darkcomet | 628ff193256507f8c7ee292dbb844eb1af73dd40370225d07f91823f9b7a80bf

Analysis

max time kernel
145s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01-01-2025 01:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_423e2a21a50500e685a172c24ec0f433.exe
Size

811KB
MD5

423e2a21a50500e685a172c24ec0f433
SHA1

f36cedcbc57957e9bc238e538b9057d4df66eaa7
SHA256

628ff193256507f8c7ee292dbb844eb1af73dd40370225d07f91823f9b7a80bf
SHA512

f33303b6db5cf4786debea19d7277e10f3067392989abf0f617ce79147c3a46244f710f9945ca640f4a092b49ba574280e55c7ecf02c8c76c7a28a3eb7668785
SSDEEP

24576:lAEENIq8XwyVPQclDq/+WnpsSdD0QZh9uL:lAEsw722Wn8L

Score

10^/10

darkcomet discovery persistence rat trojan

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Darkcomet family
darkcomet

Modifies WinLogon for persistence 2 TTPs 24 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windark\\windark.exe"	JaffaCakes118_423e2a21a50500e685a172c24ec0f433.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe"	windark.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe"	windark.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe"	windark.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe"	windark.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe"	windark.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe"	windark.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe"	windark.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe"	windark.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe"	windark.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe"	windark.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe"	windark.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe"	windark.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe"	windark.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe"	windark.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe"	windark.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe"	windark.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe"	windark.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe"	windark.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe"	windark.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe"	windark.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe"	windark.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe"	windark.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe,C:\\Windows\\system32\\Windark\\windark.exe"	windark.exe

Checks BIOS information in registry 2 TTPs 24 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	windark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	windark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	JaffaCakes118_423e2a21a50500e685a172c24ec0f433.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	windark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	windark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	windark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	windark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	windark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	windark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	windark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	windark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	windark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	windark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	windark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	windark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	windark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	windark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	windark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	windark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	windark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	windark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	windark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	windark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	windark.exe

Deletes itself 1 IoCs

pid	Process
2772	cmd.exe

Executes dropped EXE 23 IoCs

pid	Process
2680	windark.exe
1820	windark.exe
1980	windark.exe
2864	windark.exe
1456	windark.exe
1632	windark.exe
1356	windark.exe
1952	windark.exe
2736	windark.exe
2772	windark.exe
2160	windark.exe
1052	windark.exe
2236	windark.exe
2608	windark.exe
2936	windark.exe
552	windark.exe
1688	windark.exe
2784	windark.exe
2052	windark.exe
1992	windark.exe
2652	windark.exe
592	windark.exe
448	windark.exe

Loads dropped DLL 46 IoCs

pid	Process
1964	JaffaCakes118_423e2a21a50500e685a172c24ec0f433.exe
1964	JaffaCakes118_423e2a21a50500e685a172c24ec0f433.exe
2680	windark.exe
2680	windark.exe
1820	windark.exe
1820	windark.exe
1980	windark.exe
1980	windark.exe
2864	windark.exe
2864	windark.exe
1456	windark.exe
1456	windark.exe
1632	windark.exe
1632	windark.exe
1356	windark.exe
1356	windark.exe
1952	windark.exe
1952	windark.exe
2736	windark.exe
2736	windark.exe
2772	windark.exe
2772	windark.exe
2160	windark.exe
2160	windark.exe
1052	windark.exe
1052	windark.exe
2236	windark.exe
2236	windark.exe
2608	windark.exe
2608	windark.exe
2936	windark.exe
2936	windark.exe
552	windark.exe
552	windark.exe
1688	windark.exe
1688	windark.exe
2784	windark.exe
2784	windark.exe
2052	windark.exe
2052	windark.exe
1992	windark.exe
1992	windark.exe
2652	windark.exe
2652	windark.exe
592	windark.exe
592	windark.exe

Adds Run key to start application 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\windark = "C:\\Windows\\system32\\Windark\\windark.exe"	JaffaCakes118_423e2a21a50500e685a172c24ec0f433.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\windark = "C:\\Windows\\system32\\Windark\\windark.exe"	windark.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\windark = "C:\\Windows\\system32\\Windark\\windark.exe"	windark.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\windark = "C:\\Windows\\system32\\Windark\\windark.exe"	windark.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\windark = "C:\\Windows\\system32\\Windark\\windark.exe"	windark.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\windark = "C:\\Windows\\system32\\Windark\\windark.exe"	windark.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\windark = "C:\\Windows\\system32\\Windark\\windark.exe"	windark.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\windark = "C:\\Windows\\system32\\Windark\\windark.exe"	windark.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\windark = "C:\\Windows\\system32\\Windark\\windark.exe"	windark.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\windark = "C:\\Windows\\system32\\Windark\\windark.exe"	windark.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\windark = "C:\\Windows\\system32\\Windark\\windark.exe"	windark.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\windark = "C:\\Windows\\system32\\Windark\\windark.exe"	windark.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\windark = "C:\\Windows\\system32\\Windark\\windark.exe"	windark.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\windark = "C:\\Windows\\system32\\Windark\\windark.exe"	windark.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\windark = "C:\\Windows\\system32\\Windark\\windark.exe"	windark.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\windark = "C:\\Windows\\system32\\Windark\\windark.exe"	windark.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\windark = "C:\\Windows\\system32\\Windark\\windark.exe"	windark.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\windark = "C:\\Windows\\system32\\Windark\\windark.exe"	windark.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\windark = "C:\\Windows\\system32\\Windark\\windark.exe"	windark.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\windark = "C:\\Windows\\system32\\Windark\\windark.exe"	windark.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\windark = "C:\\Windows\\system32\\Windark\\windark.exe"	windark.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\windark = "C:\\Windows\\system32\\Windark\\windark.exe"	windark.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\windark = "C:\\Windows\\system32\\Windark\\windark.exe"	windark.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\windark = "C:\\Windows\\system32\\Windark\\windark.exe"	windark.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Windark\windark.exe	windark.exe
File opened for modification	C:\Windows\SysWOW64\Windark\	windark.exe
File opened for modification	C:\Windows\SysWOW64\Windark\windark.exe	windark.exe
File opened for modification	C:\Windows\SysWOW64\Windark\	windark.exe
File created	C:\Windows\SysWOW64\Windark\windark.exe	windark.exe
File opened for modification	C:\Windows\SysWOW64\Windark\	windark.exe
File created	C:\Windows\SysWOW64\Windark\windark.exe	windark.exe
File opened for modification	C:\Windows\SysWOW64\Windark\	windark.exe
File opened for modification	C:\Windows\SysWOW64\Windark\	windark.exe
File opened for modification	C:\Windows\SysWOW64\Windark\	windark.exe
File opened for modification	C:\Windows\SysWOW64\Windark\windark.exe	windark.exe
File created	C:\Windows\SysWOW64\Windark\windark.exe	windark.exe
File created	C:\Windows\SysWOW64\Windark\windark.exe	windark.exe
File opened for modification	C:\Windows\SysWOW64\Windark\windark.exe	windark.exe
File opened for modification	C:\Windows\SysWOW64\Windark\	windark.exe
File created	C:\Windows\SysWOW64\Windark\windark.exe	windark.exe
File opened for modification	C:\Windows\SysWOW64\Windark\windark.exe	JaffaCakes118_423e2a21a50500e685a172c24ec0f433.exe
File opened for modification	C:\Windows\SysWOW64\Windark\windark.exe	windark.exe
File opened for modification	C:\Windows\SysWOW64\Windark\	windark.exe
File created	C:\Windows\SysWOW64\Windark\windark.exe	windark.exe
File opened for modification	C:\Windows\SysWOW64\Windark\windark.exe	windark.exe
File created	C:\Windows\SysWOW64\Windark\windark.exe	windark.exe
File opened for modification	C:\Windows\SysWOW64\Windark\	windark.exe
File opened for modification	C:\Windows\SysWOW64\Windark\	windark.exe
File opened for modification	C:\Windows\SysWOW64\Windark\windark.exe	windark.exe
File created	C:\Windows\SysWOW64\Windark\windark.exe	windark.exe
File opened for modification	C:\Windows\SysWOW64\Windark\	JaffaCakes118_423e2a21a50500e685a172c24ec0f433.exe
File created	C:\Windows\SysWOW64\Windark\windark.exe	windark.exe
File opened for modification	C:\Windows\SysWOW64\Windark\windark.exe	windark.exe
File opened for modification	C:\Windows\SysWOW64\Windark\windark.exe	windark.exe
File created	C:\Windows\SysWOW64\Windark\windark.exe	windark.exe
File created	C:\Windows\SysWOW64\Windark\windark.exe	windark.exe
File opened for modification	C:\Windows\SysWOW64\Windark\windark.exe	windark.exe
File opened for modification	C:\Windows\SysWOW64\Windark\	windark.exe
File opened for modification	C:\Windows\SysWOW64\Windark\windark.exe	windark.exe
File created	C:\Windows\SysWOW64\Windark\windark.exe	windark.exe
File opened for modification	C:\Windows\SysWOW64\Windark\windark.exe	windark.exe
File opened for modification	C:\Windows\SysWOW64\Windark\windark.exe	windark.exe
File opened for modification	C:\Windows\SysWOW64\Windark\	windark.exe
File opened for modification	C:\Windows\SysWOW64\Windark\	windark.exe
File created	C:\Windows\SysWOW64\Windark\windark.exe	windark.exe
File created	C:\Windows\SysWOW64\Windark\windark.exe	windark.exe
File opened for modification	C:\Windows\SysWOW64\Windark\windark.exe	windark.exe
File created	C:\Windows\SysWOW64\Windark\windark.exe	windark.exe
File created	C:\Windows\SysWOW64\Windark\windark.exe	windark.exe
File opened for modification	C:\Windows\SysWOW64\Windark\windark.exe	windark.exe
File opened for modification	C:\Windows\SysWOW64\Windark\windark.exe	windark.exe
File created	C:\Windows\SysWOW64\Windark\windark.exe	windark.exe
File opened for modification	C:\Windows\SysWOW64\Windark\windark.exe	windark.exe
File opened for modification	C:\Windows\SysWOW64\Windark\windark.exe	windark.exe
File opened for modification	C:\Windows\SysWOW64\Windark\	windark.exe
File opened for modification	C:\Windows\SysWOW64\Windark\	windark.exe
File created	C:\Windows\SysWOW64\Windark\windark.exe	windark.exe
File created	C:\Windows\SysWOW64\Windark\windark.exe	windark.exe
File opened for modification	C:\Windows\SysWOW64\Windark\	windark.exe
File opened for modification	C:\Windows\SysWOW64\Windark\	windark.exe
File created	C:\Windows\SysWOW64\Windark\windark.exe	JaffaCakes118_423e2a21a50500e685a172c24ec0f433.exe
File opened for modification	C:\Windows\SysWOW64\Windark\windark.exe	windark.exe
File created	C:\Windows\SysWOW64\Windark\windark.exe	windark.exe
File opened for modification	C:\Windows\SysWOW64\Windark\	windark.exe
File opened for modification	C:\Windows\SysWOW64\Windark\windark.exe	windark.exe
File opened for modification	C:\Windows\SysWOW64\Windark\	windark.exe
File opened for modification	C:\Windows\SysWOW64\Windark\windark.exe	windark.exe
File opened for modification	C:\Windows\SysWOW64\Windark\windark.exe	windark.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windark.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windark.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windark.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windark.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windark.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windark.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windark.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windark.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windark.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windark.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windark.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windark.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windark.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windark.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windark.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windark.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windark.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windark.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windark.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_423e2a21a50500e685a172c24ec0f433.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windark.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 23 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2164	PING.EXE
784	PING.EXE
644	PING.EXE
1060	PING.EXE
1804	PING.EXE
568	PING.EXE
340	PING.EXE
2384	PING.EXE
2112	PING.EXE
2356	PING.EXE
2564	PING.EXE
3032	PING.EXE
2748	PING.EXE
2820	PING.EXE
644	PING.EXE
1096	PING.EXE
2600	PING.EXE
1240	PING.EXE
2388	PING.EXE
1724	PING.EXE
2084	PING.EXE
2256	PING.EXE
1308	PING.EXE

Checks processor information in registry 2 TTPs 64 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	windark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	windark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	windark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	windark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	windark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	windark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	windark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	JaffaCakes118_423e2a21a50500e685a172c24ec0f433.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	windark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	windark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	windark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	windark.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	windark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	windark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	windark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	windark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	windark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	windark.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	JaffaCakes118_423e2a21a50500e685a172c24ec0f433.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	JaffaCakes118_423e2a21a50500e685a172c24ec0f433.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	windark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	windark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	windark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	windark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	windark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	windark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	windark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	windark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	windark.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	windark.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	windark.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	windark.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	windark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	windark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	windark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	windark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	windark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	windark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	windark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	windark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	windark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	windark.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	windark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	windark.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	windark.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	windark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	windark.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	windark.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	windark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	windark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	windark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	windark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	windark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	windark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	windark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	windark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	windark.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	windark.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	windark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	windark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	windark.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	windark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	windark.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	windark.exe

Enumerates system info in registry 2 TTPs 24 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	windark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	windark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	windark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	windark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	JaffaCakes118_423e2a21a50500e685a172c24ec0f433.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	windark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	windark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	windark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	windark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	windark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	windark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	windark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	windark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	windark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	windark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	windark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	windark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	windark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	windark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	windark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	windark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	windark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	windark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	windark.exe

Runs ping.exe 1 TTPs 23 IoCs

Remote System Discovery

T1018

pid	Process
2164	PING.EXE
644	PING.EXE
2748	PING.EXE
2564	PING.EXE
1060	PING.EXE
644	PING.EXE
1724	PING.EXE
2256	PING.EXE
2356	PING.EXE
2388	PING.EXE
2600	PING.EXE
784	PING.EXE
3032	PING.EXE
1804	PING.EXE
340	PING.EXE
1096	PING.EXE
2384	PING.EXE
2084	PING.EXE
568	PING.EXE
1308	PING.EXE
1240	PING.EXE
2820	PING.EXE
2112	PING.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	1964	JaffaCakes118_423e2a21a50500e685a172c24ec0f433.exe
Token: SeSecurityPrivilege	1964	JaffaCakes118_423e2a21a50500e685a172c24ec0f433.exe
Token: SeTakeOwnershipPrivilege	1964	JaffaCakes118_423e2a21a50500e685a172c24ec0f433.exe
Token: SeLoadDriverPrivilege	1964	JaffaCakes118_423e2a21a50500e685a172c24ec0f433.exe
Token: SeSystemProfilePrivilege	1964	JaffaCakes118_423e2a21a50500e685a172c24ec0f433.exe
Token: SeSystemtimePrivilege	1964	JaffaCakes118_423e2a21a50500e685a172c24ec0f433.exe
Token: SeProfSingleProcessPrivilege	1964	JaffaCakes118_423e2a21a50500e685a172c24ec0f433.exe
Token: SeIncBasePriorityPrivilege	1964	JaffaCakes118_423e2a21a50500e685a172c24ec0f433.exe
Token: SeCreatePagefilePrivilege	1964	JaffaCakes118_423e2a21a50500e685a172c24ec0f433.exe
Token: SeBackupPrivilege	1964	JaffaCakes118_423e2a21a50500e685a172c24ec0f433.exe
Token: SeRestorePrivilege	1964	JaffaCakes118_423e2a21a50500e685a172c24ec0f433.exe
Token: SeShutdownPrivilege	1964	JaffaCakes118_423e2a21a50500e685a172c24ec0f433.exe
Token: SeDebugPrivilege	1964	JaffaCakes118_423e2a21a50500e685a172c24ec0f433.exe
Token: SeSystemEnvironmentPrivilege	1964	JaffaCakes118_423e2a21a50500e685a172c24ec0f433.exe
Token: SeChangeNotifyPrivilege	1964	JaffaCakes118_423e2a21a50500e685a172c24ec0f433.exe
Token: SeRemoteShutdownPrivilege	1964	JaffaCakes118_423e2a21a50500e685a172c24ec0f433.exe
Token: SeUndockPrivilege	1964	JaffaCakes118_423e2a21a50500e685a172c24ec0f433.exe
Token: SeManageVolumePrivilege	1964	JaffaCakes118_423e2a21a50500e685a172c24ec0f433.exe
Token: SeImpersonatePrivilege	1964	JaffaCakes118_423e2a21a50500e685a172c24ec0f433.exe
Token: SeCreateGlobalPrivilege	1964	JaffaCakes118_423e2a21a50500e685a172c24ec0f433.exe
Token: 33	1964	JaffaCakes118_423e2a21a50500e685a172c24ec0f433.exe
Token: 34	1964	JaffaCakes118_423e2a21a50500e685a172c24ec0f433.exe
Token: 35	1964	JaffaCakes118_423e2a21a50500e685a172c24ec0f433.exe
Token: SeIncreaseQuotaPrivilege	2680	windark.exe
Token: SeSecurityPrivilege	2680	windark.exe
Token: SeTakeOwnershipPrivilege	2680	windark.exe
Token: SeLoadDriverPrivilege	2680	windark.exe
Token: SeSystemProfilePrivilege	2680	windark.exe
Token: SeSystemtimePrivilege	2680	windark.exe
Token: SeProfSingleProcessPrivilege	2680	windark.exe
Token: SeIncBasePriorityPrivilege	2680	windark.exe
Token: SeCreatePagefilePrivilege	2680	windark.exe
Token: SeBackupPrivilege	2680	windark.exe
Token: SeRestorePrivilege	2680	windark.exe
Token: SeShutdownPrivilege	2680	windark.exe
Token: SeDebugPrivilege	2680	windark.exe
Token: SeSystemEnvironmentPrivilege	2680	windark.exe
Token: SeChangeNotifyPrivilege	2680	windark.exe
Token: SeRemoteShutdownPrivilege	2680	windark.exe
Token: SeUndockPrivilege	2680	windark.exe
Token: SeManageVolumePrivilege	2680	windark.exe
Token: SeImpersonatePrivilege	2680	windark.exe
Token: SeCreateGlobalPrivilege	2680	windark.exe
Token: 33	2680	windark.exe
Token: 34	2680	windark.exe
Token: 35	2680	windark.exe
Token: SeIncreaseQuotaPrivilege	1820	windark.exe
Token: SeSecurityPrivilege	1820	windark.exe
Token: SeTakeOwnershipPrivilege	1820	windark.exe
Token: SeLoadDriverPrivilege	1820	windark.exe
Token: SeSystemProfilePrivilege	1820	windark.exe
Token: SeSystemtimePrivilege	1820	windark.exe
Token: SeProfSingleProcessPrivilege	1820	windark.exe
Token: SeIncBasePriorityPrivilege	1820	windark.exe
Token: SeCreatePagefilePrivilege	1820	windark.exe
Token: SeBackupPrivilege	1820	windark.exe
Token: SeRestorePrivilege	1820	windark.exe
Token: SeShutdownPrivilege	1820	windark.exe
Token: SeDebugPrivilege	1820	windark.exe
Token: SeSystemEnvironmentPrivilege	1820	windark.exe
Token: SeChangeNotifyPrivilege	1820	windark.exe
Token: SeRemoteShutdownPrivilege	1820	windark.exe
Token: SeUndockPrivilege	1820	windark.exe
Token: SeManageVolumePrivilege	1820	windark.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 2680	1964	JaffaCakes118_423e2a21a50500e685a172c24ec0f433.exe	30
PID 1964 wrote to memory of 2680	1964	JaffaCakes118_423e2a21a50500e685a172c24ec0f433.exe	30
PID 1964 wrote to memory of 2680	1964	JaffaCakes118_423e2a21a50500e685a172c24ec0f433.exe	30
PID 1964 wrote to memory of 2680	1964	JaffaCakes118_423e2a21a50500e685a172c24ec0f433.exe	30
PID 1964 wrote to memory of 2772	1964	JaffaCakes118_423e2a21a50500e685a172c24ec0f433.exe	31
PID 1964 wrote to memory of 2772	1964	JaffaCakes118_423e2a21a50500e685a172c24ec0f433.exe	31
PID 1964 wrote to memory of 2772	1964	JaffaCakes118_423e2a21a50500e685a172c24ec0f433.exe	31
PID 1964 wrote to memory of 2772	1964	JaffaCakes118_423e2a21a50500e685a172c24ec0f433.exe	31
PID 2772 wrote to memory of 2564	2772	cmd.exe	33
PID 2772 wrote to memory of 2564	2772	cmd.exe	33
PID 2772 wrote to memory of 2564	2772	cmd.exe	33
PID 2772 wrote to memory of 2564	2772	cmd.exe	33
PID 2680 wrote to memory of 1820	2680	windark.exe	34
PID 2680 wrote to memory of 1820	2680	windark.exe	34
PID 2680 wrote to memory of 1820	2680	windark.exe	34
PID 2680 wrote to memory of 1820	2680	windark.exe	34
PID 2680 wrote to memory of 2560	2680	windark.exe	35
PID 2680 wrote to memory of 2560	2680	windark.exe	35
PID 2680 wrote to memory of 2560	2680	windark.exe	35
PID 2680 wrote to memory of 2560	2680	windark.exe	35
PID 2560 wrote to memory of 2164	2560	cmd.exe	37
PID 2560 wrote to memory of 2164	2560	cmd.exe	37
PID 2560 wrote to memory of 2164	2560	cmd.exe	37
PID 2560 wrote to memory of 2164	2560	cmd.exe	37
PID 1820 wrote to memory of 1980	1820	windark.exe	38
PID 1820 wrote to memory of 1980	1820	windark.exe	38
PID 1820 wrote to memory of 1980	1820	windark.exe	38
PID 1820 wrote to memory of 1980	1820	windark.exe	38
PID 1820 wrote to memory of 2816	1820	windark.exe	39
PID 1820 wrote to memory of 2816	1820	windark.exe	39
PID 1820 wrote to memory of 2816	1820	windark.exe	39
PID 1820 wrote to memory of 2816	1820	windark.exe	39
PID 2816 wrote to memory of 784	2816	cmd.exe	41
PID 2816 wrote to memory of 784	2816	cmd.exe	41
PID 2816 wrote to memory of 784	2816	cmd.exe	41
PID 2816 wrote to memory of 784	2816	cmd.exe	41
PID 1980 wrote to memory of 2864	1980	windark.exe	42
PID 1980 wrote to memory of 2864	1980	windark.exe	42
PID 1980 wrote to memory of 2864	1980	windark.exe	42
PID 1980 wrote to memory of 2864	1980	windark.exe	42
PID 1980 wrote to memory of 600	1980	windark.exe	43
PID 1980 wrote to memory of 600	1980	windark.exe	43
PID 1980 wrote to memory of 600	1980	windark.exe	43
PID 1980 wrote to memory of 600	1980	windark.exe	43
PID 600 wrote to memory of 644	600	cmd.exe	45
PID 600 wrote to memory of 644	600	cmd.exe	45
PID 600 wrote to memory of 644	600	cmd.exe	45
PID 600 wrote to memory of 644	600	cmd.exe	45
PID 2864 wrote to memory of 1456	2864	windark.exe	46
PID 2864 wrote to memory of 1456	2864	windark.exe	46
PID 2864 wrote to memory of 1456	2864	windark.exe	46
PID 2864 wrote to memory of 1456	2864	windark.exe	46
PID 2864 wrote to memory of 2912	2864	windark.exe	47
PID 2864 wrote to memory of 2912	2864	windark.exe	47
PID 2864 wrote to memory of 2912	2864	windark.exe	47
PID 2864 wrote to memory of 2912	2864	windark.exe	47
PID 2912 wrote to memory of 1060	2912	cmd.exe	49
PID 2912 wrote to memory of 1060	2912	cmd.exe	49
PID 2912 wrote to memory of 1060	2912	cmd.exe	49
PID 2912 wrote to memory of 1060	2912	cmd.exe	49
PID 1456 wrote to memory of 1632	1456	windark.exe	50
PID 1456 wrote to memory of 1632	1456	windark.exe	50
PID 1456 wrote to memory of 1632	1456	windark.exe	50
PID 1456 wrote to memory of 1632	1456	windark.exe	50

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_423e2a21a50500e685a172c24ec0f433.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_423e2a21a50500e685a172c24ec0f433.exe"
1⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Windows\SysWOW64\Windark\windark.exe
  "C:\Windows\system32\Windark\windark.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2680
- - C:\Windows\SysWOW64\Windark\windark.exe
    "C:\Windows\system32\Windark\windark.exe"
    3⤵
    - Modifies WinLogon for persistence
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1820
  - - C:\Windows\SysWOW64\Windark\windark.exe
      "C:\Windows\system32\Windark\windark.exe"
      4⤵
      Modifies WinLogon for persistence
      Checks BIOS information in registry
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Checks processor information in registry
      Enumerates system info in registry
      Suspicious use of WriteProcessMemory
      PID:1980
    - - C:\Windows\SysWOW64\Windark\windark.exe
        
        "C:\Windows\system32\Windark\windark.exe"
        5⤵
        Modifies WinLogon for persistence
        Checks BIOS information in registry
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Enumerates system info in registry
        Suspicious use of WriteProcessMemory
        
        PID:2864
      - C:\Windows\SysWOW64\Windark\windark.exe
        
        "C:\Windows\system32\Windark\windark.exe"
        6⤵
        Modifies WinLogon for persistence
        Checks BIOS information in registry
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        Checks processor information in registry
        Enumerates system info in registry
        Suspicious use of WriteProcessMemory
        
        PID:1456
        
        C:\Windows\SysWOW64\Windark\windark.exe
        
        "C:\Windows\system32\Windark\windark.exe"
        7⤵
        Modifies WinLogon for persistence
        Checks BIOS information in registry
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:1632
        
        C:\Windows\SysWOW64\Windark\windark.exe
        
        "C:\Windows\system32\Windark\windark.exe"
        8⤵
        Modifies WinLogon for persistence
        Checks BIOS information in registry
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:1356
        
        C:\Windows\SysWOW64\Windark\windark.exe
        
        "C:\Windows\system32\Windark\windark.exe"
        9⤵
        Modifies WinLogon for persistence
        Checks BIOS information in registry
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:1952
        
        C:\Windows\SysWOW64\Windark\windark.exe
        
        "C:\Windows\system32\Windark\windark.exe"
        10⤵
        Modifies WinLogon for persistence
        Checks BIOS information in registry
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:2736
        
        C:\Windows\SysWOW64\Windark\windark.exe
        
        "C:\Windows\system32\Windark\windark.exe"
        11⤵
        Modifies WinLogon for persistence
        Checks BIOS information in registry
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:2772
        
        C:\Windows\SysWOW64\Windark\windark.exe
        
        "C:\Windows\system32\Windark\windark.exe"
        12⤵
        Modifies WinLogon for persistence
        Checks BIOS information in registry
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:2160
        
        C:\Windows\SysWOW64\Windark\windark.exe
        
        "C:\Windows\system32\Windark\windark.exe"
        13⤵
        Modifies WinLogon for persistence
        Checks BIOS information in registry
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:1052
        
        C:\Windows\SysWOW64\Windark\windark.exe
        
        "C:\Windows\system32\Windark\windark.exe"
        14⤵
        Modifies WinLogon for persistence
        Checks BIOS information in registry
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:2236
        
        C:\Windows\SysWOW64\Windark\windark.exe
        
        "C:\Windows\system32\Windark\windark.exe"
        15⤵
        Modifies WinLogon for persistence
        Checks BIOS information in registry
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:2608
        
        C:\Windows\SysWOW64\Windark\windark.exe
        
        "C:\Windows\system32\Windark\windark.exe"
        16⤵
        Modifies WinLogon for persistence
        Checks BIOS information in registry
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:2936
        
        C:\Windows\SysWOW64\Windark\windark.exe
        
        "C:\Windows\system32\Windark\windark.exe"
        17⤵
        Modifies WinLogon for persistence
        Checks BIOS information in registry
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:552
        
        C:\Windows\SysWOW64\Windark\windark.exe
        
        "C:\Windows\system32\Windark\windark.exe"
        18⤵
        Modifies WinLogon for persistence
        Checks BIOS information in registry
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:1688
        
        C:\Windows\SysWOW64\Windark\windark.exe
        
        "C:\Windows\system32\Windark\windark.exe"
        19⤵
        Modifies WinLogon for persistence
        Checks BIOS information in registry
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:2784
        
        C:\Windows\SysWOW64\Windark\windark.exe
        
        "C:\Windows\system32\Windark\windark.exe"
        20⤵
        Modifies WinLogon for persistence
        Checks BIOS information in registry
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:2052
        
        C:\Windows\SysWOW64\Windark\windark.exe
        
        "C:\Windows\system32\Windark\windark.exe"
        21⤵
        Modifies WinLogon for persistence
        Checks BIOS information in registry
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:1992
        
        C:\Windows\SysWOW64\Windark\windark.exe
        
        "C:\Windows\system32\Windark\windark.exe"
        22⤵
        Modifies WinLogon for persistence
        Checks BIOS information in registry
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:2652
        
        C:\Windows\SysWOW64\Windark\windark.exe
        
        "C:\Windows\system32\Windark\windark.exe"
        23⤵
        Modifies WinLogon for persistence
        Checks BIOS information in registry
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:592
        
        C:\Windows\SysWOW64\Windark\windark.exe
        
        "C:\Windows\system32\Windark\windark.exe"
        24⤵
        Modifies WinLogon for persistence
        Checks BIOS information in registry
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:448
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\_dcsc_.bat" "
        24⤵
        System Location Discovery: System Language Discovery
        
        PID:2340
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 2
        25⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2356
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\_dcsc_.bat" "
        23⤵
        System Location Discovery: System Language Discovery
        
        PID:1860
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 2
        24⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1308
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\_dcsc_.bat" "
        22⤵
        System Location Discovery: System Language Discovery
        
        PID:2412
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 2
        23⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:568
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\_dcsc_.bat" "
        21⤵
        System Location Discovery: System Language Discovery
        
        PID:2488
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 2
        22⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2256
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\_dcsc_.bat" "
        20⤵
        System Location Discovery: System Language Discovery
        
        PID:3008
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 2
        21⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2084
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\_dcsc_.bat" "
        19⤵
        System Location Discovery: System Language Discovery
        
        PID:1972
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 2
        20⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2600
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\_dcsc_.bat" "
        18⤵
        System Location Discovery: System Language Discovery
        
        PID:276
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 2
        19⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1724
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\_dcsc_.bat" "
        17⤵
        System Location Discovery: System Language Discovery
        
        PID:2056
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 2
        18⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2112
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\_dcsc_.bat" "
        16⤵
        System Location Discovery: System Language Discovery
        
        PID:1744
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 2
        17⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2388
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\_dcsc_.bat" "
        15⤵
        System Location Discovery: System Language Discovery
        
        PID:1532
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 2
        16⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2384
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\_dcsc_.bat" "
        14⤵
        System Location Discovery: System Language Discovery
        
        PID:2108
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 2
        15⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1096
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\_dcsc_.bat" "
        13⤵
        System Location Discovery: System Language Discovery
        
        PID:2004
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 2
        14⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:644
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\_dcsc_.bat" "
        12⤵
        System Location Discovery: System Language Discovery
        
        PID:2344
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 2
        13⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2820
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\_dcsc_.bat" "
        11⤵
        System Location Discovery: System Language Discovery
        
        PID:2408
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 2
        12⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:340
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\_dcsc_.bat" "
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:1720
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 2
        11⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2748
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\_dcsc_.bat" "
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:2328
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 2
        10⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1804
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\_dcsc_.bat" "
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:776
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 2
        9⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3032
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\_dcsc_.bat" "
        7⤵
        
        PID:108
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 2
        8⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1240
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\_dcsc_.bat" "
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2912
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 2
        7⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1060
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\_dcsc_.bat" "
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:600
      - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 2
        6⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:644
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\_dcsc_.bat" "
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2816
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 2
        5⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:784
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\_dcsc_.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2560
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 2
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2164
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\_dcsc_.bat" "
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2772
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_dcsc_.bat

Filesize
119B

MD5
df477d04c257623c6b27d53f5d7825e2

SHA1
cb1824486bd1abebd866bc2e640c4daec221e93c

SHA256
80e438064dd912c9e30a89e5d52c7ce78a8f676ef46c32fd98a78d1fde01210c

SHA512
592ae3e2e07060dc8acd99fe2fe2c54f2a2a4f54ad8310bffb55303838a076246c422bb9e7bec1197307dc743df8da8a0020b88d6165119e32e5e6ce344fe040

Download Submit
C:\Users\Admin\AppData\Local\Temp\_dcsc_.bat

Filesize
74B

MD5
096f7e12ac4d9c311ca4260bdfe7f5c2

SHA1
fca64a8d081ec220e8b449c9cd7d391d5f154c8b

SHA256
c2d1eb36fc8d04928d4763e3c4e3a7f9b62ea03a49fa87f85f6c20418f8b8154

SHA512
94444ae692ed7ccca0d04fae8637718ebbc2c7e1429284f865b91f42593a0f45d05d89899c7129ac149079ff658c2c93ba5be0e4218fd80f67e7d2feaa595b69

Download Submit
\Windows\SysWOW64\Windark\windark.exe

Filesize
811KB

MD5
423e2a21a50500e685a172c24ec0f433

SHA1
f36cedcbc57957e9bc238e538b9057d4df66eaa7

SHA256
628ff193256507f8c7ee292dbb844eb1af73dd40370225d07f91823f9b7a80bf

SHA512
f33303b6db5cf4786debea19d7277e10f3067392989abf0f617ce79147c3a46244f710f9945ca640f4a092b49ba574280e55c7ecf02c8c76c7a28a3eb7668785

Download Submit
memory/552-216-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/592-270-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1052-179-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1356-113-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1456-87-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1632-100-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1688-225-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1820-48-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1952-127-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1964-0-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/1964-21-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1980-61-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1992-252-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2052-243-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2160-166-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2236-189-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2608-198-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2652-261-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2680-34-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2736-140-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2772-153-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2784-234-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2864-74-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2936-207-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads