darkcomet | 78fcdb31d09e8d94d4f2430c173e14154fc23ef7d6b07c07b361f22d5d206dda

Analysis

max time kernel
149s
max time network
16s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
13/10/2024, 19:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

41c924bdfbcec073004da66ff4010654_JaffaCakes118.exe
Size

732KB
MD5

41c924bdfbcec073004da66ff4010654
SHA1

abd7f33cebe160bb86384e9c4db77788cc51407c
SHA256

78fcdb31d09e8d94d4f2430c173e14154fc23ef7d6b07c07b361f22d5d206dda
SHA512

3b56eb4002a703fbcfcf3cae9a93a4a6f9676eddbc26304968a64f976b95b671cfbb8e43c1367ddbf9d22961d0c1791816ef193c0b597388e9f14d249866590e
SSDEEP

12288:R4dMRU/UP4heFjLDFtooSzUXZRY49SA7GI/p7a6o2Mhi9JHFRn/c0DYz29Ny:awU/UwhWv/XZpSRSJo2xT9c08aPy

Score

10^/10

darkcomet discovery evasion persistence rat trojan upx

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies WinLogon for persistence 2 TTPs 24 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe"	svchost.exe

Sets file to hidden 1 TTPs 48 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
1576	attrib.exe
2344	attrib.exe
2680	attrib.exe
1316	attrib.exe
1748	attrib.exe
1908	attrib.exe
1360	attrib.exe
1592	attrib.exe
860	attrib.exe
1736	attrib.exe
2692	attrib.exe
2812	attrib.exe
2444	attrib.exe
860	attrib.exe
2748	attrib.exe
2524	attrib.exe
2364	attrib.exe
1788	attrib.exe
1744	attrib.exe
2144	attrib.exe
2128	attrib.exe
1452	attrib.exe
2040	attrib.exe
2080	attrib.exe
780	attrib.exe
2876	attrib.exe
2644	attrib.exe
868	attrib.exe
1748	attrib.exe
1512	attrib.exe
2480	attrib.exe
980	attrib.exe
2872	attrib.exe
1512	attrib.exe
1936	attrib.exe
1916	attrib.exe
2800	attrib.exe
2732	attrib.exe
2548	attrib.exe
1912	attrib.exe
2440	attrib.exe
2668	attrib.exe
2252	attrib.exe
1132	attrib.exe
1312	attrib.exe
3024	attrib.exe
2716	attrib.exe
1440	attrib.exe

Executes dropped EXE 25 IoCs

pid	Process
2884	7za.exe
824	Server.exe
2960	svchost.exe
2288	svchost.exe
2992	svchost.exe
2040	svchost.exe
2000	svchost.exe
1368	svchost.exe
2776	svchost.exe
2648	svchost.exe
2416	svchost.exe
2980	svchost.exe
2040	svchost.exe
2112	svchost.exe
2640	svchost.exe
2560	svchost.exe
980	svchost.exe
916	svchost.exe
2376	svchost.exe
2984	svchost.exe
2296	svchost.exe
1652	svchost.exe
772	svchost.exe
2876	svchost.exe
1316	svchost.exe

Loads dropped DLL 50 IoCs

pid	Process
3000	cmd.exe
3000	cmd.exe
376	41c924bdfbcec073004da66ff4010654_JaffaCakes118.exe
376	41c924bdfbcec073004da66ff4010654_JaffaCakes118.exe
824	Server.exe
824	Server.exe
2960	svchost.exe
2960	svchost.exe
2288	svchost.exe
2288	svchost.exe
2992	svchost.exe
2992	svchost.exe
2040	svchost.exe
2040	svchost.exe
2000	svchost.exe
2000	svchost.exe
1368	svchost.exe
1368	svchost.exe
2776	svchost.exe
2776	svchost.exe
2648	svchost.exe
2648	svchost.exe
2416	svchost.exe
2416	svchost.exe
2980	svchost.exe
2980	svchost.exe
2040	svchost.exe
2040	svchost.exe
2112	svchost.exe
2112	svchost.exe
2640	svchost.exe
2640	svchost.exe
2560	svchost.exe
2560	svchost.exe
980	svchost.exe
980	svchost.exe
916	svchost.exe
916	svchost.exe
2376	svchost.exe
2376	svchost.exe
2984	svchost.exe
2984	svchost.exe
2296	svchost.exe
2296	svchost.exe
1652	svchost.exe
1652	svchost.exe
772	svchost.exe
772	svchost.exe
2876	svchost.exe
2876	svchost.exe

Adds Run key to start application 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\svchost.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\svchost.exe"	svchost.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Windupdt\svchost.exe	svchost.exe
File created	C:\Windows\SysWOW64\Windupdt\svchost.exe	svchost.exe
File created	C:\Windows\SysWOW64\Windupdt\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\svchost.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\svchost.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\	svchost.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\	svchost.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\svchost.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\	svchost.exe
File created	C:\Windows\SysWOW64\Windupdt\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\	svchost.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\	svchost.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\svchost.exe	attrib.exe
File created	C:\Windows\SysWOW64\Windupdt\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\	svchost.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\svchost.exe	attrib.exe
File created	C:\Windows\SysWOW64\Windupdt\svchost.exe	svchost.exe
File created	C:\Windows\SysWOW64\Windupdt\svchost.exe	svchost.exe
File created	C:\Windows\SysWOW64\Windupdt\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\svchost.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\svchost.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\svchost.exe	svchost.exe
File created	C:\Windows\SysWOW64\Windupdt\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\	svchost.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\svchost.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\	svchost.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\svchost.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\	svchost.exe
File created	C:\Windows\SysWOW64\Windupdt\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\	svchost.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\svchost.exe	attrib.exe
File created	C:\Windows\SysWOW64\Windupdt\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\	svchost.exe
File created	C:\Windows\SysWOW64\Windupdt\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\	svchost.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\svchost.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\svchost.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\svchost.exe	attrib.exe
File created	C:\Windows\SysWOW64\Windupdt\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\	svchost.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\svchost.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\svchost.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\svchost.exe	attrib.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/376-0-0x0000000000400000-0x0000000000474000-memory.dmp	upx
behavioral1/memory/376-24-0x0000000000400000-0x0000000000474000-memory.dmp	upx
behavioral1/memory/376-39-0x0000000000400000-0x0000000000474000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7za.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 48 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1480	cmd.exe
1976	cmd.exe
2592	cmd.exe
2804	cmd.exe
1644	cmd.exe
1436	cmd.exe
1596	PING.EXE
2612	cmd.exe
1984	PING.EXE
1992	cmd.exe
2360	cmd.exe
1736	PING.EXE
2448	cmd.exe
2336	cmd.exe
2440	PING.EXE
1132	PING.EXE
2920	cmd.exe
2220	cmd.exe
1920	cmd.exe
2108	PING.EXE
2524	PING.EXE
1980	cmd.exe
2680	cmd.exe
2876	PING.EXE
2216	cmd.exe
2740	cmd.exe
2440	PING.EXE
2876	cmd.exe
1460	cmd.exe
1224	PING.EXE
1224	PING.EXE
2824	PING.EXE
556	PING.EXE
1180	cmd.exe
2452	PING.EXE
1260	PING.EXE
544	cmd.exe
1600	PING.EXE
1748	PING.EXE
3016	PING.EXE
2540	cmd.exe
376	PING.EXE
2992	PING.EXE
1764	PING.EXE
1640	cmd.exe
1996	PING.EXE
1528	PING.EXE
1744	PING.EXE

Runs ping.exe 1 TTPs 24 IoCs

Remote System Discovery

T1018

pid	Process
1984	PING.EXE
1600	PING.EXE
2992	PING.EXE
1528	PING.EXE
2452	PING.EXE
2524	PING.EXE
1260	PING.EXE
1764	PING.EXE
2440	PING.EXE
1132	PING.EXE
2824	PING.EXE
376	PING.EXE
2108	PING.EXE
1744	PING.EXE
2876	PING.EXE
1748	PING.EXE
1736	PING.EXE
1224	PING.EXE
2440	PING.EXE
1996	PING.EXE
1224	PING.EXE
556	PING.EXE
3016	PING.EXE
1596	PING.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	824	Server.exe
Token: SeSecurityPrivilege	824	Server.exe
Token: SeTakeOwnershipPrivilege	824	Server.exe
Token: SeLoadDriverPrivilege	824	Server.exe
Token: SeSystemProfilePrivilege	824	Server.exe
Token: SeSystemtimePrivilege	824	Server.exe
Token: SeProfSingleProcessPrivilege	824	Server.exe
Token: SeIncBasePriorityPrivilege	824	Server.exe
Token: SeCreatePagefilePrivilege	824	Server.exe
Token: SeBackupPrivilege	824	Server.exe
Token: SeRestorePrivilege	824	Server.exe
Token: SeShutdownPrivilege	824	Server.exe
Token: SeDebugPrivilege	824	Server.exe
Token: SeSystemEnvironmentPrivilege	824	Server.exe
Token: SeChangeNotifyPrivilege	824	Server.exe
Token: SeRemoteShutdownPrivilege	824	Server.exe
Token: SeUndockPrivilege	824	Server.exe
Token: SeManageVolumePrivilege	824	Server.exe
Token: SeImpersonatePrivilege	824	Server.exe
Token: SeCreateGlobalPrivilege	824	Server.exe
Token: 33	824	Server.exe
Token: 34	824	Server.exe
Token: 35	824	Server.exe
Token: SeIncreaseQuotaPrivilege	2960	svchost.exe
Token: SeSecurityPrivilege	2960	svchost.exe
Token: SeTakeOwnershipPrivilege	2960	svchost.exe
Token: SeLoadDriverPrivilege	2960	svchost.exe
Token: SeSystemProfilePrivilege	2960	svchost.exe
Token: SeSystemtimePrivilege	2960	svchost.exe
Token: SeProfSingleProcessPrivilege	2960	svchost.exe
Token: SeIncBasePriorityPrivilege	2960	svchost.exe
Token: SeCreatePagefilePrivilege	2960	svchost.exe
Token: SeBackupPrivilege	2960	svchost.exe
Token: SeRestorePrivilege	2960	svchost.exe
Token: SeShutdownPrivilege	2960	svchost.exe
Token: SeDebugPrivilege	2960	svchost.exe
Token: SeSystemEnvironmentPrivilege	2960	svchost.exe
Token: SeChangeNotifyPrivilege	2960	svchost.exe
Token: SeRemoteShutdownPrivilege	2960	svchost.exe
Token: SeUndockPrivilege	2960	svchost.exe
Token: SeManageVolumePrivilege	2960	svchost.exe
Token: SeImpersonatePrivilege	2960	svchost.exe
Token: SeCreateGlobalPrivilege	2960	svchost.exe
Token: 33	2960	svchost.exe
Token: 34	2960	svchost.exe
Token: 35	2960	svchost.exe
Token: SeIncreaseQuotaPrivilege	2288	svchost.exe
Token: SeSecurityPrivilege	2288	svchost.exe
Token: SeTakeOwnershipPrivilege	2288	svchost.exe
Token: SeLoadDriverPrivilege	2288	svchost.exe
Token: SeSystemProfilePrivilege	2288	svchost.exe
Token: SeSystemtimePrivilege	2288	svchost.exe
Token: SeProfSingleProcessPrivilege	2288	svchost.exe
Token: SeIncBasePriorityPrivilege	2288	svchost.exe
Token: SeCreatePagefilePrivilege	2288	svchost.exe
Token: SeBackupPrivilege	2288	svchost.exe
Token: SeRestorePrivilege	2288	svchost.exe
Token: SeShutdownPrivilege	2288	svchost.exe
Token: SeDebugPrivilege	2288	svchost.exe
Token: SeSystemEnvironmentPrivilege	2288	svchost.exe
Token: SeChangeNotifyPrivilege	2288	svchost.exe
Token: SeRemoteShutdownPrivilege	2288	svchost.exe
Token: SeUndockPrivilege	2288	svchost.exe
Token: SeManageVolumePrivilege	2288	svchost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 376 wrote to memory of 3000	376	41c924bdfbcec073004da66ff4010654_JaffaCakes118.exe	30
PID 376 wrote to memory of 3000	376	41c924bdfbcec073004da66ff4010654_JaffaCakes118.exe	30
PID 376 wrote to memory of 3000	376	41c924bdfbcec073004da66ff4010654_JaffaCakes118.exe	30
PID 376 wrote to memory of 3000	376	41c924bdfbcec073004da66ff4010654_JaffaCakes118.exe	30
PID 3000 wrote to memory of 2884	3000	cmd.exe	32
PID 3000 wrote to memory of 2884	3000	cmd.exe	32
PID 3000 wrote to memory of 2884	3000	cmd.exe	32
PID 3000 wrote to memory of 2884	3000	cmd.exe	32
PID 376 wrote to memory of 824	376	41c924bdfbcec073004da66ff4010654_JaffaCakes118.exe	33
PID 376 wrote to memory of 824	376	41c924bdfbcec073004da66ff4010654_JaffaCakes118.exe	33
PID 376 wrote to memory of 824	376	41c924bdfbcec073004da66ff4010654_JaffaCakes118.exe	33
PID 376 wrote to memory of 824	376	41c924bdfbcec073004da66ff4010654_JaffaCakes118.exe	33
PID 824 wrote to memory of 2756	824	Server.exe	34
PID 824 wrote to memory of 2756	824	Server.exe	34
PID 824 wrote to memory of 2756	824	Server.exe	34
PID 824 wrote to memory of 2756	824	Server.exe	34
PID 824 wrote to memory of 2860	824	Server.exe	35
PID 824 wrote to memory of 2860	824	Server.exe	35
PID 824 wrote to memory of 2860	824	Server.exe	35
PID 824 wrote to memory of 2860	824	Server.exe	35
PID 2756 wrote to memory of 2644	2756	cmd.exe	39
PID 2756 wrote to memory of 2644	2756	cmd.exe	39
PID 2756 wrote to memory of 2644	2756	cmd.exe	39
PID 2756 wrote to memory of 2644	2756	cmd.exe	39
PID 2860 wrote to memory of 2732	2860	cmd.exe	38
PID 2860 wrote to memory of 2732	2860	cmd.exe	38
PID 2860 wrote to memory of 2732	2860	cmd.exe	38
PID 2860 wrote to memory of 2732	2860	cmd.exe	38
PID 824 wrote to memory of 2960	824	Server.exe	40
PID 824 wrote to memory of 2960	824	Server.exe	40
PID 824 wrote to memory of 2960	824	Server.exe	40
PID 824 wrote to memory of 2960	824	Server.exe	40
PID 824 wrote to memory of 2612	824	Server.exe	41
PID 824 wrote to memory of 2612	824	Server.exe	41
PID 824 wrote to memory of 2612	824	Server.exe	41
PID 824 wrote to memory of 2612	824	Server.exe	41
PID 2612 wrote to memory of 2876	2612	cmd.exe	43
PID 2612 wrote to memory of 2876	2612	cmd.exe	43
PID 2612 wrote to memory of 2876	2612	cmd.exe	43
PID 2612 wrote to memory of 2876	2612	cmd.exe	43
PID 2960 wrote to memory of 452	2960	svchost.exe	44
PID 2960 wrote to memory of 452	2960	svchost.exe	44
PID 2960 wrote to memory of 452	2960	svchost.exe	44
PID 2960 wrote to memory of 452	2960	svchost.exe	44
PID 2960 wrote to memory of 1168	2960	svchost.exe	46
PID 2960 wrote to memory of 1168	2960	svchost.exe	46
PID 2960 wrote to memory of 1168	2960	svchost.exe	46
PID 2960 wrote to memory of 1168	2960	svchost.exe	46
PID 452 wrote to memory of 1360	452	cmd.exe	48
PID 452 wrote to memory of 1360	452	cmd.exe	48
PID 452 wrote to memory of 1360	452	cmd.exe	48
PID 452 wrote to memory of 1360	452	cmd.exe	48
PID 1168 wrote to memory of 1512	1168	cmd.exe	49
PID 1168 wrote to memory of 1512	1168	cmd.exe	49
PID 1168 wrote to memory of 1512	1168	cmd.exe	49
PID 1168 wrote to memory of 1512	1168	cmd.exe	49
PID 2960 wrote to memory of 2288	2960	svchost.exe	50
PID 2960 wrote to memory of 2288	2960	svchost.exe	50
PID 2960 wrote to memory of 2288	2960	svchost.exe	50
PID 2960 wrote to memory of 2288	2960	svchost.exe	50
PID 2960 wrote to memory of 1976	2960	svchost.exe	51
PID 2960 wrote to memory of 1976	2960	svchost.exe	51
PID 2960 wrote to memory of 1976	2960	svchost.exe	51
PID 2960 wrote to memory of 1976	2960	svchost.exe	51

Views/modifies file attributes 1 TTPs 48 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
1748	attrib.exe
1512	attrib.exe
2344	attrib.exe
2800	attrib.exe
2716	attrib.exe
2080	attrib.exe
1316	attrib.exe
1912	attrib.exe
868	attrib.exe
2692	attrib.exe
2872	attrib.exe
1452	attrib.exe
1312	attrib.exe
2748	attrib.exe
1908	attrib.exe
2524	attrib.exe
2440	attrib.exe
2444	attrib.exe
2128	attrib.exe
1512	attrib.exe
2040	attrib.exe
1744	attrib.exe
2732	attrib.exe
2876	attrib.exe
860	attrib.exe
2252	attrib.exe
1916	attrib.exe
1592	attrib.exe
1788	attrib.exe
1736	attrib.exe
1440	attrib.exe
1132	attrib.exe
2548	attrib.exe
1748	attrib.exe
2812	attrib.exe
1576	attrib.exe
1936	attrib.exe
2644	attrib.exe
1360	attrib.exe
2144	attrib.exe
2364	attrib.exe
980	attrib.exe
860	attrib.exe
2680	attrib.exe
2480	attrib.exe
2668	attrib.exe
3024	attrib.exe
780	attrib.exe

C:\Users\Admin\AppData\Local\Temp\41c924bdfbcec073004da66ff4010654_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\41c924bdfbcec073004da66ff4010654_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:376
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\7za.exe" "x" "-y" "C:\Users\Admin\AppData\Roaming\Server.7z" "-pHVLnt5Dy""
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:3000
- - C:\Users\Admin\AppData\Roaming\7za.exe
    "C:\Users\Admin\AppData\Roaming\7za.exe" "x" "-y" "C:\Users\Admin\AppData\Roaming\Server.7z" "-pHVLnt5Dy"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2884
- C:\Users\Admin\AppData\Roaming\Server.exe
  C:\Users\Admin\AppData\Roaming\Server.exe
  2⤵
  - Modifies WinLogon for persistence
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:824
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Roaming\Server.exe" +s +h
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2756
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Users\Admin\AppData\Roaming\Server.exe" +s +h
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:2644
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Roaming" +s +h
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2860
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Users\Admin\AppData\Roaming" +s +h
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:2732
- - C:\Windows\SysWOW64\Windupdt\svchost.exe
    "C:\Windows\system32\Windupdt\svchost.exe"
    3⤵
    - Modifies WinLogon for persistence
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Drops file in System32 directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2960
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Windupdt\svchost.exe" +s +h
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:452
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\svchost.exe" +s +h
        5⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:1360
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Windupdt" +s +h
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1168
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        5⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:1512
  - - C:\Windows\SysWOW64\Windupdt\svchost.exe
      "C:\Windows\system32\Windupdt\svchost.exe"
      4⤵
      Modifies WinLogon for persistence
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in System32 directory
      Suspicious use of AdjustPrivilegeToken
      PID:2288
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Windupdt\svchost.exe" +s +h
        5⤵
        
        PID:1932
      - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\svchost.exe" +s +h
        6⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:2480
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        5⤵
        
        PID:1392
      - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        6⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:2692
    - - C:\Windows\SysWOW64\Windupdt\svchost.exe
        
        "C:\Windows\system32\Windupdt\svchost.exe"
        5⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2992
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Windupdt\svchost.exe" +s +h
        6⤵
        
        PID:3040
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\svchost.exe" +s +h
        7⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:2144
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2212
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        7⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:2364
      - C:\Windows\SysWOW64\Windupdt\svchost.exe
        
        "C:\Windows\system32\Windupdt\svchost.exe"
        6⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:2040
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Windupdt\svchost.exe" +s +h
        7⤵
        
        PID:920
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\svchost.exe" +s +h
        8⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:980
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2968
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        8⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:2812
        
        C:\Windows\SysWOW64\Windupdt\svchost.exe
        
        "C:\Windows\system32\Windupdt\svchost.exe"
        7⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:2000
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Windupdt\svchost.exe" +s +h
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1080
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\svchost.exe" +s +h
        9⤵
        Sets file to hidden
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:1440
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3052
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        9⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:1576
        
        C:\Windows\SysWOW64\Windupdt\svchost.exe
        
        "C:\Windows\system32\Windupdt\svchost.exe"
        8⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1368
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Windupdt\svchost.exe" +s +h
        9⤵
        
        PID:2008
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\svchost.exe" +s +h
        10⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:2252
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:1572
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        10⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:2444
        
        C:\Windows\SysWOW64\Windupdt\svchost.exe
        
        "C:\Windows\system32\Windupdt\svchost.exe"
        9⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2776
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Windupdt\svchost.exe" +s +h
        10⤵
        
        PID:2044
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\svchost.exe" +s +h
        11⤵
        Sets file to hidden
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:2872
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        10⤵
        
        PID:2760
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        11⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:2128
        
        C:\Windows\SysWOW64\Windupdt\svchost.exe
        
        "C:\Windows\system32\Windupdt\svchost.exe"
        10⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2648
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Windupdt\svchost.exe" +s +h
        11⤵
        
        PID:1448
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\svchost.exe" +s +h
        12⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:1512
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        11⤵
        
        PID:2408
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        12⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:1936
        
        C:\Windows\SysWOW64\Windupdt\svchost.exe
        
        "C:\Windows\system32\Windupdt\svchost.exe"
        11⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2416
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Windupdt\svchost.exe" +s +h
        12⤵
        System Location Discovery: System Language Discovery
        
        PID:1948
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\svchost.exe" +s +h
        13⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:1916
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        12⤵
        System Location Discovery: System Language Discovery
        
        PID:2892
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        13⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:1132
        
        C:\Windows\SysWOW64\Windupdt\svchost.exe
        
        "C:\Windows\system32\Windupdt\svchost.exe"
        12⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2980
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Windupdt\svchost.exe" +s +h
        13⤵
        System Location Discovery: System Language Discovery
        
        PID:2176
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\svchost.exe" +s +h
        14⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:2344
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        13⤵
        System Location Discovery: System Language Discovery
        
        PID:2528
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        14⤵
        Sets file to hidden
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:1452
        
        C:\Windows\SysWOW64\Windupdt\svchost.exe
        
        "C:\Windows\system32\Windupdt\svchost.exe"
        13⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2040
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Windupdt\svchost.exe" +s +h
        14⤵
        
        PID:1440
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\svchost.exe" +s +h
        15⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:1312
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        14⤵
        
        PID:2352
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        15⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:860
        
        C:\Windows\SysWOW64\Windupdt\svchost.exe
        
        "C:\Windows\system32\Windupdt\svchost.exe"
        14⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2112
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Windupdt\svchost.exe" +s +h
        15⤵
        
        PID:2700
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\svchost.exe" +s +h
        16⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:2668
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        15⤵
        
        PID:2808
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        16⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:2800
        
        C:\Windows\SysWOW64\Windupdt\svchost.exe
        
        "C:\Windows\system32\Windupdt\svchost.exe"
        15⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        
        PID:2640
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Windupdt\svchost.exe" +s +h
        16⤵
        
        PID:2460
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\svchost.exe" +s +h
        17⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:1592
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        16⤵
        
        PID:2072
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        17⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:2680
        
        C:\Windows\SysWOW64\Windupdt\svchost.exe
        
        "C:\Windows\system32\Windupdt\svchost.exe"
        16⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2560
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Windupdt\svchost.exe" +s +h
        17⤵
        
        PID:2260
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\svchost.exe" +s +h
        18⤵
        Sets file to hidden
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:3024
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        17⤵
        System Location Discovery: System Language Discovery
        
        PID:3008
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        18⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:2748
        
        C:\Windows\SysWOW64\Windupdt\svchost.exe
        
        "C:\Windows\system32\Windupdt\svchost.exe"
        17⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:980
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Windupdt\svchost.exe" +s +h
        18⤵
        System Location Discovery: System Language Discovery
        
        PID:1476
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\svchost.exe" +s +h
        19⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:2040
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        18⤵
        
        PID:820
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        19⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:1316
        
        C:\Windows\SysWOW64\Windupdt\svchost.exe
        
        "C:\Windows\system32\Windupdt\svchost.exe"
        18⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:916
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Windupdt\svchost.exe" +s +h
        19⤵
        
        PID:2688
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\svchost.exe" +s +h
        20⤵
        Sets file to hidden
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:2716
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        19⤵
        
        PID:2120
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        20⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:2548
        
        C:\Windows\SysWOW64\Windupdt\svchost.exe
        
        "C:\Windows\system32\Windupdt\svchost.exe"
        19⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:2376
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Windupdt\svchost.exe" +s +h
        20⤵
        
        PID:1512
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\svchost.exe" +s +h
        21⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:2080
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        20⤵
        System Location Discovery: System Language Discovery
        
        PID:2552
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        21⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:1744
        
        C:\Windows\SysWOW64\Windupdt\svchost.exe
        
        "C:\Windows\system32\Windupdt\svchost.exe"
        20⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:2984
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Windupdt\svchost.exe" +s +h
        21⤵
        
        PID:2268
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\svchost.exe" +s +h
        22⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:1748
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        21⤵
        
        PID:1516
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        22⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:780
        
        C:\Windows\SysWOW64\Windupdt\svchost.exe
        
        "C:\Windows\system32\Windupdt\svchost.exe"
        21⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:2296
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Windupdt\svchost.exe" +s +h
        22⤵
        
        PID:2304
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\svchost.exe" +s +h
        23⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:1912
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        22⤵
        System Location Discovery: System Language Discovery
        
        PID:2888
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        23⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:2876
        
        C:\Windows\SysWOW64\Windupdt\svchost.exe
        
        "C:\Windows\system32\Windupdt\svchost.exe"
        22⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:1652
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Windupdt\svchost.exe" +s +h
        23⤵
        
        PID:2376
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\svchost.exe" +s +h
        24⤵
        Sets file to hidden
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:1748
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        23⤵
        
        PID:2016
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        24⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:860
        
        C:\Windows\SysWOW64\Windupdt\svchost.exe
        
        "C:\Windows\system32\Windupdt\svchost.exe"
        23⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:772
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Windupdt\svchost.exe" +s +h
        24⤵
        
        PID:1764
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\svchost.exe" +s +h
        25⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:2440
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        24⤵
        
        PID:764
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        25⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:868
        
        C:\Windows\SysWOW64\Windupdt\svchost.exe
        
        "C:\Windows\system32\Windupdt\svchost.exe"
        24⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2876
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Windupdt\svchost.exe" +s +h
        25⤵
        
        PID:1528
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\svchost.exe" +s +h
        26⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:1788
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        25⤵
        System Location Discovery: System Language Discovery
        
        PID:860
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        26⤵
        Sets file to hidden
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:1908
        
        C:\Windows\SysWOW64\Windupdt\svchost.exe
        
        "C:\Windows\system32\Windupdt\svchost.exe"
        25⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:1316
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Windupdt\svchost.exe" +s +h
        26⤵
        
        PID:1744
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\svchost.exe" +s +h
        27⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:2524
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        26⤵
        
        PID:1592
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        27⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:1736
        
        C:\Windows\SysWOW64\Windupdt\svchost.exe
        
        "C:\Windows\system32\Windupdt\svchost.exe"
        26⤵
        
        PID:1340
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\Windupdt\svchost.exe"
        26⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:2876
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 5
        27⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2440
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\Windupdt\svchost.exe"
        25⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:1640
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 5
        26⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2440
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\Windupdt\svchost.exe"
        24⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:2540
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 5
        25⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1744
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\Windupdt\svchost.exe"
        23⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:2336
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 5
        24⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1596
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\Windupdt\svchost.exe"
        22⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:2680
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 5
        23⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3016
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\Windupdt\svchost.exe"
        21⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:2448
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 5
        22⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1764
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\Windupdt\svchost.exe"
        20⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:1980
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 5
        21⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1260
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\Windupdt\svchost.exe"
        19⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:1436
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 5
        20⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2524
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\Windupdt\svchost.exe"
        18⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:1480
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 5
        19⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2452
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\Windupdt\svchost.exe"
        17⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:1180
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 5
        18⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1528
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\Windupdt\svchost.exe"
        16⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:1644
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 5
        17⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1224
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\Windupdt\svchost.exe"
        15⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:2804
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 5
        16⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2108
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\Windupdt\svchost.exe"
        14⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:1992
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 5
        15⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:556
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\Windupdt\svchost.exe"
        13⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:2360
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 5
        14⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1736
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\Windupdt\svchost.exe"
        12⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:2220
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 5
        13⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2992
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\Windupdt\svchost.exe"
        11⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:1920
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 5
        12⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1224
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\Windupdt\svchost.exe"
        10⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:2592
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 5
        11⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:376
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\Windupdt\svchost.exe"
        9⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:2740
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 5
        10⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2824
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\Windupdt\svchost.exe"
        8⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:2920
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 5
        9⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1996
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\Windupdt\svchost.exe"
        7⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:1460
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 5
        8⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1748
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\Windupdt\svchost.exe"
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:2216
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 5
        7⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1600
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\Windupdt\svchost.exe"
        5⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:544
      - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 5
        6⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1132
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\Windupdt\svchost.exe"
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:1976
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 5
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1984
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Users\Admin\AppData\Roaming\Server.exe"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:2612
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 5
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\7za.exe

Filesize
574KB

MD5
42badc1d2f03a8b1e4875740d3d49336

SHA1
cee178da1fb05f99af7a3547093122893bd1eb46

SHA256
c136b1467d669a725478a6110ebaaab3cb88a3d389dfa688e06173c066b76fcf

SHA512
6bc519a7368ee6bd8c8f69f2d634dd18799b4ca31fbc284d2580ba625f3a88b6a52d2bc17bea0e75e63ca11c10356c47ee00c2c500294abcb5141424fc5dc71c

Download Submit
C:\Users\Admin\AppData\Roaming\Server.7z

Filesize
224KB

MD5
73bd60ded28c2d96e8c3dd264c0d1722

SHA1
5b8311f22928366069d76bf63f69b49b4999c673

SHA256
3e185059a20b71dc12ce5489012ae0cd63246d7ed593853f269d7b3685273d64

SHA512
5e6c00598475e3185028dc7980da4e97e600e64bfc1e5b492f87d8fc4029265d3c5209438d470b0be0982b0d3d08ca11ce2a57a06125330e8ddc53535cef8031

Download Submit
C:\Users\Admin\AppData\Roaming\Server.exe

Filesize
226KB

MD5
339d416cc9228b8767fab174ef22c36d

SHA1
4f02beb635f08ae389d55cbc54b9c9cc01d3dcc2

SHA256
ebb17542e1484b5cfd421f03662da89630db1e2dca7fce1c54f0c8e53a1c29d5

SHA512
a39f8497a7426663788b4b140f78912ea2bc342c7aa09440c90fe06b7afd8feee49c4ab52b4e37941d0c0ced68bf948e3c466e0ae873b8917a02ff666a9128b2

Download Submit
memory/376-39-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/376-19-0x0000000002F70000-0x0000000003027000-memory.dmp

Filesize
732KB

Download
memory/376-0-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/376-17-0x0000000002F70000-0x0000000003027000-memory.dmp

Filesize
732KB

Download
memory/376-24-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/772-140-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/772-138-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/824-18-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/824-35-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/824-36-0x00000000001D0000-0x00000000001D3000-memory.dmp

Filesize
12KB

Download
memory/824-21-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/824-20-0x00000000001D0000-0x00000000001D3000-memory.dmp

Filesize
12KB

Download
memory/916-124-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/980-122-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/1316-148-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/1316-145-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/1316-146-0x0000000004480000-0x0000000004537000-memory.dmp

Filesize
732KB

Download
memory/1368-70-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/1368-75-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/1652-135-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/1652-137-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2000-64-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2000-68-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2040-98-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2040-63-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2040-104-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2112-110-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2112-102-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2288-53-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2288-50-0x0000000004540000-0x00000000045F7000-memory.dmp

Filesize
732KB

Download
memory/2288-47-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2296-132-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2296-134-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2376-127-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2376-125-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2416-90-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2560-120-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2560-118-0x0000000004750000-0x0000000004807000-memory.dmp

Filesize
732KB

Download
memory/2640-116-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2640-112-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2648-85-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2648-81-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2776-80-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2876-142-0x0000000005D80000-0x0000000005E37000-memory.dmp

Filesize
732KB

Download
memory/2876-141-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2876-144-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2960-43-0x00000000046F0000-0x00000000047A7000-memory.dmp

Filesize
732KB

Download
memory/2960-44-0x00000000046F0000-0x00000000047A7000-memory.dmp

Filesize
732KB

Download
memory/2960-45-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2960-37-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2980-96-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2980-95-0x0000000004610000-0x00000000046C7000-memory.dmp

Filesize
732KB

Download
memory/2984-129-0x0000000004540000-0x00000000045F7000-memory.dmp

Filesize
732KB

Download
memory/2984-131-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2984-128-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2992-57-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads