darkcomet | 656e11809a26f8d79cb4224037b8ef39237055fff2a6f71e7e859c3562bc5e0e

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
03-01-2025 20:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_6f7419f95dd64522af24a32c480eef4e.exe
Size

1.1MB
MD5

6f7419f95dd64522af24a32c480eef4e
SHA1

54ce15566292b1494ce59ce769cd8f9d7184c4ce
SHA256

656e11809a26f8d79cb4224037b8ef39237055fff2a6f71e7e859c3562bc5e0e
SHA512

ce71d48e49b4c956505454df41eda68f517ff2aee196462dfb226d19ca56d5eee173ac7e89ccf9aae72a6e0739c317802d66a23d84abaa334ad6dd0c4b5929ef
SSDEEP

24576:DpqpyFE//Tct4bOs7pSBsvrOR7ywR7i0fBDkw/t:D8WSV70z71O0pn

Score

10^/10

darkcomet discovery rat trojan upx

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Darkcomet family
darkcomet

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	new2.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	JaffaCakes118_6f7419f95dd64522af24a32c480eef4e.exe

Executes dropped EXE 2 IoCs

pid	Process
4820	Virus mdx v2.0.exe
2268	new2.exe

Loads dropped DLL 1 IoCs

pid	Process
2268	new2.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/4820-29-0x0000000000400000-0x00000000004C1000-memory.dmp	autoit_exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Anti v1.ocx	new2.exe
File created	C:\Windows\SysWOW64\Anti v1.ocx	new2.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000c000000023b85-9.dat	upx
behavioral2/memory/4820-19-0x0000000000400000-0x00000000004C1000-memory.dmp	upx
behavioral2/memory/4820-29-0x0000000000400000-0x00000000004C1000-memory.dmp	upx

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Virus mdx v2.0.exe	JaffaCakes118_6f7419f95dd64522af24a32c480eef4e.exe
File opened for modification	C:\Windows\new2.exe	JaffaCakes118_6f7419f95dd64522af24a32c480eef4e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3608	2268	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_6f7419f95dd64522af24a32c480eef4e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Virus mdx v2.0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	new2.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	new2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	new2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	new2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	new2.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	new2.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF070144-EB7B-4D63-BBFC-DABB33AE234C}\ToolboxBitmap32\ = "C:\\Windows\\SysWow64\\Anti v1.ocx, 30000"	new2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF070144-EB7B-4D63-BBFC-DABB33AE234C}\MiscStatus	new2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{752059E9-5070-4A92-8AD9-7AA03D4F088D}\ = "UserControl1"	new2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E3B53AB7-68FF-4DF8-A66A-ABFB71BA5037}\1.0\FLAGS	new2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{752059E9-5070-4A92-8AD9-7AA03D4F088D}\TypeLib\Version = "1.0"	new2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{752059E9-5070-4A92-8AD9-7AA03D4F088D}\TypeLib\ = "{E3B53AB7-68FF-4DF8-A66A-ABFB71BA5037}"	new2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF070144-EB7B-4D63-BBFC-DABB33AE234C}	new2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E3B53AB7-68FF-4DF8-A66A-ABFB71BA5037}\1.0	new2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E70092BC-DA5C-43E3-ABE6-1D703F78EA12}\TypeLib\Version = "1.0"	new2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{752059E9-5070-4A92-8AD9-7AA03D4F088D}\TypeLib	new2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E3B53AB7-68FF-4DF8-A66A-ABFB71BA5037}	new2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E70092BC-DA5C-43E3-ABE6-1D703F78EA12}\ProxyStubClsid32	new2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{752059E9-5070-4A92-8AD9-7AA03D4F088D}\ProxyStubClsid32	new2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF070144-EB7B-4D63-BBFC-DABB33AE234C}\TypeLib\ = "{E3B53AB7-68FF-4DF8-A66A-ABFB71BA5037}"	new2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E3B53AB7-68FF-4DF8-A66A-ABFB71BA5037}\1.0\FLAGS\ = "2"	new2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{752059E9-5070-4A92-8AD9-7AA03D4F088D}\TypeLib	new2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E3B53AB7-68FF-4DF8-A66A-ABFB71BA5037}\1.0\0\win32	new2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E70092BC-DA5C-43E3-ABE6-1D703F78EA12}\ = "_UserControl1"	new2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E70092BC-DA5C-43E3-ABE6-1D703F78EA12}\ProxyStubClsid32	new2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DmarAnti.UserControl1	new2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{752059E9-5070-4A92-8AD9-7AA03D4F088D}\ProxyStubClsid32	new2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF070144-EB7B-4D63-BBFC-DABB33AE234C}\MiscStatus\1\ = "131473"	new2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{752059E9-5070-4A92-8AD9-7AA03D4F088D}\ProxyStubClsid\ = "{00020420-0000-0000-C000-000000000046}"	new2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E3B53AB7-68FF-4DF8-A66A-ABFB71BA5037}\1.0\HELPDIR	new2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E70092BC-DA5C-43E3-ABE6-1D703F78EA12}\TypeLib\Version = "1.0"	new2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{752059E9-5070-4A92-8AD9-7AA03D4F088D}\ = "__UserControl1"	new2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{752059E9-5070-4A92-8AD9-7AA03D4F088D}	new2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{752059E9-5070-4A92-8AD9-7AA03D4F088D}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	new2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF070144-EB7B-4D63-BBFC-DABB33AE234C}\InprocServer32	new2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF070144-EB7B-4D63-BBFC-DABB33AE234C}\TypeLib	new2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{752059E9-5070-4A92-8AD9-7AA03D4F088D}\ = "__UserControl1"	new2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF070144-EB7B-4D63-BBFC-DABB33AE234C}\InprocServer32\ = "C:\\Windows\\SysWow64\\Anti v1.ocx"	new2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DmarAnti.UserControl1\Clsid\ = "{CF070144-EB7B-4D63-BBFC-DABB33AE234C}"	new2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E70092BC-DA5C-43E3-ABE6-1D703F78EA12}	new2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E70092BC-DA5C-43E3-ABE6-1D703F78EA12}\TypeLib\ = "{E3B53AB7-68FF-4DF8-A66A-ABFB71BA5037}"	new2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E70092BC-DA5C-43E3-ABE6-1D703F78EA12}\TypeLib	new2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{752059E9-5070-4A92-8AD9-7AA03D4F088D}\TypeLib\ = "{E3B53AB7-68FF-4DF8-A66A-ABFB71BA5037}"	new2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF070144-EB7B-4D63-BBFC-DABB33AE234C}\ProgID	new2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF070144-EB7B-4D63-BBFC-DABB33AE234C}\VERSION\ = "1.0"	new2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DmarAnti.UserControl1\ = "DmarAnti.UserControl1"	new2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E70092BC-DA5C-43E3-ABE6-1D703F78EA12}\ = "UserControl1"	new2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E3B53AB7-68FF-4DF8-A66A-ABFB71BA5037}\1.0\ = "DmarAnti"	new2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E70092BC-DA5C-43E3-ABE6-1D703F78EA12}\ = "_UserControl1"	new2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E70092BC-DA5C-43E3-ABE6-1D703F78EA12}\TypeLib\ = "{E3B53AB7-68FF-4DF8-A66A-ABFB71BA5037}"	new2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{752059E9-5070-4A92-8AD9-7AA03D4F088D}\TypeLib\Version = "1.0"	new2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{752059E9-5070-4A92-8AD9-7AA03D4F088D}	new2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF070144-EB7B-4D63-BBFC-DABB33AE234C}\Control\	new2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF070144-EB7B-4D63-BBFC-DABB33AE234C}\Control	new2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF070144-EB7B-4D63-BBFC-DABB33AE234C}\MiscStatus\ = "0"	new2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF070144-EB7B-4D63-BBFC-DABB33AE234C}\VERSION	new2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E70092BC-DA5C-43E3-ABE6-1D703F78EA12}\TypeLib	new2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF070144-EB7B-4D63-BBFC-DABB33AE234C}\InprocServer32\ThreadingModel = "Apartment"	new2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E70092BC-DA5C-43E3-ABE6-1D703F78EA12}\ProxyStubClsid	new2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DmarAnti.UserControl1\Clsid	new2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{752059E9-5070-4A92-8AD9-7AA03D4F088D}\ProxyStubClsid	new2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E3B53AB7-68FF-4DF8-A66A-ABFB71BA5037}\1.0\HELPDIR\ = "C:\\Windows\\system32"	new2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E70092BC-DA5C-43E3-ABE6-1D703F78EA12}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	new2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E70092BC-DA5C-43E3-ABE6-1D703F78EA12}	new2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E70092BC-DA5C-43E3-ABE6-1D703F78EA12}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	new2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E3B53AB7-68FF-4DF8-A66A-ABFB71BA5037}\1.0\0	new2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E3B53AB7-68FF-4DF8-A66A-ABFB71BA5037}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\Anti v1.ocx"	new2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF070144-EB7B-4D63-BBFC-DABB33AE234C}\ToolboxBitmap32	new2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E70092BC-DA5C-43E3-ABE6-1D703F78EA12}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	new2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{752059E9-5070-4A92-8AD9-7AA03D4F088D}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	new2.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4820	Virus mdx v2.0.exe
4820	Virus mdx v2.0.exe
4820	Virus mdx v2.0.exe
4820	Virus mdx v2.0.exe
4820	Virus mdx v2.0.exe
4820	Virus mdx v2.0.exe
4820	Virus mdx v2.0.exe
4820	Virus mdx v2.0.exe
4820	Virus mdx v2.0.exe
4820	Virus mdx v2.0.exe
4820	Virus mdx v2.0.exe
4820	Virus mdx v2.0.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2268	new2.exe
Token: SeSecurityPrivilege	2268	new2.exe
Token: SeTakeOwnershipPrivilege	2268	new2.exe
Token: SeLoadDriverPrivilege	2268	new2.exe
Token: SeSystemProfilePrivilege	2268	new2.exe
Token: SeSystemtimePrivilege	2268	new2.exe
Token: SeProfSingleProcessPrivilege	2268	new2.exe
Token: SeIncBasePriorityPrivilege	2268	new2.exe
Token: SeCreatePagefilePrivilege	2268	new2.exe
Token: SeBackupPrivilege	2268	new2.exe
Token: SeRestorePrivilege	2268	new2.exe
Token: SeShutdownPrivilege	2268	new2.exe
Token: SeDebugPrivilege	2268	new2.exe
Token: SeSystemEnvironmentPrivilege	2268	new2.exe
Token: SeChangeNotifyPrivilege	2268	new2.exe
Token: SeRemoteShutdownPrivilege	2268	new2.exe
Token: SeUndockPrivilege	2268	new2.exe
Token: SeManageVolumePrivilege	2268	new2.exe
Token: SeImpersonatePrivilege	2268	new2.exe
Token: SeCreateGlobalPrivilege	2268	new2.exe
Token: 33	2268	new2.exe
Token: 34	2268	new2.exe
Token: 35	2268	new2.exe
Token: 36	2268	new2.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2336	JaffaCakes118_6f7419f95dd64522af24a32c480eef4e.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2336 wrote to memory of 4820	2336	JaffaCakes118_6f7419f95dd64522af24a32c480eef4e.exe	82
PID 2336 wrote to memory of 4820	2336	JaffaCakes118_6f7419f95dd64522af24a32c480eef4e.exe	82
PID 2336 wrote to memory of 4820	2336	JaffaCakes118_6f7419f95dd64522af24a32c480eef4e.exe	82
PID 2336 wrote to memory of 2268	2336	JaffaCakes118_6f7419f95dd64522af24a32c480eef4e.exe	83
PID 2336 wrote to memory of 2268	2336	JaffaCakes118_6f7419f95dd64522af24a32c480eef4e.exe	83
PID 2336 wrote to memory of 2268	2336	JaffaCakes118_6f7419f95dd64522af24a32c480eef4e.exe	83
PID 2268 wrote to memory of 3672	2268	new2.exe	87
PID 2268 wrote to memory of 3672	2268	new2.exe	87
PID 2268 wrote to memory of 3672	2268	new2.exe	87

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6f7419f95dd64522af24a32c480eef4e.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6f7419f95dd64522af24a32c480eef4e.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2336
- C:\Windows\Virus mdx v2.0.exe
  "C:\Windows\Virus mdx v2.0.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4820
- C:\Windows\new2.exe
  "C:\Windows\new2.exe"
  2⤵
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2268
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2268 -s 220
    3⤵
    - Program crash
    PID:3608
- - C:\Windows\SysWOW64\explorer.exe
    "C:\Windows\SysWOW64\explorer.exe"
    3⤵
    PID:3672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2268 -ip 2268
1⤵
PID:2756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Anti v1.ocx

Filesize
32KB

MD5
e4aa837c58969cfcbe0b830a2f5f51b9

SHA1
8170f323075c3171bae60e078be4a854242372db

SHA256
bce81f610a13e8a49a7de03981a42be9778094ceda06d39317163de3c4113a7e

SHA512
accc7011665a5344277c2ac230e83e7802be1a28bbe5429d3c73455e1265728bdb3dc768f111d97d43a28d7f112224f4f53ecc910885024ef761d0a64d042b55

Download Submit
C:\Windows\Virus mdx v2.0.exe

Filesize
295KB

MD5
7461681832167d8e2d09bbf28f7b4755

SHA1
2fe11d4eafa5f225ce7193e6f38f6134ecb1d2e9

SHA256
5e59a012e8fe6f490bab5f349b676bb7b481abfc89509dd23ca7a24ad854fb7d

SHA512
1400c77e7d784ceac0ce9da68a582463cf7ec06d55b084d573e049a048ecc55ca4ff65467b54b965fe026304c7e62833522fa57cadc49996dae23ff3eaac1ba6

Download Submit
C:\Windows\new2.exe

Filesize
575KB

MD5
72bc8d73c76ba1734fbee9320491d8ad

SHA1
b8fd436cbc1d5dce99a3793ebcb005445487c1a8

SHA256
8297f48a55c63f3106938fafde85fd704dde30144b4e8140f2ab22134e164842

SHA512
0dd1ef327aba4ead7e640c6c005e137370f51b33966b3dbe7b3c8ffd6683d3f94c3bf98d9430602260338af34dbddff800cbd85b266839503bb0ec01ce88dc0b

Download Submit
memory/2268-37-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/2268-64-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/2268-65-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/2268-35-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/2268-27-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/2268-63-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/2268-62-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/2268-38-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/2268-36-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/2268-44-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/2268-43-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/2268-42-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/2268-41-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/2268-40-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/2268-46-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/2268-47-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/2268-39-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/2268-61-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/2268-45-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/2268-60-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/2268-53-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/2268-49-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/2268-50-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/2268-51-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/2268-52-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/2268-48-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/2268-54-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/2268-55-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/2268-56-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/2268-57-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/2268-58-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/2268-59-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/2336-0-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2336-1-0x0000000000407000-0x0000000000409000-memory.dmp

Filesize
8KB

Download
memory/2336-26-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2336-2-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/4820-19-0x0000000000400000-0x00000000004C1000-memory.dmp

Filesize
772KB

Download
memory/4820-29-0x0000000000400000-0x00000000004C1000-memory.dmp

Filesize
772KB

Download