDebugPrivilege	1828	4819ac7420498073e2f939de3bdcf120_JaffaCakes118.exe
Token: SeSystemEnvironmentPrivilege	1828	4819ac7420498073e2f939de3bdcf120_JaffaCakes118.exe
Token: SeChangeNotifyPrivilege	1828	4819ac7420498073e2f939de3bdcf120_JaffaCakes118.exe
Token: SeRemoteShutdownPrivilege	1828	4819ac7420498073e2f939de3bdcf120_JaffaCakes118.exe
Token: SeUndockPrivilege	1828	4819ac7420498073e2f939de3bdcf120_JaffaCakes118.exe
Token: SeManageVolumePrivilege	1828	4819ac7420498073e2f939de3bdcf120_JaffaCakes118.exe
Token: SeImpersonatePrivilege	1828	4819ac7420498073e2f939de3bdcf120_JaffaCakes118.exe
Token: SeCreateGlobalPrivilege	1828	4819ac7420498073e2f939de3bdcf120_JaffaCakes118.exe
Token: 33	1828	4819ac7420498073e2f939de3bdcf120_JaffaCakes118.exe
Token: 34	1828	4819ac7420498073e2f939de3bdcf120_JaffaCakes118.exe
Token: 35	1828	4819ac7420498073e2f939de3bdcf120_JaffaCakes118.exe
Token: 36	1828	4819ac7420498073e2f939de3bdcf120_JaffaCakes118.exe
Token: SeIncreaseQuotaPrivilege	3976	msdcsc.exe
Token: SeSecurityPrivilege	3976	msdcsc.exe
Token: SeTakeOwnershipPrivilege	3976	msdcsc.exe
Token: SeLoadDriverPrivilege	3976	msdcsc.exe
Token: SeSystemProfilePrivilege	3976	msdcsc.exe
Token: SeSystemtimePrivilege	3976	msdcsc.exe
Token: SeProfSingleProcessPrivilege	3976	msdcsc.exe
Token: SeIncBasePriorityPrivilege	3976	msdcsc.exe
Token: SeCreatePagefilePrivilege	3976	msdcsc.exe
Token: SeBackupPrivilege	3976	msdcsc.exe
Token: SeRestorePrivilege	3976	msdcsc.exe
Token: SeShutdownPrivilege	3976	msdcsc.exe
Token: SeDebugPrivilege	3976	msdcsc.exe
Token: SeSystemEnvironmentPrivilege	3976	msdcsc.exe
Token: SeChangeNotifyPrivilege	3976	msdcsc.exe
Token: SeRemoteShutdownPrivilege	3976	msdcsc.exe
Token: SeUndockPrivilege	3976	msdcsc.exe
Token: SeManageVolumePrivilege	3976	msdcsc.exe
Token: SeImpersonatePrivilege	3976	msdcsc.exe
Token: SeCreateGlobalPrivilege	3976	msdcsc.exe
Token: 33	3976	msdcsc.exe
Token: 34	3976	msdcsc.exe
Token: 35	3976	msdcsc.exe
Token: 36	3976	msdcsc.exe
Token: SeIncreaseQuotaPrivilege	4116	msdcsc.exe
Token: SeSecurityPrivilege	4116	msdcsc.exe
Token: SeTakeOwnershipPrivilege	4116	msdcsc.exe
Token: SeLoadDriverPrivilege	4116	msdcsc.exe
Token: SeSystemProfilePrivilege	4116	msdcsc.exe
Token: SeSystemtimePrivilege	4116	msdcsc.exe
Token: SeProfSingleProcessPrivilege	4116	msdcsc.exe
Token: SeIncBasePriorityPrivilege	4116	msdcsc.exe
Token: SeCreatePagefilePrivilege	4116	msdcsc.exe
Token: SeBackupPrivilege	4116	msdcsc.exe
Token: SeRestorePrivilege	4116	msdcsc.exe
Token: SeShutdownPrivilege	4116	msdcsc.exe
Token: SeDebugPrivilege	4116	msdcsc.exe
Token: SeSystemEnvironmentPrivilege	4116	msdcsc.exe
Token: SeChangeNotifyPrivilege	4116	msdcsc.exe
Token: SeRemoteShutdownPrivilege	4116	msdcsc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
920	msdcsc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1828 wrote to memory of 2176	1828	4819ac7420498073e2f939de3bdcf120_JaffaCakes118.exe	86
PID 1828 wrote to memory of 2176	1828	4819ac7420498073e2f939de3bdcf120_JaffaCakes118.exe	86
PID 1828 wrote to memory of 2176	1828	4819ac7420498073e2f939de3bdcf120_JaffaCakes118.exe	86
PID 1828 wrote to memory of 2616	1828	4819ac7420498073e2f939de3bdcf120_JaffaCakes118.exe	88
PID 1828 wrote to memory of 2616	1828	4819ac7420498073e2f939de3bdcf120_JaffaCakes118.exe	88
PID 1828 wrote to memory of 2616	1828	4819ac7420498073e2f939de3bdcf120_JaffaCakes118.exe	88
PID 1828 wrote to memory of 4924	1828	4819ac7420498073e2f939de3bdcf120_JaffaCakes118.exe	89
PID 1828 wrote to memory of 4924	1828	4819ac7420498073e2f939de3bdcf120_JaffaCakes118.exe	89
PID 1828 wrote to memory of 4924	1828	4819ac7420498073e2f939de3bdcf120_JaffaCakes118.exe	89
PID 1828 wrote to memory of 4924	1828	4819ac7420498073e2f939de3bdcf120_JaffaCakes118.exe	89
PID 1828 wrote to memory of 4924	1828	4819ac7420498073e2f939de3bdcf120_JaffaCakes118.exe	89
PID 1828 wrote to memory of 4924	1828	4819ac7420498073e2f939de3bdcf120_JaffaCakes118.exe	89
PID 1828 wrote to memory of 4924	1828	4819ac7420498073e2f939de3bdcf120_JaffaCakes118.exe	89
PID 1828 wrote to memory of 4924	1828	4819ac7420498073e2f939de3bdcf120_JaffaCakes118.exe	89
PID 1828 wrote to memory of 4924	1828	4819ac7420498073e2f939de3bdcf120_JaffaCakes118.exe	89
PID 1828 wrote to memory of 4924	1828	4819ac7420498073e2f939de3bdcf120_JaffaCakes118.exe	89
PID 1828 wrote to memory of 4924	1828	4819ac7420498073e2f939de3bdcf120_JaffaCakes118.exe	89
PID 1828 wrote to memory of 4924	1828	4819ac7420498073e2f939de3bdcf120_JaffaCakes118.exe	89
PID 1828 wrote to memory of 4924	1828	4819ac7420498073e2f939de3bdcf120_JaffaCakes118.exe	89
PID 1828 wrote to memory of 4924	1828	4819ac7420498073e2f939de3bdcf120_JaffaCakes118.exe	89
PID 1828 wrote to memory of 4924	1828	4819ac7420498073e2f939de3bdcf120_JaffaCakes118.exe	89
PID 1828 wrote to memory of 4924	1828	4819ac7420498073e2f939de3bdcf120_JaffaCakes118.exe	89
PID 1828 wrote to memory of 4924	1828	4819ac7420498073e2f939de3bdcf120_JaffaCakes118.exe	89
PID 2176 wrote to memory of 5104	2176	cmd.exe	91
PID 2176 wrote to memory of 5104	2176	cmd.exe	91
PID 2176 wrote to memory of 5104	2176	cmd.exe	91
PID 2616 wrote to memory of 3312	2616	cmd.exe	92
PID 2616 wrote to memory of 3312	2616	cmd.exe	92
PID 2616 wrote to memory of 3312	2616	cmd.exe	92
PID 1828 wrote to memory of 3976	1828	4819ac7420498073e2f939de3bdcf120_JaffaCakes118.exe	93
PID 1828 wrote to memory of 3976	1828	4819ac7420498073e2f939de3bdcf120_JaffaCakes118.exe	93
PID 1828 wrote to memory of 3976	1828	4819ac7420498073e2f939de3bdcf120_JaffaCakes118.exe	93
PID 3976 wrote to memory of 3632	3976	msdcsc.exe	94
PID 3976 wrote to memory of 3632	3976	msdcsc.exe	94
PID 3976 wrote to memory of 3632	3976	msdcsc.exe	94
PID 3976 wrote to memory of 2212	3976	msdcsc.exe	95
PID 3976 wrote to memory of 2212	3976	msdcsc.exe	95
PID 3976 wrote to memory of 2212	3976	msdcsc.exe	95
PID 3976 wrote to memory of 3388	3976	msdcsc.exe	97
PID 3976 wrote to memory of 3388	3976	msdcsc.exe	97
PID 3976 wrote to memory of 3388	3976	msdcsc.exe	97
PID 3976 wrote to memory of 3388	3976	msdcsc.exe	97
PID 3976 wrote to memory of 3388	3976	msdcsc.exe	97
PID 3976 wrote to memory of 3388	3976	msdcsc.exe	97
PID 3976 wrote to memory of 3388	3976	msdcsc.exe	97
PID 3976 wrote to memory of 3388	3976	msdcsc.exe	97
PID 3976 wrote to memory of 3388	3976	msdcsc.exe	97
PID 3976 wrote to memory of 3388	3976	msdcsc.exe	97
PID 3976 wrote to memory of 3388	3976	msdcsc.exe	97
PID 3976 wrote to memory of 3388	3976	msdcsc.exe	97
PID 3976 wrote to memory of 3388	3976	msdcsc.exe	97
PID 3976 wrote to memory of 3388	3976	msdcsc.exe	97
PID 3976 wrote to memory of 3388	3976	msdcsc.exe	97
PID 3976 wrote to memory of 3388	3976	msdcsc.exe	97
PID 3976 wrote to memory of 3388	3976	msdcsc.exe	97
PID 3632 wrote to memory of 3432	3632	cmd.exe	99
PID 3632 wrote to memory of 3432	3632	cmd.exe	99
PID 3632 wrote to memory of 3432	3632	cmd.exe	99
PID 2212 wrote to memory of 3392	2212	cmd.exe	100
PID 2212 wrote to memory of 3392	2212	cmd.exe	100
PID 2212 wrote to memory of 3392	2212	cmd.exe	100
PID 3976 wrote to memory of 4116	3976	msdcsc.exe	101
PID 3976 wrote to memory of 4116	3976	msdcsc.exe	101
PID 3976 wrote to memory of 4116	3976	msdcsc.exe	101

Views/modifies file attributes 1 TTPs 24 IoCs

Hidden Files and Directories

T1564.001

pid	Process
4912	attrib.exe
2664	attrib.exe
4676	attrib.exe
2864	attrib.exe
3468	attrib.exe
872	attrib.exe
5104	attrib.exe
3432	attrib.exe
4304	attrib.exe
1288	attrib.exe
1908	attrib.exe
3312	attrib.exe
3624	attrib.exe
660	attrib.exe
4440	attrib.exe
4936	attrib.exe
3608	attrib.exe
2484	attrib.exe
1500	attrib.exe
3392	attrib.exe
64	attrib.exe
1648	attrib.exe
3468	attrib.exe
2784	attrib.exe

C:\Users\Admin\AppData\Local\Temp\4819ac7420498073e2f939de3bdcf120_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4819ac7420498073e2f939de3bdcf120_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1828
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\4819ac7420498073e2f939de3bdcf120_JaffaCakes118.exe" +s +h
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2176
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Users\Admin\AppData\Local\Temp\4819ac7420498073e2f939de3bdcf120_JaffaCakes118.exe" +s +h
    3⤵
    - Sets file to hidden
    - Views/modifies file attributes
    PID:5104
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2616
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
    3⤵
    - Sets file to hidden
    - Views/modifies file attributes
    PID:3312
- C:\Windows\SysWOW64\notepad.exe
  notepad
  2⤵
  - Deletes itself
  PID:4924
- C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
  "C:\Windows\system32\MSDCSC\msdcsc.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3976
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3632
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h
      4⤵
      Sets file to hidden
      Drops file in System32 directory
      Views/modifies file attributes
      PID:3432
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2212
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
      4⤵
      Sets file to hidden
      Drops file in System32 directory
      Views/modifies file attributes
      PID:3392
- - C:\Windows\SysWOW64\notepad.exe
    notepad
    3⤵
    PID:3388
- - C:\Windows\SysWOW64\MSDCSC\u84K4144AzcZ\msdcsc.exe
    "C:\Windows\system32\MSDCSC\u84K4144AzcZ\msdcsc.exe"
    3⤵
    - Modifies WinLogon for persistence
    - Checks computer location settings
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in System32 directory
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    PID:4116
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\u84K4144AzcZ\msdcsc.exe" +s +h
      4⤵
      PID:3276
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\MSDCSC\u84K4144AzcZ\msdcsc.exe" +s +h
        5⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:4912
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\u84K4144AzcZ" +s +h
      4⤵
      PID:1460
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\MSDCSC\u84K4144AzcZ" +s +h
        5⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:3624
  - - C:\Windows\SysWOW64\notepad.exe
      notepad
      4⤵
      PID:2732
  - - C:\Windows\SysWOW64\MSDCSC\u84K4144AzcZ\u84K4144AzcZ\msdcsc.exe
      "C:\Windows\system32\MSDCSC\u84K4144AzcZ\u84K4144AzcZ\msdcsc.exe"
      4⤵
      Modifies WinLogon for persistence
      Checks computer location settings
      Executes dropped EXE
      Adds Run key to start application
      Drops file in System32 directory
      Modifies registry class
      PID:2788
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\u84K4144AzcZ\u84K4144AzcZ\msdcsc.exe" +s +h
        5⤵
        
        PID:676
      - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\MSDCSC\u84K4144AzcZ\u84K4144AzcZ\msdcsc.exe" +s +h
        6⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:2664
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\u84K4144AzcZ\u84K4144AzcZ" +s +h
        5⤵
        
        PID:1540
      - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\MSDCSC\u84K4144AzcZ\u84K4144AzcZ" +s +h
        6⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:64
    - - C:\Windows\SysWOW64\notepad.exe
        
        notepad
        5⤵
        
        PID:2808
    - - C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
        
        "C:\Windows\system32\MSDCSC\msdcsc.exe"
        5⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        
        PID:2584
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h
        6⤵
        
        PID:2696
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h
        7⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:4304
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
        6⤵
        
        PID:2988
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
        7⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:1648
      - C:\Windows\SysWOW64\notepad.exe
        
        notepad
        6⤵
        
        PID:1408
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1408 -s 348
        7⤵
        Program crash
        
        PID:3944
      - C:\Windows\SysWOW64\MSDCSC\u84K4144AzcZ\msdcsc.exe
        
        "C:\Windows\system32\MSDCSC\u84K4144AzcZ\msdcsc.exe"
        6⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        
        PID:4380
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\u84K4144AzcZ\msdcsc.exe" +s +h
        7⤵
        
        PID:4724
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\MSDCSC\u84K4144AzcZ\msdcsc.exe" +s +h
        8⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:3468
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\u84K4144AzcZ" +s +h
        7⤵
        
        PID:4968
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\MSDCSC\u84K4144AzcZ" +s +h
        8⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:4676
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        7⤵
        
        PID:1764
        
        C:\Windows\SysWOW64\MSDCSC\u84K4144AzcZ\u84K4144AzcZ\msdcsc.exe
        
        "C:\Windows\system32\MSDCSC\u84K4144AzcZ\u84K4144AzcZ\msdcsc.exe"
        7⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        
        PID:3912
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\u84K4144AzcZ\u84K4144AzcZ\msdcsc.exe" +s +h
        8⤵
        
        PID:3920
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\MSDCSC\u84K4144AzcZ\u84K4144AzcZ\msdcsc.exe" +s +h
        9⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:1288
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\u84K4144AzcZ\u84K4144AzcZ" +s +h
        8⤵
        
        PID:5000
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\MSDCSC\u84K4144AzcZ\u84K4144AzcZ" +s +h
        9⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:660
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        8⤵
        
        PID:2396
        
        C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
        
        "C:\Windows\system32\MSDCSC\msdcsc.exe"
        8⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        
        PID:1076
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h
        9⤵
        
        PID:3692
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h
        10⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:4440
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
        9⤵
        
        PID:2032
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
        10⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:3468
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        9⤵
        
        PID:3820
        
        C:\Windows\SysWOW64\MSDCSC\u84K4144AzcZ\msdcsc.exe
        
        "C:\Windows\system32\MSDCSC\u84K4144AzcZ\msdcsc.exe"
        9⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        
        PID:3472
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\u84K4144AzcZ\msdcsc.exe" +s +h
        10⤵
        
        PID:3780
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\MSDCSC\u84K4144AzcZ\msdcsc.exe" +s +h
        11⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:4936
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\u84K4144AzcZ" +s +h
        10⤵
        
        PID:2296
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\MSDCSC\u84K4144AzcZ" +s +h
        11⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:3608
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        10⤵
        
        PID:4060
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4060 -s 184
        11⤵
        Program crash
        
        PID:3868
        
        C:\Windows\SysWOW64\MSDCSC\u84K4144AzcZ\u84K4144AzcZ\msdcsc.exe
        
        "C:\Windows\system32\MSDCSC\u84K4144AzcZ\u84K4144AzcZ\msdcsc.exe"
        10⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        
        PID:1832
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\u84K4144AzcZ\u84K4144AzcZ\msdcsc.exe" +s +h
        11⤵
        
        PID:528
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\MSDCSC\u84K4144AzcZ\u84K4144AzcZ\msdcsc.exe" +s +h
        12⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:2484
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\u84K4144AzcZ\u84K4144AzcZ" +s +h
        11⤵
        
        PID:3312
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\MSDCSC\u84K4144AzcZ\u84K4144AzcZ" +s +h
        12⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:1500
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        11⤵
        
        PID:2028
        
        C:\Windows\SysWOW64\MSDCSC\u84K4144AzcZ\u84K4144AzcZ\msdcsc.exe
        
        "C:\Windows\system32\MSDCSC\u84K4144AzcZ\u84K4144AzcZ\msdcsc.exe"
        11⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        
        PID:5116
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\u84K4144AzcZ\u84K4144AzcZ\msdcsc.exe" +s +h
        12⤵
        
        PID:3936
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\MSDCSC\u84K4144AzcZ\u84K4144AzcZ\msdcsc.exe" +s +h
        13⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:2864
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\u84K4144AzcZ\u84K4144AzcZ" +s +h
        12⤵
        
        PID:912
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\MSDCSC\u84K4144AzcZ\u84K4144AzcZ" +s +h
        13⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:2784
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        12⤵
        
        PID:4480
        
        C:\Windows\SysWOW64\MSDCSC\u84K4144AzcZ\msdcsc.exe
        
        "C:\Windows\system32\MSDCSC\u84K4144AzcZ\msdcsc.exe"
        12⤵
        Modifies WinLogon for persistence
        Modifies firewall policy service
        Modifies security service
        Windows security bypass
        Checks computer location settings
        Executes dropped EXE
        Windows security modification
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of SetWindowsHookEx
        
        PID:920
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\u84K4144AzcZ\msdcsc.exe" +s +h
        13⤵
        
        PID:660
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\MSDCSC\u84K4144AzcZ\msdcsc.exe" +s +h
        14⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:872
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\u84K4144AzcZ" +s +h
        13⤵
        
        PID:4080
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\MSDCSC\u84K4144AzcZ" +s +h
        14⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:1908
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        13⤵
        
        PID:3528
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3528 -s 84
        14⤵
        Program crash
        
        PID:1632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1408 -ip 1408
1⤵
PID:2244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4060 -ip 4060
1⤵
PID:2232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3528 -ip 3528
1⤵
PID:1848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Modify Registry