Analysis
-
max time kernel
120s -
max time network
116s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
06-11-2024 06:20
Static task
static1
Behavioral task
behavioral1
Sample
421e48716838b07749b30132827cd63bf478e7f3a59fc5517a5d8df5537689a6N.exe
Resource
win7-20241010-en
General
-
Target
421e48716838b07749b30132827cd63bf478e7f3a59fc5517a5d8df5537689a6N.exe
-
Size
1.3MB
-
MD5
b3242661967006ba6f655869554c3f20
-
SHA1
3df8fab6dc60e7d22d46fe21236bfbfd1434a77f
-
SHA256
421e48716838b07749b30132827cd63bf478e7f3a59fc5517a5d8df5537689a6
-
SHA512
28f6cabeec727a105e96a57e13e220865d80916a1f3fb762bcc9d33a8408a26d0e661a9a5a620eb471b0b9b54697cd83ff91e4c99ddc420ebb1fe5fa642756f5
-
SSDEEP
24576:oRmJkcoQricOIQxiZY1ianytXiVgxSJ2+lCVSWZlkhDyI6t8DB6btGF1/ATNNJ3:NJZoQrbTFZY1ianUiWxSJuplkZVlIbEw
Malware Config
Extracted
darkcomet
Guest16
ipresolver.zapto.org:1604
DC_MUTEX-1X48CDE
-
InstallPath
Skype/Skype.exe
-
gencode
VSt3RyM0B19F
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
Skype
Signatures
-
Darkcomet family
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "%AppData%\\Microsoft\\taskhost.exe,explorer.exe" 421e48716838b07749b30132827cd63bf478e7f3a59fc5517a5d8df5537689a6N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\VSt3RyM0B19F\\Skype/Skype.exe" 421e48716838b07749b30132827cd63bf478e7f3a59fc5517a5d8df5537689a6N.exe -
Modifies firewall policy service 3 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 421e48716838b07749b30132827cd63bf478e7f3a59fc5517a5d8df5537689a6N.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" 421e48716838b07749b30132827cd63bf478e7f3a59fc5517a5d8df5537689a6N.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile 421e48716838b07749b30132827cd63bf478e7f3a59fc5517a5d8df5537689a6N.exe -
Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" 421e48716838b07749b30132827cd63bf478e7f3a59fc5517a5d8df5537689a6N.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 421e48716838b07749b30132827cd63bf478e7f3a59fc5517a5d8df5537689a6N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 421e48716838b07749b30132827cd63bf478e7f3a59fc5517a5d8df5537689a6N.exe -
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 421e48716838b07749b30132827cd63bf478e7f3a59fc5517a5d8df5537689a6N.exe Set value (str) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\WindowsStart = "%Temp%\\Microsoft\\taskhost.exe" 421e48716838b07749b30132827cd63bf478e7f3a59fc5517a5d8df5537689a6N.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 421e48716838b07749b30132827cd63bf478e7f3a59fc5517a5d8df5537689a6N.exe -
Disables Task Manager via registry modification
-
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
pid Process 1720 attrib.exe 3644 attrib.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation 421e48716838b07749b30132827cd63bf478e7f3a59fc5517a5d8df5537689a6N.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windows.lnk 421e48716838b07749b30132827cd63bf478e7f3a59fc5517a5d8df5537689a6N.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 421e48716838b07749b30132827cd63bf478e7f3a59fc5517a5d8df5537689a6N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 421e48716838b07749b30132827cd63bf478e7f3a59fc5517a5d8df5537689a6N.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsStart = "%AppData%\\Microsoft\\taskhost.exe" 421e48716838b07749b30132827cd63bf478e7f3a59fc5517a5d8df5537689a6N.exe Set value (str) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Skype = "C:\\Windows\\system32\\VSt3RyM0B19F\\Skype/Skype.exe" 421e48716838b07749b30132827cd63bf478e7f3a59fc5517a5d8df5537689a6N.exe -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/2068-5-0x0000000000400000-0x0000000000556000-memory.dmp autoit_exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\VSt3RyM0B19F\ 421e48716838b07749b30132827cd63bf478e7f3a59fc5517a5d8df5537689a6N.exe File opened for modification C:\Windows\SysWOW64\VSt3RyM0B19F\Skype\Skype.exe 421e48716838b07749b30132827cd63bf478e7f3a59fc5517a5d8df5537689a6N.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 421e48716838b07749b30132827cd63bf478e7f3a59fc5517a5d8df5537689a6N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 421e48716838b07749b30132827cd63bf478e7f3a59fc5517a5d8df5537689a6N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language notepad.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1156 421e48716838b07749b30132827cd63bf478e7f3a59fc5517a5d8df5537689a6N.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2068 421e48716838b07749b30132827cd63bf478e7f3a59fc5517a5d8df5537689a6N.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1156 421e48716838b07749b30132827cd63bf478e7f3a59fc5517a5d8df5537689a6N.exe Token: SeSecurityPrivilege 1156 421e48716838b07749b30132827cd63bf478e7f3a59fc5517a5d8df5537689a6N.exe Token: SeTakeOwnershipPrivilege 1156 421e48716838b07749b30132827cd63bf478e7f3a59fc5517a5d8df5537689a6N.exe Token: SeLoadDriverPrivilege 1156 421e48716838b07749b30132827cd63bf478e7f3a59fc5517a5d8df5537689a6N.exe Token: SeSystemProfilePrivilege 1156 421e48716838b07749b30132827cd63bf478e7f3a59fc5517a5d8df5537689a6N.exe Token: SeSystemtimePrivilege 1156 421e48716838b07749b30132827cd63bf478e7f3a59fc5517a5d8df5537689a6N.exe Token: SeProfSingleProcessPrivilege 1156 421e48716838b07749b30132827cd63bf478e7f3a59fc5517a5d8df5537689a6N.exe Token: SeIncBasePriorityPrivilege 1156 421e48716838b07749b30132827cd63bf478e7f3a59fc5517a5d8df5537689a6N.exe Token: SeCreatePagefilePrivilege 1156 421e48716838b07749b30132827cd63bf478e7f3a59fc5517a5d8df5537689a6N.exe Token: SeBackupPrivilege 1156 421e48716838b07749b30132827cd63bf478e7f3a59fc5517a5d8df5537689a6N.exe Token: SeRestorePrivilege 1156 421e48716838b07749b30132827cd63bf478e7f3a59fc5517a5d8df5537689a6N.exe Token: SeShutdownPrivilege 1156 421e48716838b07749b30132827cd63bf478e7f3a59fc5517a5d8df5537689a6N.exe Token: SeDebugPrivilege 1156 421e48716838b07749b30132827cd63bf478e7f3a59fc5517a5d8df5537689a6N.exe Token: SeSystemEnvironmentPrivilege 1156 421e48716838b07749b30132827cd63bf478e7f3a59fc5517a5d8df5537689a6N.exe Token: SeChangeNotifyPrivilege 1156 421e48716838b07749b30132827cd63bf478e7f3a59fc5517a5d8df5537689a6N.exe Token: SeRemoteShutdownPrivilege 1156 421e48716838b07749b30132827cd63bf478e7f3a59fc5517a5d8df5537689a6N.exe Token: SeUndockPrivilege 1156 421e48716838b07749b30132827cd63bf478e7f3a59fc5517a5d8df5537689a6N.exe Token: SeManageVolumePrivilege 1156 421e48716838b07749b30132827cd63bf478e7f3a59fc5517a5d8df5537689a6N.exe Token: SeImpersonatePrivilege 1156 421e48716838b07749b30132827cd63bf478e7f3a59fc5517a5d8df5537689a6N.exe Token: SeCreateGlobalPrivilege 1156 421e48716838b07749b30132827cd63bf478e7f3a59fc5517a5d8df5537689a6N.exe Token: 33 1156 421e48716838b07749b30132827cd63bf478e7f3a59fc5517a5d8df5537689a6N.exe Token: 34 1156 421e48716838b07749b30132827cd63bf478e7f3a59fc5517a5d8df5537689a6N.exe Token: 35 1156 421e48716838b07749b30132827cd63bf478e7f3a59fc5517a5d8df5537689a6N.exe Token: 36 1156 421e48716838b07749b30132827cd63bf478e7f3a59fc5517a5d8df5537689a6N.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 2068 421e48716838b07749b30132827cd63bf478e7f3a59fc5517a5d8df5537689a6N.exe 2068 421e48716838b07749b30132827cd63bf478e7f3a59fc5517a5d8df5537689a6N.exe 2068 421e48716838b07749b30132827cd63bf478e7f3a59fc5517a5d8df5537689a6N.exe -
Suspicious use of SendNotifyMessage 3 IoCs
pid Process 2068 421e48716838b07749b30132827cd63bf478e7f3a59fc5517a5d8df5537689a6N.exe 2068 421e48716838b07749b30132827cd63bf478e7f3a59fc5517a5d8df5537689a6N.exe 2068 421e48716838b07749b30132827cd63bf478e7f3a59fc5517a5d8df5537689a6N.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1156 421e48716838b07749b30132827cd63bf478e7f3a59fc5517a5d8df5537689a6N.exe -
Suspicious use of WriteProcessMemory 45 IoCs
description pid Process procid_target PID 2068 wrote to memory of 1156 2068 421e48716838b07749b30132827cd63bf478e7f3a59fc5517a5d8df5537689a6N.exe 85 PID 2068 wrote to memory of 1156 2068 421e48716838b07749b30132827cd63bf478e7f3a59fc5517a5d8df5537689a6N.exe 85 PID 2068 wrote to memory of 1156 2068 421e48716838b07749b30132827cd63bf478e7f3a59fc5517a5d8df5537689a6N.exe 85 PID 2068 wrote to memory of 1156 2068 421e48716838b07749b30132827cd63bf478e7f3a59fc5517a5d8df5537689a6N.exe 85 PID 2068 wrote to memory of 1156 2068 421e48716838b07749b30132827cd63bf478e7f3a59fc5517a5d8df5537689a6N.exe 85 PID 2068 wrote to memory of 1156 2068 421e48716838b07749b30132827cd63bf478e7f3a59fc5517a5d8df5537689a6N.exe 85 PID 2068 wrote to memory of 1156 2068 421e48716838b07749b30132827cd63bf478e7f3a59fc5517a5d8df5537689a6N.exe 85 PID 2068 wrote to memory of 1156 2068 421e48716838b07749b30132827cd63bf478e7f3a59fc5517a5d8df5537689a6N.exe 85 PID 2068 wrote to memory of 1156 2068 421e48716838b07749b30132827cd63bf478e7f3a59fc5517a5d8df5537689a6N.exe 85 PID 2068 wrote to memory of 1156 2068 421e48716838b07749b30132827cd63bf478e7f3a59fc5517a5d8df5537689a6N.exe 85 PID 2068 wrote to memory of 1156 2068 421e48716838b07749b30132827cd63bf478e7f3a59fc5517a5d8df5537689a6N.exe 85 PID 1156 wrote to memory of 4992 1156 421e48716838b07749b30132827cd63bf478e7f3a59fc5517a5d8df5537689a6N.exe 88 PID 1156 wrote to memory of 4992 1156 421e48716838b07749b30132827cd63bf478e7f3a59fc5517a5d8df5537689a6N.exe 88 PID 1156 wrote to memory of 4992 1156 421e48716838b07749b30132827cd63bf478e7f3a59fc5517a5d8df5537689a6N.exe 88 PID 1156 wrote to memory of 5008 1156 421e48716838b07749b30132827cd63bf478e7f3a59fc5517a5d8df5537689a6N.exe 90 PID 1156 wrote to memory of 5008 1156 421e48716838b07749b30132827cd63bf478e7f3a59fc5517a5d8df5537689a6N.exe 90 PID 1156 wrote to memory of 5008 1156 421e48716838b07749b30132827cd63bf478e7f3a59fc5517a5d8df5537689a6N.exe 90 PID 1156 wrote to memory of 1356 1156 421e48716838b07749b30132827cd63bf478e7f3a59fc5517a5d8df5537689a6N.exe 91 PID 1156 wrote to memory of 1356 1156 421e48716838b07749b30132827cd63bf478e7f3a59fc5517a5d8df5537689a6N.exe 91 PID 1156 wrote to memory of 1356 1156 421e48716838b07749b30132827cd63bf478e7f3a59fc5517a5d8df5537689a6N.exe 91 PID 1156 wrote to memory of 1356 1156 421e48716838b07749b30132827cd63bf478e7f3a59fc5517a5d8df5537689a6N.exe 91 PID 1156 wrote to memory of 1356 1156 421e48716838b07749b30132827cd63bf478e7f3a59fc5517a5d8df5537689a6N.exe 91 PID 1156 wrote to memory of 1356 1156 421e48716838b07749b30132827cd63bf478e7f3a59fc5517a5d8df5537689a6N.exe 91 PID 1156 wrote to memory of 1356 1156 421e48716838b07749b30132827cd63bf478e7f3a59fc5517a5d8df5537689a6N.exe 91 PID 1156 wrote to memory of 1356 1156 421e48716838b07749b30132827cd63bf478e7f3a59fc5517a5d8df5537689a6N.exe 91 PID 1156 wrote to memory of 1356 1156 421e48716838b07749b30132827cd63bf478e7f3a59fc5517a5d8df5537689a6N.exe 91 PID 1156 wrote to memory of 1356 1156 421e48716838b07749b30132827cd63bf478e7f3a59fc5517a5d8df5537689a6N.exe 91 PID 1156 wrote to memory of 1356 1156 421e48716838b07749b30132827cd63bf478e7f3a59fc5517a5d8df5537689a6N.exe 91 PID 1156 wrote to memory of 1356 1156 421e48716838b07749b30132827cd63bf478e7f3a59fc5517a5d8df5537689a6N.exe 91 PID 1156 wrote to memory of 1356 1156 421e48716838b07749b30132827cd63bf478e7f3a59fc5517a5d8df5537689a6N.exe 91 PID 1156 wrote to memory of 1356 1156 421e48716838b07749b30132827cd63bf478e7f3a59fc5517a5d8df5537689a6N.exe 91 PID 1156 wrote to memory of 1356 1156 421e48716838b07749b30132827cd63bf478e7f3a59fc5517a5d8df5537689a6N.exe 91 PID 1156 wrote to memory of 1356 1156 421e48716838b07749b30132827cd63bf478e7f3a59fc5517a5d8df5537689a6N.exe 91 PID 1156 wrote to memory of 1356 1156 421e48716838b07749b30132827cd63bf478e7f3a59fc5517a5d8df5537689a6N.exe 91 PID 1156 wrote to memory of 1356 1156 421e48716838b07749b30132827cd63bf478e7f3a59fc5517a5d8df5537689a6N.exe 91 PID 1156 wrote to memory of 1356 1156 421e48716838b07749b30132827cd63bf478e7f3a59fc5517a5d8df5537689a6N.exe 91 PID 1156 wrote to memory of 1356 1156 421e48716838b07749b30132827cd63bf478e7f3a59fc5517a5d8df5537689a6N.exe 91 PID 1156 wrote to memory of 1356 1156 421e48716838b07749b30132827cd63bf478e7f3a59fc5517a5d8df5537689a6N.exe 91 PID 1156 wrote to memory of 1356 1156 421e48716838b07749b30132827cd63bf478e7f3a59fc5517a5d8df5537689a6N.exe 91 PID 4992 wrote to memory of 1720 4992 cmd.exe 93 PID 4992 wrote to memory of 1720 4992 cmd.exe 93 PID 4992 wrote to memory of 1720 4992 cmd.exe 93 PID 5008 wrote to memory of 3644 5008 cmd.exe 94 PID 5008 wrote to memory of 3644 5008 cmd.exe 94 PID 5008 wrote to memory of 3644 5008 cmd.exe 94 -
System policy modification 1 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion 421e48716838b07749b30132827cd63bf478e7f3a59fc5517a5d8df5537689a6N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern 421e48716838b07749b30132827cd63bf478e7f3a59fc5517a5d8df5537689a6N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern\NoControlPanel = "1" 421e48716838b07749b30132827cd63bf478e7f3a59fc5517a5d8df5537689a6N.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
pid Process 3644 attrib.exe 1720 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\421e48716838b07749b30132827cd63bf478e7f3a59fc5517a5d8df5537689a6N.exe"C:\Users\Admin\AppData\Local\Temp\421e48716838b07749b30132827cd63bf478e7f3a59fc5517a5d8df5537689a6N.exe"1⤵
- Modifies WinLogon for persistence
- Adds policy Run key to start application
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\421e48716838b07749b30132827cd63bf478e7f3a59fc5517a5d8df5537689a6N.exe"C:\Users\Admin\AppData\Local\Temp\421e48716838b07749b30132827cd63bf478e7f3a59fc5517a5d8df5537689a6N.exe"2⤵
- Modifies WinLogon for persistence
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Disables RegEdit via registry modification
- Checks computer location settings
- Windows security modification
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1156 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\421e48716838b07749b30132827cd63bf478e7f3a59fc5517a5d8df5537689a6N.exe" +s +h3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\421e48716838b07749b30132827cd63bf478e7f3a59fc5517a5d8df5537689a6N.exe" +s +h4⤵
- Sets file to hidden
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:1720
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h4⤵
- Sets file to hidden
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:3644
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad3⤵
- System Location Discovery: System Language Discovery
PID:1356
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
2Modify Registry
8