darkcomet | 8068a6cc57799b3cb59cad21d592b2a8039f8e004d42092f71791373f8951e57

Analysis

max time kernel
149s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15/07/2024, 16:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4a67817a6404e01d1ea0c9826e74d211_JaffaCakes118.exe
Size 842KB
Sample240715-tkcypsydqn
SHA256 8068a6cc57799b3cb59cad21d592b2a8039f8e004d42092f71791373f8951e57
MD5 4a67817a6404e01d1ea0c9826e74d211
SHA1 3b840ba0f80af4dd215a2552a11bf49f8ff7b053
SHA512 148162b053d58a003e6104f36e3a1bd12c5c83aa9a7a61f85cd80125c0f3d89a64a1e9c6346221e1af1b702ec51b94bce52122f1f2708408738d3f62d4c5df1f
SSDEEP 24576:pzC9vAQ1uGloDy+HGTiXzhs9IQWzxVRvByIhAVlc8:g4IoDqimlWVHvEyAg8
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

darkcomet persistence rat trojan

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies WinLogon for persistence 2 TTPs 25 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\svchost\\svchost.exe"	4a67817a6404e01d1ea0c9826e74d211_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe

Checks computer location settings 2 TTPs 24 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation	4a67817a6404e01d1ea0c9826e74d211_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation	svchost.exe

Executes dropped EXE 48 IoCs

pid	Process
2184	svchost.exe
640	svchost.exe
2924	svchost.exe
4168	svchost.exe
3664	svchost.exe
1484	svchost.exe
468	svchost.exe
3276	svchost.exe
1668	svchost.exe
4968	svchost.exe
4608	svchost.exe
3820	svchost.exe
1740	svchost.exe
2872	svchost.exe
1736	svchost.exe
4564	svchost.exe
3104	svchost.exe
4684	svchost.exe
1916	svchost.exe
4104	svchost.exe
1264	svchost.exe
2988	svchost.exe
4020	svchost.exe
548	svchost.exe
3180	svchost.exe
2764	svchost.exe
4832	svchost.exe
2616	svchost.exe
3264	svchost.exe
3868	svchost.exe
1676	svchost.exe
4044	svchost.exe
1032	svchost.exe
1456	svchost.exe
1916	svchost.exe
4768	svchost.exe
1524	svchost.exe
832	svchost.exe
2196	svchost.exe
2444	svchost.exe
4164	svchost.exe
3424	svchost.exe
5056	svchost.exe
3020	svchost.exe
2972	svchost.exe
664	svchost.exe
1348	svchost.exe
2436	svchost.exe

Adds Run key to start application 2 TTPs 25 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Windows\\system32\\svchost\\svchost.exe"	4a67817a6404e01d1ea0c9826e74d211_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost\	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost\	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost\	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File created	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost\	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost\	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost\	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File created	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost\	svchost.exe
File created	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File created	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File created	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File created	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost\	svchost.exe
File created	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File created	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost\svchost.exe	4a67817a6404e01d1ea0c9826e74d211_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\svchost\	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost\	svchost.exe
File created	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost\	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost\	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost\	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost\	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost\	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File created	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File created	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File created	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File created	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost\	svchost.exe

Suspicious use of SetThreadContext 25 IoCs

description	pid	Process	procid_target
PID 5108 set thread context of 1680	5108	4a67817a6404e01d1ea0c9826e74d211_JaffaCakes118.exe	85
PID 2184 set thread context of 640	2184	svchost.exe	91
PID 2924 set thread context of 4168	2924	svchost.exe	96
PID 3664 set thread context of 1484	3664	svchost.exe	101
PID 468 set thread context of 3276	468	svchost.exe	106
PID 1668 set thread context of 4968	1668	svchost.exe	113
PID 4608 set thread context of 3820	4608	svchost.exe	118
PID 1740 set thread context of 2872	1740	svchost.exe	124
PID 1736 set thread context of 4564	1736	svchost.exe	129
PID 3104 set thread context of 4684	3104	svchost.exe	134
PID 1916 set thread context of 4104	1916	svchost.exe	139
PID 1264 set thread context of 2988	1264	svchost.exe	144
PID 4020 set thread context of 548	4020	svchost.exe	149
PID 3180 set thread context of 2764	3180	svchost.exe	154
PID 4832 set thread context of 2616	4832	svchost.exe	159
PID 3264 set thread context of 3868	3264	svchost.exe	164
PID 1676 set thread context of 4044	1676	svchost.exe	169
PID 1032 set thread context of 1456	1032	svchost.exe	174
PID 1916 set thread context of 4768	1916	svchost.exe	179
PID 1524 set thread context of 832	1524	svchost.exe	184
PID 2196 set thread context of 2444	2196	svchost.exe	189
PID 4164 set thread context of 3424	4164	svchost.exe	194
PID 5056 set thread context of 3020	5056	svchost.exe	199
PID 2972 set thread context of 664	2972	svchost.exe	204
PID 1348 set thread context of 2436	1348	svchost.exe	209

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 24 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	4a67817a6404e01d1ea0c9826e74d211_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	svchost.exe

Runs ping.exe 1 TTPs 24 IoCs

Remote System Discovery

T1018

pid	Process
1036	PING.EXE
4476	PING.EXE
764	PING.EXE
436	PING.EXE
2184	PING.EXE
344	PING.EXE
4928	PING.EXE
2600	PING.EXE
772	PING.EXE
4700	PING.EXE
4264	PING.EXE
4676	PING.EXE
2404	PING.EXE
4840	PING.EXE
404	PING.EXE
3624	PING.EXE
5044	PING.EXE
1596	PING.EXE
4500	PING.EXE
1432	PING.EXE
4508	PING.EXE
4364	PING.EXE
4812	PING.EXE
832	PING.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	1680	4a67817a6404e01d1ea0c9826e74d211_JaffaCakes118.exe
Token: SeSecurityPrivilege	1680	4a67817a6404e01d1ea0c9826e74d211_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	1680	4a67817a6404e01d1ea0c9826e74d211_JaffaCakes118.exe
Token: SeLoadDriverPrivilege	1680	4a67817a6404e01d1ea0c9826e74d211_JaffaCakes118.exe
Token: SeSystemProfilePrivilege	1680	4a67817a6404e01d1ea0c9826e74d211_JaffaCakes118.exe
Token: SeSystemtimePrivilege	1680	4a67817a6404e01d1ea0c9826e74d211_JaffaCakes118.exe
Token: SeProfSingleProcessPrivilege	1680	4a67817a6404e01d1ea0c9826e74d211_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	1680	4a67817a6404e01d1ea0c9826e74d211_JaffaCakes118.exe
Token: SeCreatePagefilePrivilege	1680	4a67817a6404e01d1ea0c9826e74d211_JaffaCakes118.exe
Token: SeBackupPrivilege	1680	4a67817a6404e01d1ea0c9826e74d211_JaffaCakes118.exe
Token: SeRestorePrivilege	1680	4a67817a6404e01d1ea0c9826e74d211_JaffaCakes118.exe
Token: SeShutdownPrivilege	1680	4a67817a6404e01d1ea0c9826e74d211_JaffaCakes118.exe
Token: SeDebugPrivilege	1680	4a67817a6404e01d1ea0c9826e74d211_JaffaCakes118.exe
Token: SeSystemEnvironmentPrivilege	1680	4a67817a6404e01d1ea0c9826e74d211_JaffaCakes118.exe
Token: SeChangeNotifyPrivilege	1680	4a67817a6404e01d1ea0c9826e74d211_JaffaCakes118.exe
Token: SeRemoteShutdownPrivilege	1680	4a67817a6404e01d1ea0c9826e74d211_JaffaCakes118.exe
Token: SeUndockPrivilege	1680	4a67817a6404e01d1ea0c9826e74d211_JaffaCakes118.exe
Token: SeManageVolumePrivilege	1680	4a67817a6404e01d1ea0c9826e74d211_JaffaCakes118.exe
Token: SeImpersonatePrivilege	1680	4a67817a6404e01d1ea0c9826e74d211_JaffaCakes118.exe
Token: SeCreateGlobalPrivilege	1680	4a67817a6404e01d1ea0c9826e74d211_JaffaCakes118.exe
Token: 33	1680	4a67817a6404e01d1ea0c9826e74d211_JaffaCakes118.exe
Token: 34	1680	4a67817a6404e01d1ea0c9826e74d211_JaffaCakes118.exe
Token: 35	1680	4a67817a6404e01d1ea0c9826e74d211_JaffaCakes118.exe
Token: 36	1680	4a67817a6404e01d1ea0c9826e74d211_JaffaCakes118.exe
Token: SeIncreaseQuotaPrivilege	640	svchost.exe
Token: SeSecurityPrivilege	640	svchost.exe
Token: SeTakeOwnershipPrivilege	640	svchost.exe
Token: SeLoadDriverPrivilege	640	svchost.exe
Token: SeSystemProfilePrivilege	640	svchost.exe
Token: SeSystemtimePrivilege	640	svchost.exe
Token: SeProfSingleProcessPrivilege	640	svchost.exe
Token: SeIncBasePriorityPrivilege	640	svchost.exe
Token: SeCreatePagefilePrivilege	640	svchost.exe
Token: SeBackupPrivilege	640	svchost.exe
Token: SeRestorePrivilege	640	svchost.exe
Token: SeShutdownPrivilege	640	svchost.exe
Token: SeDebugPrivilege	640	svchost.exe
Token: SeSystemEnvironmentPrivilege	640	svchost.exe
Token: SeChangeNotifyPrivilege	640	svchost.exe
Token: SeRemoteShutdownPrivilege	640	svchost.exe
Token: SeUndockPrivilege	640	svchost.exe
Token: SeManageVolumePrivilege	640	svchost.exe
Token: SeImpersonatePrivilege	640	svchost.exe
Token: SeCreateGlobalPrivilege	640	svchost.exe
Token: 33	640	svchost.exe
Token: 34	640	svchost.exe
Token: 35	640	svchost.exe
Token: 36	640	svchost.exe
Token: SeIncreaseQuotaPrivilege	4168	svchost.exe
Token: SeSecurityPrivilege	4168	svchost.exe
Token: SeTakeOwnershipPrivilege	4168	svchost.exe
Token: SeLoadDriverPrivilege	4168	svchost.exe
Token: SeSystemProfilePrivilege	4168	svchost.exe
Token: SeSystemtimePrivilege	4168	svchost.exe
Token: SeProfSingleProcessPrivilege	4168	svchost.exe
Token: SeIncBasePriorityPrivilege	4168	svchost.exe
Token: SeCreatePagefilePrivilege	4168	svchost.exe
Token: SeBackupPrivilege	4168	svchost.exe
Token: SeRestorePrivilege	4168	svchost.exe
Token: SeShutdownPrivilege	4168	svchost.exe
Token: SeDebugPrivilege	4168	svchost.exe
Token: SeSystemEnvironmentPrivilege	4168	svchost.exe
Token: SeChangeNotifyPrivilege	4168	svchost.exe
Token: SeRemoteShutdownPrivilege	4168	svchost.exe

Suspicious use of SetWindowsHookEx 25 IoCs

pid	Process
5108	4a67817a6404e01d1ea0c9826e74d211_JaffaCakes118.exe
2184	svchost.exe
2924	svchost.exe
3664	svchost.exe
468	svchost.exe
1668	svchost.exe
4608	svchost.exe
1740	svchost.exe
1736	svchost.exe
3104	svchost.exe
1916	svchost.exe
1264	svchost.exe
4020	svchost.exe
3180	svchost.exe
4832	svchost.exe
3264	svchost.exe
1676	svchost.exe
1032	svchost.exe
1916	svchost.exe
1524	svchost.exe
2196	svchost.exe
4164	svchost.exe
5056	svchost.exe
2972	svchost.exe
1348	svchost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5108 wrote to memory of 1680	5108	4a67817a6404e01d1ea0c9826e74d211_JaffaCakes118.exe	85
PID 5108 wrote to memory of 1680	5108	4a67817a6404e01d1ea0c9826e74d211_JaffaCakes118.exe	85
PID 5108 wrote to memory of 1680	5108	4a67817a6404e01d1ea0c9826e74d211_JaffaCakes118.exe	85
PID 5108 wrote to memory of 1680	5108	4a67817a6404e01d1ea0c9826e74d211_JaffaCakes118.exe	85
PID 5108 wrote to memory of 1680	5108	4a67817a6404e01d1ea0c9826e74d211_JaffaCakes118.exe	85
PID 5108 wrote to memory of 1680	5108	4a67817a6404e01d1ea0c9826e74d211_JaffaCakes118.exe	85
PID 5108 wrote to memory of 1680	5108	4a67817a6404e01d1ea0c9826e74d211_JaffaCakes118.exe	85
PID 5108 wrote to memory of 1680	5108	4a67817a6404e01d1ea0c9826e74d211_JaffaCakes118.exe	85
PID 5108 wrote to memory of 1680	5108	4a67817a6404e01d1ea0c9826e74d211_JaffaCakes118.exe	85
PID 5108 wrote to memory of 1680	5108	4a67817a6404e01d1ea0c9826e74d211_JaffaCakes118.exe	85
PID 5108 wrote to memory of 1680	5108	4a67817a6404e01d1ea0c9826e74d211_JaffaCakes118.exe	85
PID 5108 wrote to memory of 1680	5108	4a67817a6404e01d1ea0c9826e74d211_JaffaCakes118.exe	85
PID 5108 wrote to memory of 1680	5108	4a67817a6404e01d1ea0c9826e74d211_JaffaCakes118.exe	85
PID 5108 wrote to memory of 1680	5108	4a67817a6404e01d1ea0c9826e74d211_JaffaCakes118.exe	85
PID 1680 wrote to memory of 2084	1680	4a67817a6404e01d1ea0c9826e74d211_JaffaCakes118.exe	87
PID 1680 wrote to memory of 2084	1680	4a67817a6404e01d1ea0c9826e74d211_JaffaCakes118.exe	87
PID 1680 wrote to memory of 2084	1680	4a67817a6404e01d1ea0c9826e74d211_JaffaCakes118.exe	87
PID 2084 wrote to memory of 5044	2084	cmd.exe	89
PID 2084 wrote to memory of 5044	2084	cmd.exe	89
PID 2084 wrote to memory of 5044	2084	cmd.exe	89
PID 1680 wrote to memory of 2184	1680	4a67817a6404e01d1ea0c9826e74d211_JaffaCakes118.exe	90
PID 1680 wrote to memory of 2184	1680	4a67817a6404e01d1ea0c9826e74d211_JaffaCakes118.exe	90
PID 1680 wrote to memory of 2184	1680	4a67817a6404e01d1ea0c9826e74d211_JaffaCakes118.exe	90
PID 2184 wrote to memory of 640	2184	svchost.exe	91
PID 2184 wrote to memory of 640	2184	svchost.exe	91
PID 2184 wrote to memory of 640	2184	svchost.exe	91
PID 2184 wrote to memory of 640	2184	svchost.exe	91
PID 2184 wrote to memory of 640	2184	svchost.exe	91
PID 2184 wrote to memory of 640	2184	svchost.exe	91
PID 2184 wrote to memory of 640	2184	svchost.exe	91
PID 2184 wrote to memory of 640	2184	svchost.exe	91
PID 2184 wrote to memory of 640	2184	svchost.exe	91
PID 2184 wrote to memory of 640	2184	svchost.exe	91
PID 2184 wrote to memory of 640	2184	svchost.exe	91
PID 2184 wrote to memory of 640	2184	svchost.exe	91
PID 2184 wrote to memory of 640	2184	svchost.exe	91
PID 2184 wrote to memory of 640	2184	svchost.exe	91
PID 640 wrote to memory of 1456	640	svchost.exe	92
PID 640 wrote to memory of 1456	640	svchost.exe	92
PID 640 wrote to memory of 1456	640	svchost.exe	92
PID 1456 wrote to memory of 772	1456	cmd.exe	94
PID 1456 wrote to memory of 772	1456	cmd.exe	94
PID 1456 wrote to memory of 772	1456	cmd.exe	94
PID 640 wrote to memory of 2924	640	svchost.exe	95
PID 640 wrote to memory of 2924	640	svchost.exe	95
PID 640 wrote to memory of 2924	640	svchost.exe	95
PID 2924 wrote to memory of 4168	2924	svchost.exe	96
PID 2924 wrote to memory of 4168	2924	svchost.exe	96
PID 2924 wrote to memory of 4168	2924	svchost.exe	96
PID 2924 wrote to memory of 4168	2924	svchost.exe	96
PID 2924 wrote to memory of 4168	2924	svchost.exe	96
PID 2924 wrote to memory of 4168	2924	svchost.exe	96
PID 2924 wrote to memory of 4168	2924	svchost.exe	96
PID 2924 wrote to memory of 4168	2924	svchost.exe	96
PID 2924 wrote to memory of 4168	2924	svchost.exe	96
PID 2924 wrote to memory of 4168	2924	svchost.exe	96
PID 2924 wrote to memory of 4168	2924	svchost.exe	96
PID 2924 wrote to memory of 4168	2924	svchost.exe	96
PID 2924 wrote to memory of 4168	2924	svchost.exe	96
PID 2924 wrote to memory of 4168	2924	svchost.exe	96
PID 4168 wrote to memory of 2108	4168	svchost.exe	97
PID 4168 wrote to memory of 2108	4168	svchost.exe	97
PID 4168 wrote to memory of 2108	4168	svchost.exe	97
PID 2108 wrote to memory of 764	2108	cmd.exe	99

C:\Users\Admin\AppData\Local\Temp\4a67817a6404e01d1ea0c9826e74d211_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4a67817a6404e01d1ea0c9826e74d211_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5108
- C:\Users\Admin\AppData\Local\Temp\4a67817a6404e01d1ea0c9826e74d211_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\4a67817a6404e01d1ea0c9826e74d211_JaffaCakes118.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Checks computer location settings
  - Adds Run key to start application
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1680
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2084
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 5
      4⤵
      Runs ping.exe
      PID:5044
- - C:\Windows\SysWOW64\svchost\svchost.exe
    "C:\Windows\system32\svchost\svchost.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2184
  - - C:\Windows\SysWOW64\svchost\svchost.exe
      "C:\Windows\SysWOW64\svchost\svchost.exe"
      4⤵
      Modifies WinLogon for persistence
      Checks computer location settings
      Executes dropped EXE
      Adds Run key to start application
      Drops file in System32 directory
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:640
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1456
      - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 5
        6⤵
        Runs ping.exe
        
        PID:772
    - - C:\Windows\SysWOW64\svchost\svchost.exe
        
        "C:\Windows\system32\svchost\svchost.exe"
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2924
      - C:\Windows\SysWOW64\svchost\svchost.exe
        
        "C:\Windows\SysWOW64\svchost\svchost.exe"
        6⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4168
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:2108
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 5
        8⤵
        Runs ping.exe
        
        PID:764
        
        C:\Windows\SysWOW64\svchost\svchost.exe
        
        "C:\Windows\system32\svchost\svchost.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:3664
        
        C:\Windows\SysWOW64\svchost\svchost.exe
        
        "C:\Windows\SysWOW64\svchost\svchost.exe"
        8⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        
        PID:1484
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
        9⤵
        
        PID:2396
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 5
        10⤵
        Runs ping.exe
        
        PID:436
        
        C:\Windows\SysWOW64\svchost\svchost.exe
        
        "C:\Windows\system32\svchost\svchost.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:468
        
        C:\Windows\SysWOW64\svchost\svchost.exe
        
        "C:\Windows\SysWOW64\svchost\svchost.exe"
        10⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        
        PID:3276
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
        11⤵
        
        PID:1328
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 5
        12⤵
        Runs ping.exe
        
        PID:4700
        
        C:\Windows\SysWOW64\svchost\svchost.exe
        
        "C:\Windows\system32\svchost\svchost.exe"
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:1668
        
        C:\Windows\SysWOW64\svchost\svchost.exe
        
        "C:\Windows\SysWOW64\svchost\svchost.exe"
        12⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        
        PID:4968
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
        13⤵
        
        PID:1820
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 5
        14⤵
        Runs ping.exe
        
        PID:4364
        
        C:\Windows\SysWOW64\svchost\svchost.exe
        
        "C:\Windows\system32\svchost\svchost.exe"
        13⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:4608
        
        C:\Windows\SysWOW64\svchost\svchost.exe
        
        "C:\Windows\SysWOW64\svchost\svchost.exe"
        14⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        
        PID:3820
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
        15⤵
        
        PID:4888
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 5
        16⤵
        Runs ping.exe
        
        PID:1596
        
        C:\Windows\SysWOW64\svchost\svchost.exe
        
        "C:\Windows\system32\svchost\svchost.exe"
        15⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:1740
        
        C:\Windows\SysWOW64\svchost\svchost.exe
        
        "C:\Windows\SysWOW64\svchost\svchost.exe"
        16⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        
        PID:2872
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
        17⤵
        
        PID:2556
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 5
        18⤵
        Runs ping.exe
        
        PID:4500
        
        C:\Windows\SysWOW64\svchost\svchost.exe
        
        "C:\Windows\system32\svchost\svchost.exe"
        17⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:1736
        
        C:\Windows\SysWOW64\svchost\svchost.exe
        
        "C:\Windows\SysWOW64\svchost\svchost.exe"
        18⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        
        PID:4564
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
        19⤵
        
        PID:2024
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 5
        20⤵
        Runs ping.exe
        
        PID:4812
        
        C:\Windows\SysWOW64\svchost\svchost.exe
        
        "C:\Windows\system32\svchost\svchost.exe"
        19⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:3104
        
        C:\Windows\SysWOW64\svchost\svchost.exe
        
        "C:\Windows\SysWOW64\svchost\svchost.exe"
        20⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        
        PID:4684
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
        21⤵
        
        PID:4452
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 5
        22⤵
        Runs ping.exe
        
        PID:4264
        
        C:\Windows\SysWOW64\svchost\svchost.exe
        
        "C:\Windows\system32\svchost\svchost.exe"
        21⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:1916
        
        C:\Windows\SysWOW64\svchost\svchost.exe
        
        "C:\Windows\SysWOW64\svchost\svchost.exe"
        22⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        
        PID:4104
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
        23⤵
        
        PID:1720
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 5
        24⤵
        Runs ping.exe
        
        PID:832
        
        C:\Windows\SysWOW64\svchost\svchost.exe
        
        "C:\Windows\system32\svchost\svchost.exe"
        23⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:1264
        
        C:\Windows\SysWOW64\svchost\svchost.exe
        
        "C:\Windows\SysWOW64\svchost\svchost.exe"
        24⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        
        PID:2988
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
        25⤵
        
        PID:2420
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 5
        26⤵
        Runs ping.exe
        
        PID:4676
        
        C:\Windows\SysWOW64\svchost\svchost.exe
        
        "C:\Windows\system32\svchost\svchost.exe"
        25⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:4020
        
        C:\Windows\SysWOW64\svchost\svchost.exe
        
        "C:\Windows\SysWOW64\svchost\svchost.exe"
        26⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        
        PID:548
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
        27⤵
        
        PID:3424
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 5
        28⤵
        Runs ping.exe
        
        PID:344
        
        C:\Windows\SysWOW64\svchost\svchost.exe
        
        "C:\Windows\system32\svchost\svchost.exe"
        27⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:3180
        
        C:\Windows\SysWOW64\svchost\svchost.exe
        
        "C:\Windows\SysWOW64\svchost\svchost.exe"
        28⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        
        PID:2764
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
        29⤵
        
        PID:4920
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 5
        30⤵
        Runs ping.exe
        
        PID:4928
        
        C:\Windows\SysWOW64\svchost\svchost.exe
        
        "C:\Windows\system32\svchost\svchost.exe"
        29⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:4832
        
        C:\Windows\SysWOW64\svchost\svchost.exe
        
        "C:\Windows\SysWOW64\svchost\svchost.exe"
        30⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        
        PID:2616
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
        31⤵
        
        PID:4120
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 5
        32⤵
        Runs ping.exe
        
        PID:2184
        
        C:\Windows\SysWOW64\svchost\svchost.exe
        
        "C:\Windows\system32\svchost\svchost.exe"
        31⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:3264
        
        C:\Windows\SysWOW64\svchost\svchost.exe
        
        "C:\Windows\SysWOW64\svchost\svchost.exe"
        32⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        
        PID:3868
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
        33⤵
        
        PID:2004
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 5
        34⤵
        Runs ping.exe
        
        PID:2600
        
        C:\Windows\SysWOW64\svchost\svchost.exe
        
        "C:\Windows\system32\svchost\svchost.exe"
        33⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:1676
        
        C:\Windows\SysWOW64\svchost\svchost.exe
        
        "C:\Windows\SysWOW64\svchost\svchost.exe"
        34⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        
        PID:4044
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
        35⤵
        
        PID:4812
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 5
        36⤵
        Runs ping.exe
        
        PID:2404
        
        C:\Windows\SysWOW64\svchost\svchost.exe
        
        "C:\Windows\system32\svchost\svchost.exe"
        35⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:1032
        
        C:\Windows\SysWOW64\svchost\svchost.exe
        
        "C:\Windows\SysWOW64\svchost\svchost.exe"
        36⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        
        PID:1456
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
        37⤵
        
        PID:2220
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 5
        38⤵
        Runs ping.exe
        
        PID:1036
        
        C:\Windows\SysWOW64\svchost\svchost.exe
        
        "C:\Windows\system32\svchost\svchost.exe"
        37⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:1916
        
        C:\Windows\SysWOW64\svchost\svchost.exe
        
        "C:\Windows\SysWOW64\svchost\svchost.exe"
        38⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        
        PID:4768
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
        39⤵
        
        PID:468
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 5
        40⤵
        Runs ping.exe
        
        PID:4840
        
        C:\Windows\SysWOW64\svchost\svchost.exe
        
        "C:\Windows\system32\svchost\svchost.exe"
        39⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:1524
        
        C:\Windows\SysWOW64\svchost\svchost.exe
        
        "C:\Windows\SysWOW64\svchost\svchost.exe"
        40⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        
        PID:832
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
        41⤵
        
        PID:4652
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 5
        42⤵
        Runs ping.exe
        
        PID:404
        
        C:\Windows\SysWOW64\svchost\svchost.exe
        
        "C:\Windows\system32\svchost\svchost.exe"
        41⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2196
        
        C:\Windows\SysWOW64\svchost\svchost.exe
        
        "C:\Windows\SysWOW64\svchost\svchost.exe"
        42⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        
        PID:2444
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
        43⤵
        
        PID:5096
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 5
        44⤵
        Runs ping.exe
        
        PID:4508
        
        C:\Windows\SysWOW64\svchost\svchost.exe
        
        "C:\Windows\system32\svchost\svchost.exe"
        43⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:4164
        
        C:\Windows\SysWOW64\svchost\svchost.exe
        
        "C:\Windows\SysWOW64\svchost\svchost.exe"
        44⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        
        PID:3424
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
        45⤵
        
        PID:5012
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 5
        46⤵
        Runs ping.exe
        
        PID:4476
        
        C:\Windows\SysWOW64\svchost\svchost.exe
        
        "C:\Windows\system32\svchost\svchost.exe"
        45⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:5056
        
        C:\Windows\SysWOW64\svchost\svchost.exe
        
        "C:\Windows\SysWOW64\svchost\svchost.exe"
        46⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        
        PID:3020
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
        47⤵
        
        PID:1028
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 5
        48⤵
        Runs ping.exe
        
        PID:3624
        
        C:\Windows\SysWOW64\svchost\svchost.exe
        
        "C:\Windows\system32\svchost\svchost.exe"
        47⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2972
        
        C:\Windows\SysWOW64\svchost\svchost.exe
        
        "C:\Windows\SysWOW64\svchost\svchost.exe"
        48⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        
        PID:664
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
        49⤵
        
        PID:2456
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 5
        50⤵
        Runs ping.exe
        
        PID:1432
        
        C:\Windows\SysWOW64\svchost\svchost.exe
        
        "C:\Windows\system32\svchost\svchost.exe"
        49⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:1348
        
        C:\Windows\SysWOW64\svchost\svchost.exe
        
        "C:\Windows\SysWOW64\svchost\svchost.exe"
        50⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:2436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmpcmd.bat

Path C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat
Size 113B
SHA256 e5270ca818e52b8695ac2114a99c5d38f4cc62b0346a12c07d16c0c18b5c0c59
MD5 c24723d958f7a779f218406fbefe0c00
SHA1 5e5a4a3785173c2888d3349ee28521df2ae215c9
SHA512 79d467bfda97e13becdd0c3c542799f980417874aa028418861ad6a2300b077ca29f9e254f7e6a0f592978efb87488aebaef0f7abaf142b777db28a45256d662
MD5 SHA1 SHA512

Submit Download

tmpcmd.bat

Path C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat
Size 68B
SHA256 1246ec0ab23683a4c8d0e61703a0040934480f5f9febed355e20ba01e5e94a64
MD5 be86b3c417d64511f76559e76874362e
SHA1 3eeada32f888b7baefe289fede57b07ae0653ea2
SHA512 5a98e1a3534d92ea703f5a14a6be431ab4044386478ac69c0ee57f963455b61d6de766f343201a3eee36ff15ef6e8d734a12fdce0f15e3efe9b538571c226815
MD5 SHA1 SHA512

Submit Download

svchost.exe

Path C:\Windows\SysWOW64\svchost\svchost.exe
Size 842KB
SHA256 8068a6cc57799b3cb59cad21d592b2a8039f8e004d42092f71791373f8951e57
MD5 4a67817a6404e01d1ea0c9826e74d211
SHA1 3b840ba0f80af4dd215a2552a11bf49f8ff7b053
SHA512 148162b053d58a003e6104f36e3a1bd12c5c83aa9a7a61f85cd80125c0f3d89a64a1e9c6346221e1af1b702ec51b94bce52122f1f2708408738d3f62d4c5df1f
SSDEEP 24576:pzC9vAQ1uGloDy+HGTiXzhs9IQWzxVRvByIhAVlc8:g4IoDqimlWVHvEyAg8
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/468-131-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/468-124-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/640-84-0x0000000000400000-0x00000000004DB000-memory.dmp

Download

memory/640-94-0x0000000000400000-0x00000000004DB000-memory.dmp

Download

memory/640-83-0x0000000000400000-0x00000000004DB000-memory.dmp

Download

memory/1032-307-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/1032-303-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/1484-122-0x0000000000400000-0x00000000004DB000-memory.dmp

Download

memory/1484-115-0x0000000000400000-0x00000000004DB000-memory.dmp

Download

memory/1524-326-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/1668-145-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/1680-5-0x0000000000400000-0x00000000004DB000-memory.dmp

Download

memory/1680-6-0x0000000000400000-0x00000000004DB000-memory.dmp

Download

memory/1680-78-0x0000000000400000-0x00000000004DB000-memory.dmp

Download

memory/1680-3-0x0000000000400000-0x00000000004DB000-memory.dmp

Download

memory/1680-4-0x0000000000400000-0x00000000004DB000-memory.dmp

Download

memory/1680-9-0x0000000000400000-0x00000000004DB000-memory.dmp

Download

memory/1736-182-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/1916-214-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/1916-315-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/2184-86-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/2872-178-0x0000000000400000-0x00000000004DB000-memory.dmp

Download

memory/2924-102-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/2924-97-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/2988-233-0x0000000000400000-0x00000000004DB000-memory.dmp

Download

memory/3104-196-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/3276-137-0x0000000000400000-0x00000000004DB000-memory.dmp

Download

memory/3664-110-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/3664-116-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/3820-165-0x0000000000400000-0x00000000004DB000-memory.dmp

Download

memory/4104-220-0x0000000000400000-0x00000000004DB000-memory.dmp

Download

memory/4164-347-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/4168-100-0x0000000000400000-0x00000000004DB000-memory.dmp

Download

memory/4168-108-0x0000000000400000-0x00000000004DB000-memory.dmp

Download

memory/4564-192-0x0000000000400000-0x00000000004DB000-memory.dmp

Download

memory/4684-206-0x0000000000400000-0x00000000004DB000-memory.dmp

Download

memory/4832-268-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/4832-263-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/4968-151-0x0000000000400000-0x00000000004DB000-memory.dmp

Download

memory/5108-0-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/5108-8-0x0000000000400000-0x0000000000412000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads