darkcomet | b35e0f5a1b842a947ffd577ee4521e22612785bacf6dad81c803e7019156797e

Analysis

max time kernel
150s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18-12-2024 12:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe
Size

631KB
MD5

fb7f296bec3cdc8ec079f808a7011fe4
SHA1

30aa9f4978ddf727e86e5c4b381cc61f568f34b9
SHA256

b35e0f5a1b842a947ffd577ee4521e22612785bacf6dad81c803e7019156797e
SHA512

cc08dd452f57957cbf00cf1f2975fdb39edd7edf84e080876ad192170a53ca4d1d6d7f7bc05e19c7629bb689830dda889ba84140e216f2586b8890043b505b59
SSDEEP

12288:UK/xyYT2o0k3vSycsL4YAfY9vNiQNe+91BgHT9/o30i8fKtbc:+puv8QLeEfeh/o3n8Stb

Score

10^/10

darkcomet defense_evasion discovery persistence rat trojan

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Darkcomet family
darkcomet

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	rundll.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	wmpnetvk.exe

Executes dropped EXE 3 IoCs

pid	Process
2308	wmpnetvk.exe
2092	rundll.exe
752	rundll.exe

Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wmpnetvk = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Microsoft\\Protect\\Credentials\\\\wmpnetvk.exe"	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft® Windows® Operating System = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Microsoft\\Protect\\Credentials\\rundll.exe"	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1476 set thread context of 4508	1476	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe	84
PID 2092 set thread context of 752	2092	rundll.exe	97

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 2 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Microsoft\Protect\Credentials\rundll.exe:ZONE.identifier	cmd.exe
File created	C:\Users\Admin\AppData\Local\Temp\Microsoft\Protect\Credentials\wmpnetvk.exe:ZONE.identifier	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmpnetvk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	rundll.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	rundll.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	rundll.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	rundll.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Microsoft\Protect\Credentials\rundll.exe:ZONE.identifier	cmd.exe
File created	C:\Users\Admin\AppData\Local\Temp\Microsoft\Protect\Credentials\wmpnetvk.exe:ZONE.identifier	cmd.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1476	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe
1476	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe
2308	wmpnetvk.exe
1476	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe
1476	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe
1476	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe
2308	wmpnetvk.exe
2092	rundll.exe
1476	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe
2308	wmpnetvk.exe
2308	wmpnetvk.exe
2308	wmpnetvk.exe
2308	wmpnetvk.exe
2308	wmpnetvk.exe
2308	wmpnetvk.exe
2092	rundll.exe
2308	wmpnetvk.exe
2308	wmpnetvk.exe
2308	wmpnetvk.exe
1476	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe
2308	wmpnetvk.exe
2308	wmpnetvk.exe
2308	wmpnetvk.exe
2308	wmpnetvk.exe
2308	wmpnetvk.exe
2308	wmpnetvk.exe
2308	wmpnetvk.exe
2308	wmpnetvk.exe
2308	wmpnetvk.exe
2308	wmpnetvk.exe
2308	wmpnetvk.exe
2308	wmpnetvk.exe
2308	wmpnetvk.exe
2308	wmpnetvk.exe
2308	wmpnetvk.exe
2308	wmpnetvk.exe
2308	wmpnetvk.exe
2308	wmpnetvk.exe
2308	wmpnetvk.exe
2308	wmpnetvk.exe
2308	wmpnetvk.exe
2308	wmpnetvk.exe
2308	wmpnetvk.exe
2308	wmpnetvk.exe
2308	wmpnetvk.exe
2092	rundll.exe
2308	wmpnetvk.exe
2308	wmpnetvk.exe
2308	wmpnetvk.exe
2308	wmpnetvk.exe
1476	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe
2308	wmpnetvk.exe
2308	wmpnetvk.exe
2308	wmpnetvk.exe
2308	wmpnetvk.exe
2308	wmpnetvk.exe
2308	wmpnetvk.exe
2308	wmpnetvk.exe
2308	wmpnetvk.exe
2308	wmpnetvk.exe
2308	wmpnetvk.exe
2308	wmpnetvk.exe
2308	wmpnetvk.exe
2308	wmpnetvk.exe

Suspicious use of AdjustPrivilegeToken 51 IoCs

description	pid	Process
Token: SeDebugPrivilege	1476	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe
Token: SeIncreaseQuotaPrivilege	4508	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe
Token: SeSecurityPrivilege	4508	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	4508	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe
Token: SeLoadDriverPrivilege	4508	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe
Token: SeSystemProfilePrivilege	4508	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe
Token: SeSystemtimePrivilege	4508	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe
Token: SeProfSingleProcessPrivilege	4508	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	4508	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe
Token: SeCreatePagefilePrivilege	4508	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe
Token: SeBackupPrivilege	4508	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe
Token: SeRestorePrivilege	4508	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe
Token: SeShutdownPrivilege	4508	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe
Token: SeDebugPrivilege	4508	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe
Token: SeSystemEnvironmentPrivilege	4508	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe
Token: SeChangeNotifyPrivilege	4508	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe
Token: SeRemoteShutdownPrivilege	4508	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe
Token: SeUndockPrivilege	4508	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe
Token: SeManageVolumePrivilege	4508	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe
Token: SeImpersonatePrivilege	4508	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe
Token: SeCreateGlobalPrivilege	4508	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe
Token: 33	4508	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe
Token: 34	4508	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe
Token: 35	4508	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe
Token: 36	4508	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe
Token: SeDebugPrivilege	2308	wmpnetvk.exe
Token: SeDebugPrivilege	2092	rundll.exe
Token: SeIncreaseQuotaPrivilege	752	rundll.exe
Token: SeSecurityPrivilege	752	rundll.exe
Token: SeTakeOwnershipPrivilege	752	rundll.exe
Token: SeLoadDriverPrivilege	752	rundll.exe
Token: SeSystemProfilePrivilege	752	rundll.exe
Token: SeSystemtimePrivilege	752	rundll.exe
Token: SeProfSingleProcessPrivilege	752	rundll.exe
Token: SeIncBasePriorityPrivilege	752	rundll.exe
Token: SeCreatePagefilePrivilege	752	rundll.exe
Token: SeBackupPrivilege	752	rundll.exe
Token: SeRestorePrivilege	752	rundll.exe
Token: SeShutdownPrivilege	752	rundll.exe
Token: SeDebugPrivilege	752	rundll.exe
Token: SeSystemEnvironmentPrivilege	752	rundll.exe
Token: SeChangeNotifyPrivilege	752	rundll.exe
Token: SeRemoteShutdownPrivilege	752	rundll.exe
Token: SeUndockPrivilege	752	rundll.exe
Token: SeManageVolumePrivilege	752	rundll.exe
Token: SeImpersonatePrivilege	752	rundll.exe
Token: SeCreateGlobalPrivilege	752	rundll.exe
Token: 33	752	rundll.exe
Token: 34	752	rundll.exe
Token: 35	752	rundll.exe
Token: 36	752	rundll.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4508	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 55 IoCs

description	pid	Process	procid_target
PID 1476 wrote to memory of 2648	1476	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe	83
PID 1476 wrote to memory of 2648	1476	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe	83
PID 1476 wrote to memory of 2648	1476	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe	83
PID 1476 wrote to memory of 4508	1476	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe	84
PID 1476 wrote to memory of 4508	1476	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe	84
PID 1476 wrote to memory of 4508	1476	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe	84
PID 1476 wrote to memory of 4508	1476	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe	84
PID 1476 wrote to memory of 4508	1476	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe	84
PID 1476 wrote to memory of 4508	1476	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe	84
PID 1476 wrote to memory of 4508	1476	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe	84
PID 1476 wrote to memory of 4508	1476	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe	84
PID 1476 wrote to memory of 4508	1476	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe	84
PID 1476 wrote to memory of 4508	1476	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe	84
PID 1476 wrote to memory of 4508	1476	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe	84
PID 1476 wrote to memory of 4508	1476	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe	84
PID 1476 wrote to memory of 4508	1476	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe	84
PID 1476 wrote to memory of 4508	1476	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe	84
PID 1476 wrote to memory of 3604	1476	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe	85
PID 1476 wrote to memory of 3604	1476	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe	85
PID 1476 wrote to memory of 3604	1476	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe	85
PID 3604 wrote to memory of 5064	3604	vbc.exe	87
PID 3604 wrote to memory of 5064	3604	vbc.exe	87
PID 3604 wrote to memory of 5064	3604	vbc.exe	87
PID 1476 wrote to memory of 2964	1476	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe	88
PID 1476 wrote to memory of 2964	1476	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe	88
PID 1476 wrote to memory of 2964	1476	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe	88
PID 1476 wrote to memory of 324	1476	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe	90
PID 1476 wrote to memory of 324	1476	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe	90
PID 1476 wrote to memory of 324	1476	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe	90
PID 1476 wrote to memory of 4892	1476	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe	92
PID 1476 wrote to memory of 4892	1476	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe	92
PID 1476 wrote to memory of 4892	1476	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe	92
PID 1476 wrote to memory of 2308	1476	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe	94
PID 1476 wrote to memory of 2308	1476	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe	94
PID 1476 wrote to memory of 2308	1476	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe	94
PID 2308 wrote to memory of 2092	2308	wmpnetvk.exe	95
PID 2308 wrote to memory of 2092	2308	wmpnetvk.exe	95
PID 2308 wrote to memory of 2092	2308	wmpnetvk.exe	95
PID 2092 wrote to memory of 3244	2092	rundll.exe	96
PID 2092 wrote to memory of 3244	2092	rundll.exe	96
PID 2092 wrote to memory of 3244	2092	rundll.exe	96
PID 2092 wrote to memory of 752	2092	rundll.exe	97
PID 2092 wrote to memory of 752	2092	rundll.exe	97
PID 2092 wrote to memory of 752	2092	rundll.exe	97
PID 2092 wrote to memory of 752	2092	rundll.exe	97
PID 2092 wrote to memory of 752	2092	rundll.exe	97
PID 2092 wrote to memory of 752	2092	rundll.exe	97
PID 2092 wrote to memory of 752	2092	rundll.exe	97
PID 2092 wrote to memory of 752	2092	rundll.exe	97
PID 2092 wrote to memory of 752	2092	rundll.exe	97
PID 2092 wrote to memory of 752	2092	rundll.exe	97
PID 2092 wrote to memory of 752	2092	rundll.exe	97
PID 2092 wrote to memory of 752	2092	rundll.exe	97
PID 2092 wrote to memory of 752	2092	rundll.exe	97
PID 2092 wrote to memory of 752	2092	rundll.exe	97

C:\Users\Admin\AppData\Local\Temp\fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1476
- C:\Users\Admin\AppData\Local\Temp\fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe
  fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe
  2⤵
  PID:2648
- C:\Users\Admin\AppData\Local\Temp\fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe
  fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe
  2⤵
  - Checks BIOS information in registry
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:4508
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\fvmzb6lj.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3604
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES856C.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc2E33A98A4C774BA98153F2FECE8EF0FC.TMP"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5064
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2964
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - System Location Discovery: System Language Discovery
  - NTFS ADS
  PID:324
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - System Location Discovery: System Language Discovery
  - NTFS ADS
  PID:4892
- C:\Users\Admin\AppData\Local\Temp\Microsoft\Protect\Credentials\wmpnetvk.exe
  "C:\Users\Admin\AppData\Local\Temp\Microsoft\Protect\Credentials\wmpnetvk.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2308
- - C:\Users\Admin\AppData\Local\Temp\Microsoft\Protect\Credentials\rundll.exe
    "C:\Users\Admin\AppData\Local\Temp\Microsoft\Protect\Credentials\rundll.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2092
  - - C:\Users\Admin\AppData\Local\Temp\Microsoft\Protect\Credentials\rundll.exe
      rundll.exe
      4⤵
      PID:3244
  - - C:\Users\Admin\AppData\Local\Temp\Microsoft\Protect\Credentials\rundll.exe
      rundll.exe
      4⤵
      Checks BIOS information in registry
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Checks processor information in registry
      Enumerates system info in registry
      Suspicious use of AdjustPrivilegeToken
      PID:752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Microsoft\Protect\Credentials\wmpnetvk.exe

Filesize
7KB

MD5
e8ae231caeba7ca39abed45e93edf410

SHA1
98721ecfe929e612cf1686ed1e50696c471469e9

SHA256
c9d9c2e3303d296127dcf504afa35d6f8306e414614941e69f6bc9165bf2f36c

SHA512
63bbc225bca915dab6df54ebb7cb2348982229afd1d0a80823c85db4761776c5b73414c4c309b3fec584d68e23cadf673e952db66b0af59d7535ee570d1dfd51

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft\Protect\Credentials\xCocaine.txt

Filesize
631KB

MD5
fb7f296bec3cdc8ec079f808a7011fe4

SHA1
30aa9f4978ddf727e86e5c4b381cc61f568f34b9

SHA256
b35e0f5a1b842a947ffd577ee4521e22612785bacf6dad81c803e7019156797e

SHA512
cc08dd452f57957cbf00cf1f2975fdb39edd7edf84e080876ad192170a53ca4d1d6d7f7bc05e19c7629bb689830dda889ba84140e216f2586b8890043b505b59

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES856C.tmp

Filesize
1KB

MD5
d927bfcc15b157dd70749d7d35ded90b

SHA1
556316657a186b4ab59e31c12ed9c92e7ae6922f

SHA256
9b3344a44b71f6d8b439f8f7c815dcee982b68cf74f30fc83b4216212c69f216

SHA512
84f792e3163ca2696421a5a38b41dd52c118e5dfafe5caa6a444d480333bfc5d3772fed9126a3840dc8e9c0a391c746cccdf8abacb7703b0a585b39c5b9ef1fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\fvmzb6lj.0.vb

Filesize
1KB

MD5
29622516e4c9be1feb693b51ddfaa6d0

SHA1
7fd2f564a95f14101b4047d2728beedde60abb6f

SHA256
92db35abc01755d4e309ae6d956fe58d93fb3614cc9b10036ff4e473e872de15

SHA512
cf487e2d84996a48931244f5616cd24a8544baeb543b1775ebd2824acc8e40458608d20bbc6bcd58afed4150bea183b08e23ea5e631ee66914a8ef5bb5cad29d

Download Submit
C:\Users\Admin\AppData\Local\Temp\fvmzb6lj.cmdline

Filesize
314B

MD5
1d538a1d46ccf0b30e7a6817cb71969d

SHA1
fefe3bdaffbf88b485f99979ac51b1b7d74c5b28

SHA256
b3303881c5866a4e0f2da6bf6ebad5307f842a6ea3cdbe0e314620e389335bf4

SHA512
7d517c1623342a51c449fab0748856f2baabe7bbcb565609853aa1ad61c650fa1a02a471131e72b09d76aeb8b49a3a3ace1c57c341463d2eff9b96901f00015b

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbc2E33A98A4C774BA98153F2FECE8EF0FC.TMP

Filesize
652B

MD5
4b2d458e7dd9a506cc9fc9e6db3c1051

SHA1
b149eabc7625d5aa1fa71a542901618558e4ea5e

SHA256
82bb2e03bfb28c5918a6f62e107aeca29ba6a1f7347eb2c114aac34dd0dc4ca7

SHA512
3c6cd9fcdbc895ab579925a0fa5bac64d742d496bc07fcb3eae4d4375a5b2b9ae8ce5c24ea8d74a8fc02a05c959df77f58cd41f4a34bdf7d09e501394cc0baac

Download Submit
memory/1476-2-0x00000000750C0000-0x0000000075671000-memory.dmp

Filesize
5.7MB

Download
memory/1476-39-0x00000000750C0000-0x0000000075671000-memory.dmp

Filesize
5.7MB

Download
memory/1476-38-0x00000000750C0000-0x0000000075671000-memory.dmp

Filesize
5.7MB

Download
memory/1476-37-0x00000000750C2000-0x00000000750C3000-memory.dmp

Filesize
4KB

Download
memory/1476-0-0x00000000750C2000-0x00000000750C3000-memory.dmp

Filesize
4KB

Download
memory/1476-1-0x00000000750C0000-0x0000000075671000-memory.dmp

Filesize
5.7MB

Download
memory/3604-15-0x0000000002220000-0x0000000002230000-memory.dmp

Filesize
64KB

Download
memory/4508-5-0x0000000013140000-0x00000000131F6000-memory.dmp

Filesize
728KB

Download
memory/4508-3-0x0000000013140000-0x00000000131F6000-memory.dmp

Filesize
728KB

Download
memory/4508-4-0x0000000013140000-0x00000000131F6000-memory.dmp

Filesize
728KB

Download
memory/4508-7-0x0000000002410000-0x0000000002411000-memory.dmp

Filesize
4KB

Download
memory/4508-9-0x0000000013140000-0x00000000131F6000-memory.dmp

Filesize
728KB

Download
memory/4508-10-0x0000000013140000-0x00000000131F6000-memory.dmp

Filesize
728KB

Download
memory/4508-8-0x0000000013140000-0x00000000131F6000-memory.dmp

Filesize
728KB

Download