darkcomet | 4a01ae30245547e732dee65c67e8920e592beb370aeac21cba2f3aee44cbfbda

Analysis

max time kernel
142s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-10-2024 02:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

688e981a04241a918aac97054357008b_JaffaCakes118.exe
Size

1.4MB
MD5

688e981a04241a918aac97054357008b
SHA1

a144325ed430fbfb70d32e4830594dc9470af5c2
SHA256

4a01ae30245547e732dee65c67e8920e592beb370aeac21cba2f3aee44cbfbda
SHA512

277b9bf9c73d3e56cdc3299d89627438ade20612bd1c2367666682cd3648051a5154859d47e0c824f2b172b7066630c82128d87527e582c6907fc0e06cf3d382
SSDEEP

24576:YeHe8fAIwgw4lAAx9BhmroAGKmErF5HTMHHkeDz4GsiiSVTcon/lwNy9OIUcYH2u:YeHe8fAIwgw4lAAx9BhmnmAzEkoEondY

Score

10^/10

darkcomet discovery evasion persistence rat trojan

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

688e981a04241a918aac97054357008b_JaffaCakes118.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	688e981a04241a918aac97054357008b_JaffaCakes118.exe

Sets file to hidden 1 TTPs 2 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

Processes:

attrib.exeattrib.exe

pid	Process
3424	attrib.exe
3132	attrib.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

688e981a04241a918aac97054357008b_JaffaCakes118.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	688e981a04241a918aac97054357008b_JaffaCakes118.exe

Executes dropped EXE 2 IoCs

Processes:

archivoMZmsdcsc.exe

pid	Process
4876	archivoMZ
4288	msdcsc.exe

Loads dropped DLL 4 IoCs

Processes:

archivoMZ

pid	Process
4876	archivoMZ
4876	archivoMZ
4876	archivoMZ
4876	archivoMZ

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

688e981a04241a918aac97054357008b_JaffaCakes118.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	688e981a04241a918aac97054357008b_JaffaCakes118.exe

Drops file in System32 directory 2 IoCs

Processes:

archivoMZ

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\CoreAAC.ax	archivoMZ
File created	C:\Windows\SysWOW64\CoreAAC.ax	archivoMZ

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

Processes:

688e981a04241a918aac97054357008b_JaffaCakes118.exemsdcsc.exe

pid	Process
3724	688e981a04241a918aac97054357008b_JaffaCakes118.exe
4288	msdcsc.exe
4288	msdcsc.exe
4288	msdcsc.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

688e981a04241a918aac97054357008b_JaffaCakes118.exe

description	pid	Process	procid_target
PID 3724 set thread context of 1348	3724	688e981a04241a918aac97054357008b_JaffaCakes118.exe	88

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

cmd.execmd.exeattrib.execmd.execmd.exeattrib.exePING.EXEmsdcsc.exe688e981a04241a918aac97054357008b_JaffaCakes118.exearchivoMZ688e981a04241a918aac97054357008b_JaffaCakes118.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdcsc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	688e981a04241a918aac97054357008b_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	archivoMZ
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	688e981a04241a918aac97054357008b_JaffaCakes118.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

Processes:

cmd.exePING.EXE

pid	Process
2604	cmd.exe
3732	PING.EXE

NSIS installer 1 IoCs

installer

Processes:

resource	yara_rule
behavioral2/files/0x0007000000023ca1-15.dat	nsis_installer_1

Modifies registry class 20 IoCs

Processes:

archivoMZ688e981a04241a918aac97054357008b_JaffaCakes118.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4665E44B-8B9A-4515-A086-E94ECE374608}\ = "CoreAAC Audio Decoder About"	archivoMZ
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{6AC7C19E-8CA0-4E3D-9A9F-2881DE29E0AC}	archivoMZ
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{6AC7C19E-8CA0-4E3D-9A9F-2881DE29E0AC}\FilterData = 020000000000800002000000000000003070693300000000000000000200000000000000000000003074793300000000700000008000000031747933000000007000000090000000317069330800000000000000010000000000000000000000307479330000000070000000a00000006175647300001000800000aa00389b71ff00000000001000800000aa00389b714d50344100001000800000aa00389b710100000000001000800000aa00389b71	archivoMZ
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	688e981a04241a918aac97054357008b_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4665E44B-8B9A-4515-A086-E94ECE374608}	archivoMZ
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4665E44B-8B9A-4515-A086-E94ECE374608}\InprocServer32	archivoMZ
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4665E44B-8B9A-4515-A086-E94ECE374608}\InprocServer32\ = "C:\\Windows\\SysWow64\\CoreAAC.ax"	archivoMZ
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4665E44B-8B9A-4515-A086-E94ECE374608}\InprocServer32\ThreadingModel = "Both"	archivoMZ
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6AC7C19E-8CA0-4E3D-9A9F-2881DE29E0AC}	archivoMZ
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BBFC1A2A-D3A2-4610-847D-26592022F86E}\InprocServer32\ThreadingModel = "Both"	archivoMZ
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BBFC1A2A-D3A2-4610-847D-26592022F86E}\InprocServer32	archivoMZ
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6AC7C19E-8CA0-4E3D-9A9F-2881DE29E0AC}\ = "CoreAAC Audio Decoder"	archivoMZ
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6AC7C19E-8CA0-4E3D-9A9F-2881DE29E0AC}\InprocServer32\ThreadingModel = "Both"	archivoMZ
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BBFC1A2A-D3A2-4610-847D-26592022F86E}	archivoMZ
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BBFC1A2A-D3A2-4610-847D-26592022F86E}\ = "CoreAAC Audio Decoder Info"	archivoMZ
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BBFC1A2A-D3A2-4610-847D-26592022F86E}\InprocServer32\ = "C:\\Windows\\SysWow64\\CoreAAC.ax"	archivoMZ
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{6AC7C19E-8CA0-4E3D-9A9F-2881DE29E0AC}\FriendlyName = "CoreAAC Audio Decoder"	archivoMZ
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{6AC7C19E-8CA0-4E3D-9A9F-2881DE29E0AC}\CLSID = "{6AC7C19E-8CA0-4E3D-9A9F-2881DE29E0AC}"	archivoMZ
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6AC7C19E-8CA0-4E3D-9A9F-2881DE29E0AC}\InprocServer32	archivoMZ
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6AC7C19E-8CA0-4E3D-9A9F-2881DE29E0AC}\InprocServer32\ = "C:\\Windows\\SysWow64\\CoreAAC.ax"	archivoMZ

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

Processes:

PING.EXE

pid	Process
3732	PING.EXE

Suspicious use of AdjustPrivilegeToken 24 IoCs

Processes:

688e981a04241a918aac97054357008b_JaffaCakes118.exe

description	pid	Process
Token: SeIncreaseQuotaPrivilege	1348	688e981a04241a918aac97054357008b_JaffaCakes118.exe
Token: SeSecurityPrivilege	1348	688e981a04241a918aac97054357008b_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	1348	688e981a04241a918aac97054357008b_JaffaCakes118.exe
Token: SeLoadDriverPrivilege	1348	688e981a04241a918aac97054357008b_JaffaCakes118.exe
Token: SeSystemProfilePrivilege	1348	688e981a04241a918aac97054357008b_JaffaCakes118.exe
Token: SeSystemtimePrivilege	1348	688e981a04241a918aac97054357008b_JaffaCakes118.exe
Token: SeProfSingleProcessPrivilege	1348	688e981a04241a918aac97054357008b_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	1348	688e981a04241a918aac97054357008b_JaffaCakes118.exe
Token: SeCreatePagefilePrivilege	1348	688e981a04241a918aac97054357008b_JaffaCakes118.exe
Token: SeBackupPrivilege	1348	688e981a04241a918aac97054357008b_JaffaCakes118.exe
Token: SeRestorePrivilege	1348	688e981a04241a918aac97054357008b_JaffaCakes118.exe
Token: SeShutdownPrivilege	1348	688e981a04241a918aac97054357008b_JaffaCakes118.exe
Token: SeDebugPrivilege	1348	688e981a04241a918aac97054357008b_JaffaCakes118.exe
Token: SeSystemEnvironmentPrivilege	1348	688e981a04241a918aac97054357008b_JaffaCakes118.exe
Token: SeChangeNotifyPrivilege	1348	688e981a04241a918aac97054357008b_JaffaCakes118.exe
Token: SeRemoteShutdownPrivilege	1348	688e981a04241a918aac97054357008b_JaffaCakes118.exe
Token: SeUndockPrivilege	1348	688e981a04241a918aac97054357008b_JaffaCakes118.exe
Token: SeManageVolumePrivilege	1348	688e981a04241a918aac97054357008b_JaffaCakes118.exe
Token: SeImpersonatePrivilege	1348	688e981a04241a918aac97054357008b_JaffaCakes118.exe
Token: SeCreateGlobalPrivilege	1348	688e981a04241a918aac97054357008b_JaffaCakes118.exe
Token: 33	1348	688e981a04241a918aac97054357008b_JaffaCakes118.exe
Token: 34	1348	688e981a04241a918aac97054357008b_JaffaCakes118.exe
Token: 35	1348	688e981a04241a918aac97054357008b_JaffaCakes118.exe
Token: 36	1348	688e981a04241a918aac97054357008b_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

688e981a04241a918aac97054357008b_JaffaCakes118.exemsdcsc.exe

pid	Process
3724	688e981a04241a918aac97054357008b_JaffaCakes118.exe
4288	msdcsc.exe

Suspicious use of WriteProcessMemory 41 IoCs

Processes:

688e981a04241a918aac97054357008b_JaffaCakes118.exe688e981a04241a918aac97054357008b_JaffaCakes118.execmd.execmd.execmd.exe

description	pid	Process	procid_target
PID 3724 wrote to memory of 4876	3724	688e981a04241a918aac97054357008b_JaffaCakes118.exe	84
PID 3724 wrote to memory of 4876	3724	688e981a04241a918aac97054357008b_JaffaCakes118.exe	84
PID 3724 wrote to memory of 4876	3724	688e981a04241a918aac97054357008b_JaffaCakes118.exe	84
PID 3724 wrote to memory of 4924	3724	688e981a04241a918aac97054357008b_JaffaCakes118.exe	85
PID 3724 wrote to memory of 4924	3724	688e981a04241a918aac97054357008b_JaffaCakes118.exe	85
PID 3724 wrote to memory of 4924	3724	688e981a04241a918aac97054357008b_JaffaCakes118.exe	85
PID 3724 wrote to memory of 1348	3724	688e981a04241a918aac97054357008b_JaffaCakes118.exe	88
PID 3724 wrote to memory of 1348	3724	688e981a04241a918aac97054357008b_JaffaCakes118.exe	88
PID 3724 wrote to memory of 1348	3724	688e981a04241a918aac97054357008b_JaffaCakes118.exe	88
PID 3724 wrote to memory of 1348	3724	688e981a04241a918aac97054357008b_JaffaCakes118.exe	88
PID 3724 wrote to memory of 1348	3724	688e981a04241a918aac97054357008b_JaffaCakes118.exe	88
PID 3724 wrote to memory of 1348	3724	688e981a04241a918aac97054357008b_JaffaCakes118.exe	88
PID 3724 wrote to memory of 1348	3724	688e981a04241a918aac97054357008b_JaffaCakes118.exe	88
PID 3724 wrote to memory of 1348	3724	688e981a04241a918aac97054357008b_JaffaCakes118.exe	88
PID 3724 wrote to memory of 1348	3724	688e981a04241a918aac97054357008b_JaffaCakes118.exe	88
PID 3724 wrote to memory of 1348	3724	688e981a04241a918aac97054357008b_JaffaCakes118.exe	88
PID 3724 wrote to memory of 1348	3724	688e981a04241a918aac97054357008b_JaffaCakes118.exe	88
PID 3724 wrote to memory of 1348	3724	688e981a04241a918aac97054357008b_JaffaCakes118.exe	88
PID 3724 wrote to memory of 1348	3724	688e981a04241a918aac97054357008b_JaffaCakes118.exe	88
PID 3724 wrote to memory of 1348	3724	688e981a04241a918aac97054357008b_JaffaCakes118.exe	88
PID 1348 wrote to memory of 2632	1348	688e981a04241a918aac97054357008b_JaffaCakes118.exe	95
PID 1348 wrote to memory of 2632	1348	688e981a04241a918aac97054357008b_JaffaCakes118.exe	95
PID 1348 wrote to memory of 2632	1348	688e981a04241a918aac97054357008b_JaffaCakes118.exe	95
PID 1348 wrote to memory of 3832	1348	688e981a04241a918aac97054357008b_JaffaCakes118.exe	97
PID 1348 wrote to memory of 3832	1348	688e981a04241a918aac97054357008b_JaffaCakes118.exe	97
PID 1348 wrote to memory of 3832	1348	688e981a04241a918aac97054357008b_JaffaCakes118.exe	97
PID 1348 wrote to memory of 2604	1348	688e981a04241a918aac97054357008b_JaffaCakes118.exe	99
PID 1348 wrote to memory of 2604	1348	688e981a04241a918aac97054357008b_JaffaCakes118.exe	99
PID 1348 wrote to memory of 2604	1348	688e981a04241a918aac97054357008b_JaffaCakes118.exe	99
PID 2632 wrote to memory of 3424	2632	cmd.exe	101
PID 2632 wrote to memory of 3424	2632	cmd.exe	101
PID 2632 wrote to memory of 3424	2632	cmd.exe	101
PID 3832 wrote to memory of 3132	3832	cmd.exe	102
PID 3832 wrote to memory of 3132	3832	cmd.exe	102
PID 3832 wrote to memory of 3132	3832	cmd.exe	102
PID 2604 wrote to memory of 3732	2604	cmd.exe	103
PID 2604 wrote to memory of 3732	2604	cmd.exe	103
PID 2604 wrote to memory of 3732	2604	cmd.exe	103
PID 1348 wrote to memory of 4288	1348	688e981a04241a918aac97054357008b_JaffaCakes118.exe	104
PID 1348 wrote to memory of 4288	1348	688e981a04241a918aac97054357008b_JaffaCakes118.exe	104
PID 1348 wrote to memory of 4288	1348	688e981a04241a918aac97054357008b_JaffaCakes118.exe	104

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Processes:

attrib.exeattrib.exe

pid	Process
3424	attrib.exe
3132	attrib.exe

C:\Users\Admin\AppData\Local\Temp\688e981a04241a918aac97054357008b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\688e981a04241a918aac97054357008b_JaffaCakes118.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3724
- C:\archivoMZ
  \archivoMZ
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:4876
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\RoamingFirewall.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4924
- C:\Users\Admin\AppData\Local\Temp\688e981a04241a918aac97054357008b_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\688e981a04241a918aac97054357008b_JaffaCakes118.exe
  2⤵
  - Modifies WinLogon for persistence
  - Checks computer location settings
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1348
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\688e981a04241a918aac97054357008b_JaffaCakes118.exe" +s +h
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2632
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Users\Admin\AppData\Local\Temp\688e981a04241a918aac97054357008b_JaffaCakes118.exe" +s +h
      4⤵
      Sets file to hidden
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:3424
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3832
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
      4⤵
      Sets file to hidden
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:3132
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 4 && del "C:\Users\Admin\AppData\Local\Temp\688e981a04241a918aac97054357008b_JaffaCakes118.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:2604
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 4
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:3732
- - C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
    "C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4288

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsbA337.tmp\InstallOptions.dll

Filesize
12KB

MD5
9aff00ec14e6cb71a13451011c580077

SHA1
5972140e4a0addb9eac685fe6037da7479f23ecf

SHA256
cc8145683ad8fd77bd5cca193e84188e40d6d03a0a0d1d00e2bdbef91be96bb3

SHA512
311abd4e9927c1424d794ba401f3935ad3b108a2124e58e0d29aa946514c7a1d62b9b08b013699f4f90796bdfb6c07211daddbb521c1d20ccee771f6ea43b110

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsbA337.tmp\UserInfo.dll

Filesize
4KB

MD5
419d642fe3436fda8bb22eea9c37a6ca

SHA1
c1644131b880c6e03f14de3c79efd27093a77908

SHA256
25c4f65b02eca4ad897d7a623b3ca1290bac836e98ab5ee5f6c527dfb6a41dd7

SHA512
29df088e3b5189efd6fbeebc2f23c5850303d40fe5331cd336bb852d986f9ab66f7bcd963ebf8c4e4eea7d49a6590027490d651a3e4781024c7983a2c456a337

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsbA337.tmp\ioSpecial.ini

Filesize
711B

MD5
0efe45ba8308e977ba169b483db8afb7

SHA1
86601f5aa384c4d0bbe17d1b8c2a519d3746f7db

SHA256
ec1a980c8e19bfe81567fd3b3cb92345a4a49475393c8f49d51d2cd1cc833d76

SHA512
962cd95a6ff0e04777c022ee4b9a58fddd154c16a7838935c6c061a7d8b34b5f3a5fd4f58a31135ca4aa5ea0d11e1a6158e5950f05fbbbe1205f318cab6b8e89

Download Submit
C:\Users\Admin\AppData\RoamingFirewall.bat

Filesize
16B

MD5
ad8f534ea726ddec58a390dee334362f

SHA1
847339c3a250e6910602a8570156ac4559ef90c0

SHA256
8a469c68715e6cda6c891a6c372b1560e17b9f8756e97f321a9d966986f960da

SHA512
6eca7a37fedbd0c6ccc5e0ccec9e48641cd7d4bd6d2a1979dc0fb8b6950c264db48291f68b8cc50c987b98f551304e114c1ca916b1f88144e8fa6d50cf939a92

Download Submit
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe

Filesize
1.4MB

MD5
688e981a04241a918aac97054357008b

SHA1
a144325ed430fbfb70d32e4830594dc9470af5c2

SHA256
4a01ae30245547e732dee65c67e8920e592beb370aeac21cba2f3aee44cbfbda

SHA512
277b9bf9c73d3e56cdc3299d89627438ade20612bd1c2367666682cd3648051a5154859d47e0c824f2b172b7066630c82128d87527e582c6907fc0e06cf3d382

Download Submit
C:\Windows\SysWOW64\CoreAAC.ax

Filesize
416KB

MD5
980d3842c1b0114f53e783577a6fe7ac

SHA1
ea09de5cc6901d1ef72501c5dac782e5e4b7507c

SHA256
33581d2d6eb6700609d10581e2b6bcafe231e492c6f5b328751df9d0db5d581b

SHA512
213bcd781a1aeed258adc9c2465b008b1f7ff5e765929aac5fc0a85bc9688952bfe9e7a194c02ba4c96804c599d753df944583e035f3e08776f9b5f821b43e50

Download Submit
C:\archivoMZ

Filesize
252KB

MD5
1a216df3e4a5dc41f65640f3d2d84efe

SHA1
f764a312a18957282d88e30b54a887a4ca7e507d

SHA256
3b9fa35864192f51b38beeffdb62d4999033f0f0d382f2dfeab9d450980e370d

SHA512
f86a3521beff1ec2e24d2afa930dcbcc182d9a061f2d9265e68e4408c1c127efd259223716675e92aab23d1bceb61e032286453b047eff4e64ad4d696942f5ab

Download Submit
memory/1348-101-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/1348-173-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/1348-107-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/1348-105-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/1348-103-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/1348-102-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/3724-2-0x0000000000400000-0x0000000000665000-memory.dmp

Filesize
2.4MB

Download
memory/3724-106-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download
memory/3724-4-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download
memory/3724-6-0x0000000000400000-0x0000000000665000-memory.dmp

Filesize
2.4MB

Download
memory/3724-1-0x0000000000400000-0x0000000000665000-memory.dmp

Filesize
2.4MB

Download
memory/3724-5-0x0000000000400000-0x0000000000665000-memory.dmp

Filesize
2.4MB

Download
memory/3724-0-0x0000000000400000-0x0000000000665000-memory.dmp

Filesize
2.4MB

Download
memory/3724-7-0x0000000000400000-0x0000000000665000-memory.dmp

Filesize
2.4MB

Download
memory/3724-104-0x0000000000400000-0x0000000000665000-memory.dmp

Filesize
2.4MB

Download
memory/3724-3-0x0000000000400000-0x0000000000665000-memory.dmp

Filesize
2.4MB

Download
memory/3724-10-0x0000000000400000-0x0000000000665000-memory.dmp

Filesize
2.4MB

Download
memory/4288-174-0x0000000000400000-0x0000000000665000-memory.dmp

Filesize
2.4MB

Download
memory/4288-169-0x0000000000400000-0x0000000000665000-memory.dmp

Filesize
2.4MB

Download
memory/4288-175-0x0000000000400000-0x0000000000665000-memory.dmp

Filesize
2.4MB

Download
memory/4288-179-0x0000000000400000-0x0000000000665000-memory.dmp

Filesize
2.4MB

Download
memory/4288-172-0x0000000000400000-0x0000000000665000-memory.dmp

Filesize
2.4MB

Download