darkcomet | 22958ccd515d58690de6f31678ad466571318066c63bb714154e724010a94eb0

Analysis

max time kernel
149s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/08/2024, 12:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ab06a58820fc4737bf0f2d0964b41083_JaffaCakes118.exe
Size

747KB
MD5

ab06a58820fc4737bf0f2d0964b41083
SHA1

efd19604663c07542ffee9101ef78a1c072ffe05
SHA256

22958ccd515d58690de6f31678ad466571318066c63bb714154e724010a94eb0
SHA512

4eb76333d568392dd16733d6acecb16a49eeaf601534b6364f84ddb93eb890ae527dde81400cd23094c3f9d39023e41403b64b458fe7d4417179c21c24abf9f0
SSDEEP

12288:46A84PaHhfD/tV9sj5NKR0pau9XGyu2qBVGLQyTPfhcSsvv:9AmBpVKHu0Mu9Xo20VGLVP5Yvv

Score

10^/10

darkcomet discovery evasion persistence rat trojan

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies WinLogon for persistence 2 TTPs 24 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\svchost\\svchost.exe"	ab06a58820fc4737bf0f2d0964b41083_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe,C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe

Sets file to hidden 1 TTPs 48 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
6088	attrib.exe
5792	attrib.exe
3876	attrib.exe
1216	attrib.exe
1800	attrib.exe
3136	attrib.exe
2484	attrib.exe
448	attrib.exe
380	attrib.exe
448	attrib.exe
5692	attrib.exe
5208	attrib.exe
2752	attrib.exe
2824	attrib.exe
1372	attrib.exe
3588	attrib.exe
4244	attrib.exe
5104	attrib.exe
2576	attrib.exe
5704	attrib.exe
1860	attrib.exe
1864	attrib.exe
1564	attrib.exe
1888	attrib.exe
5796	attrib.exe
948	attrib.exe
2512	attrib.exe
3888	attrib.exe
6108	attrib.exe
1368	attrib.exe
1452	attrib.exe
1508	attrib.exe
2368	attrib.exe
6068	attrib.exe
1564	attrib.exe
1564	attrib.exe
3252	attrib.exe
2864	attrib.exe
472	attrib.exe
3504	attrib.exe
3268	attrib.exe
4304	attrib.exe
1452	attrib.exe
3948	attrib.exe
4316	attrib.exe
5680	attrib.exe
1304	attrib.exe
5600	attrib.exe

Checks computer location settings 2 TTPs 24 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	ab06a58820fc4737bf0f2d0964b41083_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	svchost.exe

Executes dropped EXE 23 IoCs

pid	Process
3632	svchost.exe
3712	svchost.exe
3748	svchost.exe
3264	svchost.exe
4568	svchost.exe
4992	svchost.exe
4380	svchost.exe
3620	svchost.exe
2484	svchost.exe
472	svchost.exe
1452	svchost.exe
2372	svchost.exe
2512	svchost.exe
5108	svchost.exe
1620	svchost.exe
5708	svchost.exe
6104	svchost.exe
2372	svchost.exe
5572	svchost.exe
2308	svchost.exe
1980	svchost.exe
3936	svchost.exe
212	svchost.exe

Adds Run key to start application 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Hostprozess für Windows-Dienste = "C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Hostprozess für Windows-Dienste = "C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Hostprozess für Windows-Dienste = "C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Hostprozess für Windows-Dienste = "C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Hostprozess für Windows-Dienste = "C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Hostprozess für Windows-Dienste = "C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Hostprozess für Windows-Dienste = "C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Hostprozess für Windows-Dienste = "C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Hostprozess für Windows-Dienste = "C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Hostprozess für Windows-Dienste = "C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Hostprozess für Windows-Dienste = "C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Hostprozess für Windows-Dienste = "C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Hostprozess für Windows-Dienste = "C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Hostprozess für Windows-Dienste = "C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Hostprozess für Windows-Dienste = "C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Hostprozess für Windows-Dienste = "C:\\Windows\\system32\\svchost\\svchost.exe"	ab06a58820fc4737bf0f2d0964b41083_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Hostprozess für Windows-Dienste = "C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Hostprozess für Windows-Dienste = "C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Hostprozess für Windows-Dienste = "C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Hostprozess für Windows-Dienste = "C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Hostprozess für Windows-Dienste = "C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Hostprozess für Windows-Dienste = "C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Hostprozess für Windows-Dienste = "C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Hostprozess für Windows-Dienste = "C:\\Windows\\system32\\svchost\\svchost.exe"	svchost.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\svchost\	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost	attrib.exe
File created	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost\svchost.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File created	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File created	C:\Windows\SysWOW64\svchost\svchost.exe	ab06a58820fc4737bf0f2d0964b41083_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\svchost\svchost.exe	attrib.exe
File created	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File created	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost\	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost\svchost.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\svchost\svchost.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\svchost	attrib.exe
File opened for modification	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File created	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File created	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost\svchost.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\svchost\	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File created	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost	attrib.exe
File opened for modification	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost\svchost.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\svchost\svchost.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\svchost\svchost.exe	attrib.exe
File created	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost\	svchost.exe
File created	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File created	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost\svchost.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\svchost\	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost\	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost	attrib.exe
File created	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost\svchost.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\svchost\	ab06a58820fc4737bf0f2d0964b41083_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost\	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost\	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost\svchost.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost	attrib.exe
File opened for modification	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File created	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost\svchost.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\svchost\svchost.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\svchost\	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost\svchost.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\svchost\svchost.exe	ab06a58820fc4737bf0f2d0964b41083_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\svchost\svchost.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\svchost\	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost	attrib.exe
File opened for modification	C:\Windows\SysWOW64\svchost\svchost.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\svchost\	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost\	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost	attrib.exe
File opened for modification	C:\Windows\SysWOW64\svchost\svchost.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\svchost\	svchost.exe
File created	C:\Windows\SysWOW64\svchost\svchost.exe	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ab06a58820fc4737bf0f2d0964b41083_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 46 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2736	PING.EXE
2908	cmd.exe
4832	cmd.exe
2960	cmd.exe
3980	cmd.exe
552	PING.EXE
3136	cmd.exe
444	PING.EXE
4568	cmd.exe
1972	PING.EXE
5720	cmd.exe
5780	PING.EXE
6124	cmd.exe
5840	PING.EXE
232	PING.EXE
3720	cmd.exe
3960	cmd.exe
5288	PING.EXE
5936	PING.EXE
3036	cmd.exe
4356	PING.EXE
4616	cmd.exe
3600	PING.EXE
4824	cmd.exe
1800	PING.EXE
1760	PING.EXE
5164	PING.EXE
4460	PING.EXE
5192	cmd.exe
4556	PING.EXE
944	PING.EXE
1100	cmd.exe
3596	cmd.exe
4412	cmd.exe
4488	cmd.exe
1844	cmd.exe
1308	PING.EXE
2948	cmd.exe
3272	cmd.exe
2824	PING.EXE
5156	cmd.exe
6116	PING.EXE
2524	cmd.exe
388	PING.EXE
4516	PING.EXE
3620	PING.EXE

Modifies registry class 23 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	ab06a58820fc4737bf0f2d0964b41083_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	svchost.exe

Runs ping.exe 1 TTPs 23 IoCs

Remote System Discovery

T1018

pid	Process
3620	PING.EXE
552	PING.EXE
444	PING.EXE
5780	PING.EXE
5288	PING.EXE
388	PING.EXE
4516	PING.EXE
232	PING.EXE
4556	PING.EXE
4460	PING.EXE
1308	PING.EXE
1800	PING.EXE
1760	PING.EXE
2824	PING.EXE
1972	PING.EXE
2736	PING.EXE
5164	PING.EXE
6116	PING.EXE
4356	PING.EXE
944	PING.EXE
3600	PING.EXE
5840	PING.EXE
5936	PING.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4296	ab06a58820fc4737bf0f2d0964b41083_JaffaCakes118.exe
Token: SeSecurityPrivilege	4296	ab06a58820fc4737bf0f2d0964b41083_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	4296	ab06a58820fc4737bf0f2d0964b41083_JaffaCakes118.exe
Token: SeLoadDriverPrivilege	4296	ab06a58820fc4737bf0f2d0964b41083_JaffaCakes118.exe
Token: SeSystemProfilePrivilege	4296	ab06a58820fc4737bf0f2d0964b41083_JaffaCakes118.exe
Token: SeSystemtimePrivilege	4296	ab06a58820fc4737bf0f2d0964b41083_JaffaCakes118.exe
Token: SeProfSingleProcessPrivilege	4296	ab06a58820fc4737bf0f2d0964b41083_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	4296	ab06a58820fc4737bf0f2d0964b41083_JaffaCakes118.exe
Token: SeCreatePagefilePrivilege	4296	ab06a58820fc4737bf0f2d0964b41083_JaffaCakes118.exe
Token: SeBackupPrivilege	4296	ab06a58820fc4737bf0f2d0964b41083_JaffaCakes118.exe
Token: SeRestorePrivilege	4296	ab06a58820fc4737bf0f2d0964b41083_JaffaCakes118.exe
Token: SeShutdownPrivilege	4296	ab06a58820fc4737bf0f2d0964b41083_JaffaCakes118.exe
Token: SeDebugPrivilege	4296	ab06a58820fc4737bf0f2d0964b41083_JaffaCakes118.exe
Token: SeSystemEnvironmentPrivilege	4296	ab06a58820fc4737bf0f2d0964b41083_JaffaCakes118.exe
Token: SeChangeNotifyPrivilege	4296	ab06a58820fc4737bf0f2d0964b41083_JaffaCakes118.exe
Token: SeRemoteShutdownPrivilege	4296	ab06a58820fc4737bf0f2d0964b41083_JaffaCakes118.exe
Token: SeUndockPrivilege	4296	ab06a58820fc4737bf0f2d0964b41083_JaffaCakes118.exe
Token: SeManageVolumePrivilege	4296	ab06a58820fc4737bf0f2d0964b41083_JaffaCakes118.exe
Token: SeImpersonatePrivilege	4296	ab06a58820fc4737bf0f2d0964b41083_JaffaCakes118.exe
Token: SeCreateGlobalPrivilege	4296	ab06a58820fc4737bf0f2d0964b41083_JaffaCakes118.exe
Token: 33	4296	ab06a58820fc4737bf0f2d0964b41083_JaffaCakes118.exe
Token: 34	4296	ab06a58820fc4737bf0f2d0964b41083_JaffaCakes118.exe
Token: 35	4296	ab06a58820fc4737bf0f2d0964b41083_JaffaCakes118.exe
Token: 36	4296	ab06a58820fc4737bf0f2d0964b41083_JaffaCakes118.exe
Token: SeIncreaseQuotaPrivilege	3632	svchost.exe
Token: SeSecurityPrivilege	3632	svchost.exe
Token: SeTakeOwnershipPrivilege	3632	svchost.exe
Token: SeLoadDriverPrivilege	3632	svchost.exe
Token: SeSystemProfilePrivilege	3632	svchost.exe
Token: SeSystemtimePrivilege	3632	svchost.exe
Token: SeProfSingleProcessPrivilege	3632	svchost.exe
Token: SeIncBasePriorityPrivilege	3632	svchost.exe
Token: SeCreatePagefilePrivilege	3632	svchost.exe
Token: SeBackupPrivilege	3632	svchost.exe
Token: SeRestorePrivilege	3632	svchost.exe
Token: SeShutdownPrivilege	3632	svchost.exe
Token: SeDebugPrivilege	3632	svchost.exe
Token: SeSystemEnvironmentPrivilege	3632	svchost.exe
Token: SeChangeNotifyPrivilege	3632	svchost.exe
Token: SeRemoteShutdownPrivilege	3632	svchost.exe
Token: SeUndockPrivilege	3632	svchost.exe
Token: SeManageVolumePrivilege	3632	svchost.exe
Token: SeImpersonatePrivilege	3632	svchost.exe
Token: SeCreateGlobalPrivilege	3632	svchost.exe
Token: 33	3632	svchost.exe
Token: 34	3632	svchost.exe
Token: 35	3632	svchost.exe
Token: 36	3632	svchost.exe
Token: SeIncreaseQuotaPrivilege	3712	svchost.exe
Token: SeSecurityPrivilege	3712	svchost.exe
Token: SeTakeOwnershipPrivilege	3712	svchost.exe
Token: SeLoadDriverPrivilege	3712	svchost.exe
Token: SeSystemProfilePrivilege	3712	svchost.exe
Token: SeSystemtimePrivilege	3712	svchost.exe
Token: SeProfSingleProcessPrivilege	3712	svchost.exe
Token: SeIncBasePriorityPrivilege	3712	svchost.exe
Token: SeCreatePagefilePrivilege	3712	svchost.exe
Token: SeBackupPrivilege	3712	svchost.exe
Token: SeRestorePrivilege	3712	svchost.exe
Token: SeShutdownPrivilege	3712	svchost.exe
Token: SeDebugPrivilege	3712	svchost.exe
Token: SeSystemEnvironmentPrivilege	3712	svchost.exe
Token: SeChangeNotifyPrivilege	3712	svchost.exe
Token: SeRemoteShutdownPrivilege	3712	svchost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4296 wrote to memory of 2084	4296	ab06a58820fc4737bf0f2d0964b41083_JaffaCakes118.exe	93
PID 4296 wrote to memory of 2084	4296	ab06a58820fc4737bf0f2d0964b41083_JaffaCakes118.exe	93
PID 4296 wrote to memory of 2084	4296	ab06a58820fc4737bf0f2d0964b41083_JaffaCakes118.exe	93
PID 4296 wrote to memory of 1948	4296	ab06a58820fc4737bf0f2d0964b41083_JaffaCakes118.exe	95
PID 4296 wrote to memory of 1948	4296	ab06a58820fc4737bf0f2d0964b41083_JaffaCakes118.exe	95
PID 4296 wrote to memory of 1948	4296	ab06a58820fc4737bf0f2d0964b41083_JaffaCakes118.exe	95
PID 2084 wrote to memory of 2484	2084	cmd.exe	97
PID 2084 wrote to memory of 2484	2084	cmd.exe	97
PID 2084 wrote to memory of 2484	2084	cmd.exe	97
PID 1948 wrote to memory of 2752	1948	cmd.exe	98
PID 1948 wrote to memory of 2752	1948	cmd.exe	98
PID 1948 wrote to memory of 2752	1948	cmd.exe	98
PID 4296 wrote to memory of 3632	4296	ab06a58820fc4737bf0f2d0964b41083_JaffaCakes118.exe	99
PID 4296 wrote to memory of 3632	4296	ab06a58820fc4737bf0f2d0964b41083_JaffaCakes118.exe	99
PID 4296 wrote to memory of 3632	4296	ab06a58820fc4737bf0f2d0964b41083_JaffaCakes118.exe	99
PID 4296 wrote to memory of 2524	4296	ab06a58820fc4737bf0f2d0964b41083_JaffaCakes118.exe	100
PID 4296 wrote to memory of 2524	4296	ab06a58820fc4737bf0f2d0964b41083_JaffaCakes118.exe	100
PID 4296 wrote to memory of 2524	4296	ab06a58820fc4737bf0f2d0964b41083_JaffaCakes118.exe	100
PID 2524 wrote to memory of 1308	2524	cmd.exe	102
PID 2524 wrote to memory of 1308	2524	cmd.exe	102
PID 2524 wrote to memory of 1308	2524	cmd.exe	102
PID 3632 wrote to memory of 4080	3632	svchost.exe	105
PID 3632 wrote to memory of 4080	3632	svchost.exe	105
PID 3632 wrote to memory of 4080	3632	svchost.exe	105
PID 3632 wrote to memory of 1744	3632	svchost.exe	107
PID 3632 wrote to memory of 1744	3632	svchost.exe	107
PID 3632 wrote to memory of 1744	3632	svchost.exe	107
PID 4080 wrote to memory of 3876	4080	cmd.exe	109
PID 4080 wrote to memory of 3876	4080	cmd.exe	109
PID 4080 wrote to memory of 3876	4080	cmd.exe	109
PID 1744 wrote to memory of 1564	1744	cmd.exe	110
PID 1744 wrote to memory of 1564	1744	cmd.exe	110
PID 1744 wrote to memory of 1564	1744	cmd.exe	110
PID 3632 wrote to memory of 3712	3632	svchost.exe	111
PID 3632 wrote to memory of 3712	3632	svchost.exe	111
PID 3632 wrote to memory of 3712	3632	svchost.exe	111
PID 3632 wrote to memory of 2908	3632	svchost.exe	112
PID 3632 wrote to memory of 2908	3632	svchost.exe	112
PID 3632 wrote to memory of 2908	3632	svchost.exe	112
PID 2908 wrote to memory of 388	2908	cmd.exe	114
PID 2908 wrote to memory of 388	2908	cmd.exe	114
PID 2908 wrote to memory of 388	2908	cmd.exe	114
PID 3712 wrote to memory of 2516	3712	svchost.exe	115
PID 3712 wrote to memory of 2516	3712	svchost.exe	115
PID 3712 wrote to memory of 2516	3712	svchost.exe	115
PID 3712 wrote to memory of 3560	3712	svchost.exe	117
PID 3712 wrote to memory of 3560	3712	svchost.exe	117
PID 3712 wrote to memory of 3560	3712	svchost.exe	117
PID 2516 wrote to memory of 448	2516	cmd.exe	119
PID 2516 wrote to memory of 448	2516	cmd.exe	119
PID 2516 wrote to memory of 448	2516	cmd.exe	119
PID 3560 wrote to memory of 2824	3560	cmd.exe	120
PID 3560 wrote to memory of 2824	3560	cmd.exe	120
PID 3560 wrote to memory of 2824	3560	cmd.exe	120
PID 3712 wrote to memory of 3748	3712	svchost.exe	121
PID 3712 wrote to memory of 3748	3712	svchost.exe	121
PID 3712 wrote to memory of 3748	3712	svchost.exe	121
PID 3712 wrote to memory of 2948	3712	svchost.exe	122
PID 3712 wrote to memory of 2948	3712	svchost.exe	122
PID 3712 wrote to memory of 2948	3712	svchost.exe	122
PID 2948 wrote to memory of 4356	2948	cmd.exe	124
PID 2948 wrote to memory of 4356	2948	cmd.exe	124
PID 2948 wrote to memory of 4356	2948	cmd.exe	124
PID 3748 wrote to memory of 2016	3748	svchost.exe	125

Views/modifies file attributes 1 TTPs 48 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2752	attrib.exe
1564	attrib.exe
472	attrib.exe
2576	attrib.exe
448	attrib.exe
2484	attrib.exe
1372	attrib.exe
2368	attrib.exe
2864	attrib.exe
5600	attrib.exe
2512	attrib.exe
5208	attrib.exe
6108	attrib.exe
3876	attrib.exe
2824	attrib.exe
1860	attrib.exe
1452	attrib.exe
1508	attrib.exe
6068	attrib.exe
948	attrib.exe
4304	attrib.exe
3588	attrib.exe
4244	attrib.exe
1800	attrib.exe
3504	attrib.exe
3252	attrib.exe
380	attrib.exe
1304	attrib.exe
5704	attrib.exe
3948	attrib.exe
1564	attrib.exe
5104	attrib.exe
1452	attrib.exe
1864	attrib.exe
1888	attrib.exe
3268	attrib.exe
5680	attrib.exe
5692	attrib.exe
448	attrib.exe
1368	attrib.exe
3136	attrib.exe
5796	attrib.exe
3888	attrib.exe
1564	attrib.exe
1216	attrib.exe
4316	attrib.exe
6088	attrib.exe
5792	attrib.exe

C:\Users\Admin\AppData\Local\Temp\ab06a58820fc4737bf0f2d0964b41083_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ab06a58820fc4737bf0f2d0964b41083_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4296
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\ab06a58820fc4737bf0f2d0964b41083_JaffaCakes118.exe" +s +h
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2084
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Users\Admin\AppData\Local\Temp\ab06a58820fc4737bf0f2d0964b41083_JaffaCakes118.exe" +s +h
    3⤵
    - Sets file to hidden
    - Views/modifies file attributes
    PID:2484
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1948
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
    3⤵
    - Sets file to hidden
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:2752
- C:\Windows\SysWOW64\svchost\svchost.exe
  "C:\Windows\system32\svchost\svchost.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3632
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4080
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
      4⤵
      Sets file to hidden
      Drops file in System32 directory
      Views/modifies file attributes
      PID:3876
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost" +s +h
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1744
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Windows\SysWOW64\svchost" +s +h
      4⤵
      Sets file to hidden
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:1564
- - C:\Windows\SysWOW64\svchost\svchost.exe
    "C:\Windows\system32\svchost\svchost.exe"
    3⤵
    - Modifies WinLogon for persistence
    - Checks computer location settings
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in System32 directory
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3712
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2516
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
        5⤵
        Sets file to hidden
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:448
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost" +s +h
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3560
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\svchost" +s +h
        5⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:2824
  - - C:\Windows\SysWOW64\svchost\svchost.exe
      "C:\Windows\system32\svchost\svchost.exe"
      4⤵
      Modifies WinLogon for persistence
      Checks computer location settings
      Executes dropped EXE
      Adds Run key to start application
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:3748
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2016
      - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
        6⤵
        Sets file to hidden
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:1372
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost" +s +h
        5⤵
        
        PID:760
      - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\svchost" +s +h
        6⤵
        Sets file to hidden
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:1860
    - - C:\Windows\SysWOW64\svchost\svchost.exe
        
        "C:\Windows\system32\svchost\svchost.exe"
        5⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        
        PID:3264
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3772
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
        7⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:1864
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost" +s +h
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2256
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\svchost" +s +h
        7⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:1564
      - C:\Windows\SysWOW64\svchost\svchost.exe
        
        "C:\Windows\system32\svchost\svchost.exe"
        6⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        
        PID:4568
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3064
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
        8⤵
        Sets file to hidden
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:3588
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost" +s +h
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2548
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\svchost" +s +h
        8⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:1368
        
        C:\Windows\SysWOW64\svchost\svchost.exe
        
        "C:\Windows\system32\svchost\svchost.exe"
        7⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4992
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3068
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
        9⤵
        Sets file to hidden
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:472
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost" +s +h
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4896
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\svchost" +s +h
        9⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:1564
        
        C:\Windows\SysWOW64\svchost\svchost.exe
        
        "C:\Windows\system32\svchost\svchost.exe"
        8⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4380
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:1456
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
        10⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:1452
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost" +s +h
        9⤵
        
        PID:2356
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\svchost" +s +h
        10⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:1216
        
        C:\Windows\SysWOW64\svchost\svchost.exe
        
        "C:\Windows\system32\svchost\svchost.exe"
        9⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        
        PID:3620
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
        10⤵
        
        PID:2556
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
        11⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:1888
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost" +s +h
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:4536
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\svchost" +s +h
        11⤵
        Sets file to hidden
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:4244
        
        C:\Windows\SysWOW64\svchost\svchost.exe
        
        "C:\Windows\system32\svchost\svchost.exe"
        10⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        
        PID:2484
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
        11⤵
        
        PID:1976
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
        12⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:1800
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost" +s +h
        11⤵
        
        PID:388
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\svchost" +s +h
        12⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:3504
        
        C:\Windows\SysWOW64\svchost\svchost.exe
        
        "C:\Windows\system32\svchost\svchost.exe"
        11⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        
        PID:472
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
        12⤵
        System Location Discovery: System Language Discovery
        
        PID:1564
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
        13⤵
        Sets file to hidden
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:5104
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost" +s +h
        12⤵
        System Location Discovery: System Language Discovery
        
        PID:3264
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\svchost" +s +h
        13⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:1508
        
        C:\Windows\SysWOW64\svchost\svchost.exe
        
        "C:\Windows\system32\svchost\svchost.exe"
        12⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        
        PID:1452
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
        13⤵
        System Location Discovery: System Language Discovery
        
        PID:4280
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
        14⤵
        Sets file to hidden
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:2368
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost" +s +h
        13⤵
        
        PID:5016
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\svchost" +s +h
        14⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:4316
        
        C:\Windows\SysWOW64\svchost\svchost.exe
        
        "C:\Windows\system32\svchost\svchost.exe"
        13⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2372
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
        14⤵
        
        PID:2368
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
        15⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:3136
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost" +s +h
        14⤵
        
        PID:4316
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\svchost" +s +h
        15⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:2576
        
        C:\Windows\SysWOW64\svchost\svchost.exe
        
        "C:\Windows\system32\svchost\svchost.exe"
        14⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        
        PID:2512
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
        15⤵
        
        PID:5112
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
        16⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:3252
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost" +s +h
        15⤵
        System Location Discovery: System Language Discovery
        
        PID:1796
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\svchost" +s +h
        16⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:380
        
        C:\Windows\SysWOW64\svchost\svchost.exe
        
        "C:\Windows\system32\svchost\svchost.exe"
        15⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        
        PID:5108
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
        16⤵
        
        PID:552
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
        17⤵
        Sets file to hidden
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:2864
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost" +s +h
        16⤵
        System Location Discovery: System Language Discovery
        
        PID:1864
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\svchost" +s +h
        17⤵
        Sets file to hidden
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:3268
        
        C:\Windows\SysWOW64\svchost\svchost.exe
        
        "C:\Windows\system32\svchost\svchost.exe"
        16⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        
        PID:1620
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
        17⤵
        System Location Discovery: System Language Discovery
        
        PID:5588
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
        18⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:5680
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost" +s +h
        17⤵
        
        PID:5612
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\svchost" +s +h
        18⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:5692
        
        C:\Windows\SysWOW64\svchost\svchost.exe
        
        "C:\Windows\system32\svchost\svchost.exe"
        17⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        
        PID:5708
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
        18⤵
        
        PID:5988
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
        19⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:6068
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost" +s +h
        18⤵
        System Location Discovery: System Language Discovery
        
        PID:6016
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\svchost" +s +h
        19⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:6088
        
        C:\Windows\SysWOW64\svchost\svchost.exe
        
        "C:\Windows\system32\svchost\svchost.exe"
        18⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        
        PID:6104
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
        19⤵
        System Location Discovery: System Language Discovery
        
        PID:3520
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
        20⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:448
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost" +s +h
        19⤵
        System Location Discovery: System Language Discovery
        
        PID:2664
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\svchost" +s +h
        20⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:1304
        
        C:\Windows\SysWOW64\svchost\svchost.exe
        
        "C:\Windows\system32\svchost\svchost.exe"
        19⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        
        PID:2372
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
        20⤵
        
        PID:5488
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
        21⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:5600
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost" +s +h
        20⤵
        System Location Discovery: System Language Discovery
        
        PID:5472
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\svchost" +s +h
        21⤵
        Sets file to hidden
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:5704
        
        C:\Windows\SysWOW64\svchost\svchost.exe
        
        "C:\Windows\system32\svchost\svchost.exe"
        20⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5572
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
        21⤵
        
        PID:5464
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
        22⤵
        Sets file to hidden
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:5792
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost" +s +h
        21⤵
        System Location Discovery: System Language Discovery
        
        PID:5812
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\svchost" +s +h
        22⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:5796
        
        C:\Windows\SysWOW64\svchost\svchost.exe
        
        "C:\Windows\system32\svchost\svchost.exe"
        21⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        
        PID:2308
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
        22⤵
        
        PID:5984
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
        23⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:3888
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost" +s +h
        22⤵
        
        PID:5708
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\svchost" +s +h
        23⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:1452
        
        C:\Windows\SysWOW64\svchost\svchost.exe
        
        "C:\Windows\system32\svchost\svchost.exe"
        22⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1980
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
        23⤵
        System Location Discovery: System Language Discovery
        
        PID:5664
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
        24⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:3948
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost" +s +h
        23⤵
        System Location Discovery: System Language Discovery
        
        PID:6112
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\svchost" +s +h
        24⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:948
        
        C:\Windows\SysWOW64\svchost\svchost.exe
        
        "C:\Windows\system32\svchost\svchost.exe"
        23⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        
        PID:3936
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
        24⤵
        
        PID:6052
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
        25⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:4304
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost" +s +h
        24⤵
        
        PID:1600
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\svchost" +s +h
        25⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:2512
        
        C:\Windows\SysWOW64\svchost\svchost.exe
        
        "C:\Windows\system32\svchost\svchost.exe"
        24⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:212
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
        25⤵
        
        PID:5360
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\svchost\svchost.exe" +s +h
        26⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:6108
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\svchost" +s +h
        25⤵
        
        PID:5152
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\svchost" +s +h
        26⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:5208
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\svchost\svchost.exe"
        24⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:5192
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 5
        25⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4556
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\svchost\svchost.exe"
        23⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:1844
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 5
        24⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4460
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\svchost\svchost.exe"
        22⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:5156
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 5
        23⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:6116
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\svchost\svchost.exe"
        21⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:4488
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 5
        22⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5936
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\svchost\svchost.exe"
        20⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:3036
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 5
        21⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5840
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\svchost\svchost.exe"
        19⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:3960
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 5
        20⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5288
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\svchost\svchost.exe"
        18⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:6124
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 5
        19⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5164
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\svchost\svchost.exe"
        17⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:5720
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 5
        18⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5780
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\svchost\svchost.exe"
        16⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:4412
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 5
        17⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2736
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\svchost\svchost.exe"
        15⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:3136
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 5
        16⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:444
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\svchost\svchost.exe"
        14⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:3720
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 5
        15⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:552
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\svchost\svchost.exe"
        13⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:3596
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 5
        14⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1760
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\svchost\svchost.exe"
        12⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:1100
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 5
        13⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1972
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\svchost\svchost.exe"
        11⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:3980
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 5
        12⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3620
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\svchost\svchost.exe"
        10⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:2960
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 5
        11⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2824
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\svchost\svchost.exe"
        9⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:4568
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 5
        10⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1800
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\svchost\svchost.exe"
        8⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:4824
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 5
        9⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:232
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\svchost\svchost.exe"
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:4616
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 5
        8⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3600
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\svchost\svchost.exe"
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:4832
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 5
        7⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4516
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\svchost\svchost.exe"
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:3272
      - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 5
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:944
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\svchost\svchost.exe"
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Suspicious use of WriteProcessMemory
      PID:2948
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 5
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4356
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\svchost\svchost.exe"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:2908
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 5
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:388
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Users\Admin\AppData\Local\Temp\ab06a58820fc4737bf0f2d0964b41083_JaffaCakes118.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:2524
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 5
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\svchost\svchost.exe

Filesize
747KB

MD5
ab06a58820fc4737bf0f2d0964b41083

SHA1
efd19604663c07542ffee9101ef78a1c072ffe05

SHA256
22958ccd515d58690de6f31678ad466571318066c63bb714154e724010a94eb0

SHA512
4eb76333d568392dd16733d6acecb16a49eeaf601534b6364f84ddb93eb890ae527dde81400cd23094c3f9d39023e41403b64b458fe7d4417179c21c24abf9f0

Download Submit
memory/472-55-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/1452-57-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/1620-65-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/1980-77-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/2308-75-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/2372-71-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/2372-59-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/2484-53-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/2512-61-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/3264-43-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/3620-51-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/3632-37-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/3712-39-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/3748-41-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/3936-79-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/4296-0-0x00000000006A0000-0x00000000006A1000-memory.dmp

Filesize
4KB

Download
memory/4296-35-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/4380-49-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/4568-45-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/4992-47-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/5108-63-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/5572-73-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/5708-67-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/6104-69-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads