darkcomet | 4a01ae30245547e732dee65c67e8920e592beb370aeac21cba2f3aee44cbfbda

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
22/10/2024, 02:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

688e981a04241a918aac97054357008b_JaffaCakes118.exe
Size

1.4MB
MD5

688e981a04241a918aac97054357008b
SHA1

a144325ed430fbfb70d32e4830594dc9470af5c2
SHA256

4a01ae30245547e732dee65c67e8920e592beb370aeac21cba2f3aee44cbfbda
SHA512

277b9bf9c73d3e56cdc3299d89627438ade20612bd1c2367666682cd3648051a5154859d47e0c824f2b172b7066630c82128d87527e582c6907fc0e06cf3d382
SSDEEP

24576:YeHe8fAIwgw4lAAx9BhmroAGKmErF5HTMHHkeDz4GsiiSVTcon/lwNy9OIUcYH2u:YeHe8fAIwgw4lAAx9BhmnmAzEkoEondY

Score

10^/10

darkcomet discovery evasion persistence rat trojan

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	688e981a04241a918aac97054357008b_JaffaCakes118.exe

Sets file to hidden 1 TTPs 2 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
2032	attrib.exe
2932	attrib.exe

Executes dropped EXE 2 IoCs

pid	Process
2140	archivoMZ
2620	msdcsc.exe

Loads dropped DLL 6 IoCs

pid	Process
2140	archivoMZ
2140	archivoMZ
2140	archivoMZ
1084	688e981a04241a918aac97054357008b_JaffaCakes118.exe
1084	688e981a04241a918aac97054357008b_JaffaCakes118.exe
2140	archivoMZ

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	688e981a04241a918aac97054357008b_JaffaCakes118.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\CoreAAC.ax	archivoMZ
File created	C:\Windows\SysWOW64\CoreAAC.ax	archivoMZ

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2412	688e981a04241a918aac97054357008b_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2412 set thread context of 1084	2412	688e981a04241a918aac97054357008b_JaffaCakes118.exe	34

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	archivoMZ
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdcsc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	688e981a04241a918aac97054357008b_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	688e981a04241a918aac97054357008b_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1644	cmd.exe
2940	PING.EXE

NSIS installer 1 IoCs

installer

resource	yara_rule
behavioral1/files/0x000f000000012782-14.dat	nsis_installer_1

Modifies registry class 19 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{6AC7C19E-8CA0-4E3D-9A9F-2881DE29E0AC}\FilterData = 020000000000800002000000000000003070693300000000000000000200000000000000000000003074793300000000700000008000000031747933000000007000000090000000317069330800000000000000010000000000000000000000307479330000000070000000a00000006175647300001000800000aa00389b71ff00000000001000800000aa00389b714d50344100001000800000aa00389b710100000000001000800000aa00389b71	archivoMZ
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BBFC1A2A-D3A2-4610-847D-26592022F86E}\InprocServer32\ = "C:\\Windows\\SysWow64\\CoreAAC.ax"	archivoMZ
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4665E44B-8B9A-4515-A086-E94ECE374608}\ = "CoreAAC Audio Decoder About"	archivoMZ
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{6AC7C19E-8CA0-4E3D-9A9F-2881DE29E0AC}\FriendlyName = "CoreAAC Audio Decoder"	archivoMZ
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{6AC7C19E-8CA0-4E3D-9A9F-2881DE29E0AC}\CLSID = "{6AC7C19E-8CA0-4E3D-9A9F-2881DE29E0AC}"	archivoMZ
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6AC7C19E-8CA0-4E3D-9A9F-2881DE29E0AC}	archivoMZ
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6AC7C19E-8CA0-4E3D-9A9F-2881DE29E0AC}\ = "CoreAAC Audio Decoder"	archivoMZ
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6AC7C19E-8CA0-4E3D-9A9F-2881DE29E0AC}\InprocServer32\ = "C:\\Windows\\SysWow64\\CoreAAC.ax"	archivoMZ
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BBFC1A2A-D3A2-4610-847D-26592022F86E}\InprocServer32	archivoMZ
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BBFC1A2A-D3A2-4610-847D-26592022F86E}\InprocServer32\ThreadingModel = "Both"	archivoMZ
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4665E44B-8B9A-4515-A086-E94ECE374608}	archivoMZ
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6AC7C19E-8CA0-4E3D-9A9F-2881DE29E0AC}\InprocServer32	archivoMZ
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6AC7C19E-8CA0-4E3D-9A9F-2881DE29E0AC}\InprocServer32\ThreadingModel = "Both"	archivoMZ
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BBFC1A2A-D3A2-4610-847D-26592022F86E}	archivoMZ
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4665E44B-8B9A-4515-A086-E94ECE374608}\InprocServer32\ThreadingModel = "Both"	archivoMZ
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{6AC7C19E-8CA0-4E3D-9A9F-2881DE29E0AC}	archivoMZ
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BBFC1A2A-D3A2-4610-847D-26592022F86E}\ = "CoreAAC Audio Decoder Info"	archivoMZ
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4665E44B-8B9A-4515-A086-E94ECE374608}\InprocServer32	archivoMZ
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4665E44B-8B9A-4515-A086-E94ECE374608}\InprocServer32\ = "C:\\Windows\\SysWow64\\CoreAAC.ax"	archivoMZ

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2940	PING.EXE

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	1084	688e981a04241a918aac97054357008b_JaffaCakes118.exe
Token: SeSecurityPrivilege	1084	688e981a04241a918aac97054357008b_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	1084	688e981a04241a918aac97054357008b_JaffaCakes118.exe
Token: SeLoadDriverPrivilege	1084	688e981a04241a918aac97054357008b_JaffaCakes118.exe
Token: SeSystemProfilePrivilege	1084	688e981a04241a918aac97054357008b_JaffaCakes118.exe
Token: SeSystemtimePrivilege	1084	688e981a04241a918aac97054357008b_JaffaCakes118.exe
Token: SeProfSingleProcessPrivilege	1084	688e981a04241a918aac97054357008b_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	1084	688e981a04241a918aac97054357008b_JaffaCakes118.exe
Token: SeCreatePagefilePrivilege	1084	688e981a04241a918aac97054357008b_JaffaCakes118.exe
Token: SeBackupPrivilege	1084	688e981a04241a918aac97054357008b_JaffaCakes118.exe
Token: SeRestorePrivilege	1084	688e981a04241a918aac97054357008b_JaffaCakes118.exe
Token: SeShutdownPrivilege	1084	688e981a04241a918aac97054357008b_JaffaCakes118.exe
Token: SeDebugPrivilege	1084	688e981a04241a918aac97054357008b_JaffaCakes118.exe
Token: SeSystemEnvironmentPrivilege	1084	688e981a04241a918aac97054357008b_JaffaCakes118.exe
Token: SeChangeNotifyPrivilege	1084	688e981a04241a918aac97054357008b_JaffaCakes118.exe
Token: SeRemoteShutdownPrivilege	1084	688e981a04241a918aac97054357008b_JaffaCakes118.exe
Token: SeUndockPrivilege	1084	688e981a04241a918aac97054357008b_JaffaCakes118.exe
Token: SeManageVolumePrivilege	1084	688e981a04241a918aac97054357008b_JaffaCakes118.exe
Token: SeImpersonatePrivilege	1084	688e981a04241a918aac97054357008b_JaffaCakes118.exe
Token: SeCreateGlobalPrivilege	1084	688e981a04241a918aac97054357008b_JaffaCakes118.exe
Token: 33	1084	688e981a04241a918aac97054357008b_JaffaCakes118.exe
Token: 34	1084	688e981a04241a918aac97054357008b_JaffaCakes118.exe
Token: 35	1084	688e981a04241a918aac97054357008b_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2412	688e981a04241a918aac97054357008b_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 52 IoCs

description	pid	Process	procid_target
PID 2412 wrote to memory of 2140	2412	688e981a04241a918aac97054357008b_JaffaCakes118.exe	31
PID 2412 wrote to memory of 2140	2412	688e981a04241a918aac97054357008b_JaffaCakes118.exe	31
PID 2412 wrote to memory of 2140	2412	688e981a04241a918aac97054357008b_JaffaCakes118.exe	31
PID 2412 wrote to memory of 2140	2412	688e981a04241a918aac97054357008b_JaffaCakes118.exe	31
PID 2412 wrote to memory of 2140	2412	688e981a04241a918aac97054357008b_JaffaCakes118.exe	31
PID 2412 wrote to memory of 2140	2412	688e981a04241a918aac97054357008b_JaffaCakes118.exe	31
PID 2412 wrote to memory of 2140	2412	688e981a04241a918aac97054357008b_JaffaCakes118.exe	31
PID 2412 wrote to memory of 2096	2412	688e981a04241a918aac97054357008b_JaffaCakes118.exe	32
PID 2412 wrote to memory of 2096	2412	688e981a04241a918aac97054357008b_JaffaCakes118.exe	32
PID 2412 wrote to memory of 2096	2412	688e981a04241a918aac97054357008b_JaffaCakes118.exe	32
PID 2412 wrote to memory of 2096	2412	688e981a04241a918aac97054357008b_JaffaCakes118.exe	32
PID 2412 wrote to memory of 1084	2412	688e981a04241a918aac97054357008b_JaffaCakes118.exe	34
PID 2412 wrote to memory of 1084	2412	688e981a04241a918aac97054357008b_JaffaCakes118.exe	34
PID 2412 wrote to memory of 1084	2412	688e981a04241a918aac97054357008b_JaffaCakes118.exe	34
PID 2412 wrote to memory of 1084	2412	688e981a04241a918aac97054357008b_JaffaCakes118.exe	34
PID 2412 wrote to memory of 1084	2412	688e981a04241a918aac97054357008b_JaffaCakes118.exe	34
PID 2412 wrote to memory of 1084	2412	688e981a04241a918aac97054357008b_JaffaCakes118.exe	34
PID 2412 wrote to memory of 1084	2412	688e981a04241a918aac97054357008b_JaffaCakes118.exe	34
PID 2412 wrote to memory of 1084	2412	688e981a04241a918aac97054357008b_JaffaCakes118.exe	34
PID 2412 wrote to memory of 1084	2412	688e981a04241a918aac97054357008b_JaffaCakes118.exe	34
PID 2412 wrote to memory of 1084	2412	688e981a04241a918aac97054357008b_JaffaCakes118.exe	34
PID 2412 wrote to memory of 1084	2412	688e981a04241a918aac97054357008b_JaffaCakes118.exe	34
PID 2412 wrote to memory of 1084	2412	688e981a04241a918aac97054357008b_JaffaCakes118.exe	34
PID 2412 wrote to memory of 1084	2412	688e981a04241a918aac97054357008b_JaffaCakes118.exe	34
PID 1084 wrote to memory of 1176	1084	688e981a04241a918aac97054357008b_JaffaCakes118.exe	35
PID 1084 wrote to memory of 1176	1084	688e981a04241a918aac97054357008b_JaffaCakes118.exe	35
PID 1084 wrote to memory of 1176	1084	688e981a04241a918aac97054357008b_JaffaCakes118.exe	35
PID 1084 wrote to memory of 1176	1084	688e981a04241a918aac97054357008b_JaffaCakes118.exe	35
PID 1084 wrote to memory of 1128	1084	688e981a04241a918aac97054357008b_JaffaCakes118.exe	37
PID 1084 wrote to memory of 1128	1084	688e981a04241a918aac97054357008b_JaffaCakes118.exe	37
PID 1084 wrote to memory of 1128	1084	688e981a04241a918aac97054357008b_JaffaCakes118.exe	37
PID 1084 wrote to memory of 1128	1084	688e981a04241a918aac97054357008b_JaffaCakes118.exe	37
PID 1084 wrote to memory of 1644	1084	688e981a04241a918aac97054357008b_JaffaCakes118.exe	39
PID 1084 wrote to memory of 1644	1084	688e981a04241a918aac97054357008b_JaffaCakes118.exe	39
PID 1084 wrote to memory of 1644	1084	688e981a04241a918aac97054357008b_JaffaCakes118.exe	39
PID 1084 wrote to memory of 1644	1084	688e981a04241a918aac97054357008b_JaffaCakes118.exe	39
PID 1176 wrote to memory of 2032	1176	cmd.exe	40
PID 1176 wrote to memory of 2032	1176	cmd.exe	40
PID 1176 wrote to memory of 2032	1176	cmd.exe	40
PID 1176 wrote to memory of 2032	1176	cmd.exe	40
PID 1644 wrote to memory of 2940	1644	cmd.exe	42
PID 1644 wrote to memory of 2940	1644	cmd.exe	42
PID 1644 wrote to memory of 2940	1644	cmd.exe	42
PID 1644 wrote to memory of 2940	1644	cmd.exe	42
PID 1128 wrote to memory of 2932	1128	cmd.exe	43
PID 1128 wrote to memory of 2932	1128	cmd.exe	43
PID 1128 wrote to memory of 2932	1128	cmd.exe	43
PID 1128 wrote to memory of 2932	1128	cmd.exe	43
PID 1084 wrote to memory of 2620	1084	688e981a04241a918aac97054357008b_JaffaCakes118.exe	44
PID 1084 wrote to memory of 2620	1084	688e981a04241a918aac97054357008b_JaffaCakes118.exe	44
PID 1084 wrote to memory of 2620	1084	688e981a04241a918aac97054357008b_JaffaCakes118.exe	44
PID 1084 wrote to memory of 2620	1084	688e981a04241a918aac97054357008b_JaffaCakes118.exe	44

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2032	attrib.exe
2932	attrib.exe

C:\Users\Admin\AppData\Local\Temp\688e981a04241a918aac97054357008b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\688e981a04241a918aac97054357008b_JaffaCakes118.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2412
- C:\archivoMZ
  \archivoMZ
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:2140
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\RoamingFirewall.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2096
- C:\Users\Admin\AppData\Local\Temp\688e981a04241a918aac97054357008b_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\688e981a04241a918aac97054357008b_JaffaCakes118.exe
  2⤵
  - Modifies WinLogon for persistence
  - Loads dropped DLL
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1084
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\688e981a04241a918aac97054357008b_JaffaCakes118.exe" +s +h
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1176
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Users\Admin\AppData\Local\Temp\688e981a04241a918aac97054357008b_JaffaCakes118.exe" +s +h
      4⤵
      Sets file to hidden
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:2032
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1128
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
      4⤵
      Sets file to hidden
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:2932
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 4 && del "C:\Users\Admin\AppData\Local\Temp\688e981a04241a918aac97054357008b_JaffaCakes118.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:1644
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 4
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2940
- - C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
    "C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsdD895.tmp\ioSpecial.ini

Filesize
711B

MD5
e85e3640f2ca2878408c7d480348a192

SHA1
b18e89db1690a5391cde793e7c61eb2bab773c5a

SHA256
1f781d61657d1c071c6d251aadaaa84c5c658710e07f7f7c6e29ae7dc14dbd71

SHA512
d87d6b483222cac17ed3829b484346eda080e57dd1c65001ec8f1b336f2f2e9afffc4854c5d74b0e1f0294f4abe4fe1d1aeac623ce020c7c25182e29d98f6184

Download Submit
C:\Users\Admin\AppData\RoamingFirewall.bat

Filesize
16B

MD5
ad8f534ea726ddec58a390dee334362f

SHA1
847339c3a250e6910602a8570156ac4559ef90c0

SHA256
8a469c68715e6cda6c891a6c372b1560e17b9f8756e97f321a9d966986f960da

SHA512
6eca7a37fedbd0c6ccc5e0ccec9e48641cd7d4bd6d2a1979dc0fb8b6950c264db48291f68b8cc50c987b98f551304e114c1ca916b1f88144e8fa6d50cf939a92

Download Submit
C:\archivoMZ

Filesize
252KB

MD5
1a216df3e4a5dc41f65640f3d2d84efe

SHA1
f764a312a18957282d88e30b54a887a4ca7e507d

SHA256
3b9fa35864192f51b38beeffdb62d4999033f0f0d382f2dfeab9d450980e370d

SHA512
f86a3521beff1ec2e24d2afa930dcbcc182d9a061f2d9265e68e4408c1c127efd259223716675e92aab23d1bceb61e032286453b047eff4e64ad4d696942f5ab

Download Submit
\Users\Admin\AppData\Local\Temp\nsdD895.tmp\InstallOptions.dll

Filesize
12KB

MD5
9aff00ec14e6cb71a13451011c580077

SHA1
5972140e4a0addb9eac685fe6037da7479f23ecf

SHA256
cc8145683ad8fd77bd5cca193e84188e40d6d03a0a0d1d00e2bdbef91be96bb3

SHA512
311abd4e9927c1424d794ba401f3935ad3b108a2124e58e0d29aa946514c7a1d62b9b08b013699f4f90796bdfb6c07211daddbb521c1d20ccee771f6ea43b110

Download Submit
\Users\Admin\AppData\Local\Temp\nsdD895.tmp\UserInfo.dll

Filesize
4KB

MD5
419d642fe3436fda8bb22eea9c37a6ca

SHA1
c1644131b880c6e03f14de3c79efd27093a77908

SHA256
25c4f65b02eca4ad897d7a623b3ca1290bac836e98ab5ee5f6c527dfb6a41dd7

SHA512
29df088e3b5189efd6fbeebc2f23c5850303d40fe5331cd336bb852d986f9ab66f7bcd963ebf8c4e4eea7d49a6590027490d651a3e4781024c7983a2c456a337

Download Submit
\Users\Admin\Documents\MSDCSC\msdcsc.exe

Filesize
1.4MB

MD5
688e981a04241a918aac97054357008b

SHA1
a144325ed430fbfb70d32e4830594dc9470af5c2

SHA256
4a01ae30245547e732dee65c67e8920e592beb370aeac21cba2f3aee44cbfbda

SHA512
277b9bf9c73d3e56cdc3299d89627438ade20612bd1c2367666682cd3648051a5154859d47e0c824f2b172b7066630c82128d87527e582c6907fc0e06cf3d382

Download Submit
\Windows\SysWOW64\CoreAAC.ax

Filesize
416KB

MD5
980d3842c1b0114f53e783577a6fe7ac

SHA1
ea09de5cc6901d1ef72501c5dac782e5e4b7507c

SHA256
33581d2d6eb6700609d10581e2b6bcafe231e492c6f5b328751df9d0db5d581b

SHA512
213bcd781a1aeed258adc9c2465b008b1f7ff5e765929aac5fc0a85bc9688952bfe9e7a194c02ba4c96804c599d753df944583e035f3e08776f9b5f821b43e50

Download Submit
memory/1084-118-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/1084-126-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/1084-145-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/1084-146-0x0000000005790000-0x00000000059F5000-memory.dmp

Filesize
2.4MB

Download
memory/1084-148-0x0000000000570000-0x0000000000670000-memory.dmp

Filesize
1024KB

Download
memory/1084-144-0x0000000005790000-0x00000000059F5000-memory.dmp

Filesize
2.4MB

Download
memory/1084-133-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/1084-107-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/1084-132-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/1084-110-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/1084-112-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/1084-114-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/1084-120-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/1084-131-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/1084-116-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/1084-122-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/1084-124-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1084-127-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2412-2-0x0000000000400000-0x0000000000665000-memory.dmp

Filesize
2.4MB

Download
memory/2412-129-0x0000000000400000-0x0000000000665000-memory.dmp

Filesize
2.4MB

Download
memory/2412-130-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download
memory/2412-1-0x0000000000400000-0x0000000000665000-memory.dmp

Filesize
2.4MB

Download
memory/2412-108-0x00000000045B0000-0x0000000004815000-memory.dmp

Filesize
2.4MB

Download
memory/2412-0-0x0000000000400000-0x0000000000665000-memory.dmp

Filesize
2.4MB

Download
memory/2412-3-0x0000000000400000-0x0000000000665000-memory.dmp

Filesize
2.4MB

Download
memory/2412-6-0x0000000000400000-0x0000000000665000-memory.dmp

Filesize
2.4MB

Download
memory/2412-11-0x0000000000400000-0x0000000000665000-memory.dmp

Filesize
2.4MB

Download
memory/2412-5-0x0000000000400000-0x0000000000665000-memory.dmp

Filesize
2.4MB

Download
memory/2412-4-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download
memory/2412-7-0x0000000000400000-0x0000000000665000-memory.dmp

Filesize
2.4MB

Download
memory/2620-152-0x0000000000400000-0x0000000000665000-memory.dmp

Filesize
2.4MB

Download
memory/2620-153-0x0000000000400000-0x0000000000665000-memory.dmp

Filesize
2.4MB

Download
memory/2620-150-0x0000000000400000-0x0000000000665000-memory.dmp

Filesize
2.4MB

Download
memory/2620-155-0x0000000000400000-0x0000000000665000-memory.dmp

Filesize
2.4MB

Download
memory/2620-151-0x0000000000400000-0x0000000000665000-memory.dmp

Filesize
2.4MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads