darkcomet | 4e8e573ab9db7a19486e141024cd14b4fe31d23118a0eac3cb5e9454fe629422

Analysis

max time kernel
145s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04-01-2025 00:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe
Size

732KB
MD5

7682d779384e5c5709d9ccc83b72fec0
SHA1

bf69afeb2a0ff053e3edde6bd0f518c90aac8b81
SHA256

4e8e573ab9db7a19486e141024cd14b4fe31d23118a0eac3cb5e9454fe629422
SHA512

296f040d21a95b349132d829d71128071a79f815f3a8a1209b72a5c72b95effa50538ddb9c4e936a3afa63a3e02562552dd660a7b5bdd6bcf0ade005133ed0b2
SSDEEP

12288:mUmupRD3yrzSjMfZm1xqNCZbFaecjB4Bq0tqwGgZc0+dHLIpew8sO/KSii/qNk9T:lrDirzSQs1xpbc+5t5X9Ow8sPTi

Score

10^/10

darkcomet office discovery evasion persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Office

tekarzum.no-ip.biz:1604

Mutex

DC_MUTEX-NNLE62S

Attributes

InstallPath
Winupdate\winupdate.exe
gencode
rVeqxqv363Vq
install
true
offline_keylogger
true
persistence
true
reg_key
Winupdate

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Darkcomet family
darkcomet

Modifies WinLogon for persistence 2 TTPs 24 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe"	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe"	winupdate.exe

Sets file to hidden 1 TTPs 46 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
2860	attrib.exe
308	attrib.exe
1436	attrib.exe
2560	attrib.exe
620	attrib.exe
2224	attrib.exe
1640	attrib.exe
1984	attrib.exe
2100	attrib.exe
620	attrib.exe
2520	attrib.exe
2756	attrib.exe
1784	attrib.exe
2260	attrib.exe
2944	attrib.exe
856	attrib.exe
2092	attrib.exe
2496	attrib.exe
2240	attrib.exe
2716	attrib.exe
2184	attrib.exe
1716	attrib.exe
2584	attrib.exe
2684	attrib.exe
2520	attrib.exe
532	attrib.exe
2504	attrib.exe
2452	attrib.exe
1236	attrib.exe
2304	attrib.exe
1508	attrib.exe
2628	attrib.exe
3044	attrib.exe
824	attrib.exe
2884	attrib.exe
2724	attrib.exe
2280	attrib.exe
676	attrib.exe
2684	attrib.exe
2584	attrib.exe
1560	attrib.exe
2680	attrib.exe
2612	attrib.exe
2192	attrib.exe
1032	attrib.exe
1360	attrib.exe

Deletes itself 1 IoCs

pid	Process
2940	notepad.exe

Executes dropped EXE 46 IoCs

pid	Process
2784	winupdate.exe
2664	winupdate.exe
1864	winupdate.exe
2444	winupdate.exe
2544	winupdate.exe
3016	winupdate.exe
2748	winupdate.exe
2280	winupdate.exe
324	winupdate.exe
1948	winupdate.exe
1032	winupdate.exe
2460	winupdate.exe
2232	winupdate.exe
2748	winupdate.exe
1668	winupdate.exe
2968	winupdate.exe
1536	winupdate.exe
1056	winupdate.exe
2788	winupdate.exe
320	winupdate.exe
824	winupdate.exe
1936	winupdate.exe
2228	winupdate.exe
1496	winupdate.exe
1264	winupdate.exe
2456	winupdate.exe
1656	winupdate.exe
3032	winupdate.exe
1932	winupdate.exe
1216	winupdate.exe
1940	winupdate.exe
944	winupdate.exe
1572	winupdate.exe
2084	winupdate.exe
2800	winupdate.exe
2692	winupdate.exe
2184	winupdate.exe
696	winupdate.exe
832	winupdate.exe
2804	winupdate.exe
1212	winupdate.exe
2264	winupdate.exe
972	winupdate.exe
620	winupdate.exe
1940	winupdate.exe
1600	winupdate.exe

Loads dropped DLL 46 IoCs

pid	Process
3048	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe
2784	winupdate.exe
2664	winupdate.exe
1864	winupdate.exe
2444	winupdate.exe
2544	winupdate.exe
3016	winupdate.exe
2748	winupdate.exe
2280	winupdate.exe
324	winupdate.exe
1948	winupdate.exe
1032	winupdate.exe
2460	winupdate.exe
2232	winupdate.exe
2748	winupdate.exe
1668	winupdate.exe
2968	winupdate.exe
1536	winupdate.exe
1056	winupdate.exe
2788	winupdate.exe
320	winupdate.exe
824	winupdate.exe
1936	winupdate.exe
2228	winupdate.exe
1496	winupdate.exe
1264	winupdate.exe
2456	winupdate.exe
1656	winupdate.exe
3032	winupdate.exe
1932	winupdate.exe
1216	winupdate.exe
1940	winupdate.exe
944	winupdate.exe
1572	winupdate.exe
2084	winupdate.exe
2800	winupdate.exe
2692	winupdate.exe
2184	winupdate.exe
696	winupdate.exe
832	winupdate.exe
2804	winupdate.exe
1212	winupdate.exe
2264	winupdate.exe
972	winupdate.exe
620	winupdate.exe
1940	winupdate.exe

Adds Run key to start application 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\Winupdate = "C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\Winupdate = "C:\\Windows\\system32\\Winupdate\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\Winupdate = "C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\Winupdate = "C:\\Windows\\system32\\Winupdate\\winupdate.exe"	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\Winupdate = "C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\Winupdate = "C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\Winupdate = "C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\Winupdate = "C:\\Windows\\system32\\Winupdate\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\Winupdate = "C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\Winupdate = "C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\Winupdate = "C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\Winupdate = "C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\Winupdate = "C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\Winupdate = "C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\Winupdate = "C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\Winupdate = "C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\Winupdate = "C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\Winupdate = "C:\\Windows\\system32\\Winupdate\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\Winupdate = "C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\Winupdate = "C:\\Windows\\system32\\Winupdate\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\Winupdate = "C:\\Windows\\system32\\Winupdate\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\Winupdate = "C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\Winupdate = "C:\\Windows\\system32\\Winupdate\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\Winupdate = "C:\\Windows\\system32\\Winupdate\\winupdate.exe"	winupdate.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Winupdate\	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Winupdate\winupdate.exe	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq\	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Winupdate\	winupdate.exe
File created	C:\Windows\SysWOW64\Winupdate\winupdate.exe	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe
File created	C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\winupdate.exe	winupdate.exe
File created	C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\winupdate.exe	winupdate.exe
File created	C:\Windows\SysWOW64\Winupdate\winupdate.exe	winupdate.exe
File created	C:\Windows\SysWOW64\Winupdate\winupdate.exe	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Winupdate	attrib.exe
File created	C:\Windows\SysWOW64\Winupdate\winupdate.exe	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Winupdate\winupdate.exe	attrib.exe
File created	C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\winupdate.exe	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Winupdate\winupdate.exe	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq	attrib.exe
File created	C:\Windows\SysWOW64\Winupdate\winupdate.exe	winupdate.exe
File created	C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq\winupdate.exe	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq\winupdate.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq\winupdate.exe	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\winupdate.exe	winupdate.exe
File created	C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\winupdate.exe	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Winupdate	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq\winupdate.exe	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Winupdate\winupdate.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Winupdate\	winupdate.exe
File created	C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\winupdate.exe	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Winupdate\winupdate.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Winupdate	attrib.exe
File created	C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq\winupdate.exe	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\winupdate.exe	winupdate.exe
File created	C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\winupdate.exe	winupdate.exe
File created	C:\Windows\SysWOW64\Winupdate\winupdate.exe	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq\	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Winupdate	attrib.exe
File created	C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\winupdate.exe	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq\winupdate.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Winupdate\winupdate.exe	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Winupdate	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq\winupdate.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Winupdate\	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Winupdate\winupdate.exe	winupdate.exe
File created	C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\winupdate.exe	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\winupdate.exe	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\winupdate.exe	attrib.exe
File created	C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\winupdate.exe	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Winupdate	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\	winupdate.exe
File created	C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\winupdate.exe	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Winupdate\winupdate.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Winupdate\winupdate.exe	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\winupdate.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq\	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq	attrib.exe
File created	C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq\winupdate.exe	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\winupdate.exe	winupdate.exe
File created	C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\winupdate.exe	winupdate.exe

Suspicious use of SetThreadContext 24 IoCs

description	pid	Process	procid_target
PID 2112 set thread context of 3048	2112	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe	32
PID 2784 set thread context of 2664	2784	winupdate.exe	45
PID 1864 set thread context of 2444	1864	winupdate.exe	58
PID 2544 set thread context of 3016	2544	winupdate.exe	71
PID 2748 set thread context of 2280	2748	winupdate.exe	84
PID 324 set thread context of 1948	324	winupdate.exe	97
PID 1032 set thread context of 2460	1032	winupdate.exe	110
PID 2232 set thread context of 2748	2232	winupdate.exe	123
PID 1668 set thread context of 2968	1668	winupdate.exe	136
PID 1536 set thread context of 1056	1536	winupdate.exe	149
PID 2788 set thread context of 320	2788	winupdate.exe	162
PID 824 set thread context of 1936	824	winupdate.exe	175
PID 2228 set thread context of 1496	2228	winupdate.exe	188
PID 1264 set thread context of 2456	1264	winupdate.exe	202
PID 1656 set thread context of 3032	1656	winupdate.exe	215
PID 1932 set thread context of 1216	1932	winupdate.exe	228
PID 1940 set thread context of 944	1940	winupdate.exe	241
PID 1572 set thread context of 2084	1572	winupdate.exe	254
PID 2800 set thread context of 2692	2800	winupdate.exe	267
PID 2184 set thread context of 696	2184	winupdate.exe	280
PID 832 set thread context of 2804	832	winupdate.exe	293
PID 1212 set thread context of 2264	1212	winupdate.exe	306
PID 972 set thread context of 620	972	winupdate.exe	319
PID 1940 set thread context of 1600	1940	winupdate.exe	332

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winupdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winupdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winupdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winupdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winupdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winupdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winupdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winupdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winupdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winupdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winupdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winupdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winupdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winupdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winupdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winupdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winupdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winupdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Runs net.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	3048	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe
Token: SeSecurityPrivilege	3048	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe
Token: SeTakeOwnershipPrivilege	3048	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe
Token: SeLoadDriverPrivilege	3048	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe
Token: SeSystemProfilePrivilege	3048	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe
Token: SeSystemtimePrivilege	3048	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe
Token: SeProfSingleProcessPrivilege	3048	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe
Token: SeIncBasePriorityPrivilege	3048	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe
Token: SeCreatePagefilePrivilege	3048	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe
Token: SeBackupPrivilege	3048	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe
Token: SeRestorePrivilege	3048	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe
Token: SeShutdownPrivilege	3048	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe
Token: SeDebugPrivilege	3048	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe
Token: SeSystemEnvironmentPrivilege	3048	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe
Token: SeChangeNotifyPrivilege	3048	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe
Token: SeRemoteShutdownPrivilege	3048	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe
Token: SeUndockPrivilege	3048	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe
Token: SeManageVolumePrivilege	3048	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe
Token: SeImpersonatePrivilege	3048	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe
Token: SeCreateGlobalPrivilege	3048	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe
Token: 33	3048	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe
Token: 34	3048	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe
Token: 35	3048	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe
Token: SeIncreaseQuotaPrivilege	2664	winupdate.exe
Token: SeSecurityPrivilege	2664	winupdate.exe
Token: SeTakeOwnershipPrivilege	2664	winupdate.exe
Token: SeLoadDriverPrivilege	2664	winupdate.exe
Token: SeSystemProfilePrivilege	2664	winupdate.exe
Token: SeSystemtimePrivilege	2664	winupdate.exe
Token: SeProfSingleProcessPrivilege	2664	winupdate.exe
Token: SeIncBasePriorityPrivilege	2664	winupdate.exe
Token: SeCreatePagefilePrivilege	2664	winupdate.exe
Token: SeBackupPrivilege	2664	winupdate.exe
Token: SeRestorePrivilege	2664	winupdate.exe
Token: SeShutdownPrivilege	2664	winupdate.exe
Token: SeDebugPrivilege	2664	winupdate.exe
Token: SeSystemEnvironmentPrivilege	2664	winupdate.exe
Token: SeChangeNotifyPrivilege	2664	winupdate.exe
Token: SeRemoteShutdownPrivilege	2664	winupdate.exe
Token: SeUndockPrivilege	2664	winupdate.exe
Token: SeManageVolumePrivilege	2664	winupdate.exe
Token: SeImpersonatePrivilege	2664	winupdate.exe
Token: SeCreateGlobalPrivilege	2664	winupdate.exe
Token: 33	2664	winupdate.exe
Token: 34	2664	winupdate.exe
Token: 35	2664	winupdate.exe
Token: SeIncreaseQuotaPrivilege	2444	winupdate.exe
Token: SeSecurityPrivilege	2444	winupdate.exe
Token: SeTakeOwnershipPrivilege	2444	winupdate.exe
Token: SeLoadDriverPrivilege	2444	winupdate.exe
Token: SeSystemProfilePrivilege	2444	winupdate.exe
Token: SeSystemtimePrivilege	2444	winupdate.exe
Token: SeProfSingleProcessPrivilege	2444	winupdate.exe
Token: SeIncBasePriorityPrivilege	2444	winupdate.exe
Token: SeCreatePagefilePrivilege	2444	winupdate.exe
Token: SeBackupPrivilege	2444	winupdate.exe
Token: SeRestorePrivilege	2444	winupdate.exe
Token: SeShutdownPrivilege	2444	winupdate.exe
Token: SeDebugPrivilege	2444	winupdate.exe
Token: SeSystemEnvironmentPrivilege	2444	winupdate.exe
Token: SeChangeNotifyPrivilege	2444	winupdate.exe
Token: SeRemoteShutdownPrivilege	2444	winupdate.exe
Token: SeUndockPrivilege	2444	winupdate.exe
Token: SeManageVolumePrivilege	2444	winupdate.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 3036	2112	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe	31
PID 2112 wrote to memory of 3036	2112	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe	31
PID 2112 wrote to memory of 3036	2112	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe	31
PID 2112 wrote to memory of 3036	2112	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe	31
PID 2112 wrote to memory of 3048	2112	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe	32
PID 2112 wrote to memory of 3048	2112	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe	32
PID 2112 wrote to memory of 3048	2112	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe	32
PID 2112 wrote to memory of 3048	2112	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe	32
PID 2112 wrote to memory of 3048	2112	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe	32
PID 2112 wrote to memory of 3048	2112	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe	32
PID 2112 wrote to memory of 3048	2112	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe	32
PID 2112 wrote to memory of 3048	2112	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe	32
PID 2112 wrote to memory of 3048	2112	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe	32
PID 2112 wrote to memory of 3048	2112	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe	32
PID 2112 wrote to memory of 3048	2112	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe	32
PID 2112 wrote to memory of 3048	2112	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe	32
PID 2112 wrote to memory of 3048	2112	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe	32
PID 3036 wrote to memory of 2176	3036	cmd.exe	34
PID 3036 wrote to memory of 2176	3036	cmd.exe	34
PID 3036 wrote to memory of 2176	3036	cmd.exe	34
PID 3036 wrote to memory of 2176	3036	cmd.exe	34
PID 2176 wrote to memory of 2760	2176	net.exe	35
PID 2176 wrote to memory of 2760	2176	net.exe	35
PID 2176 wrote to memory of 2760	2176	net.exe	35
PID 2176 wrote to memory of 2760	2176	net.exe	35
PID 3048 wrote to memory of 2924	3048	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe	36
PID 3048 wrote to memory of 2924	3048	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe	36
PID 3048 wrote to memory of 2924	3048	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe	36
PID 3048 wrote to memory of 2924	3048	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe	36
PID 3048 wrote to memory of 2880	3048	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe	37
PID 3048 wrote to memory of 2880	3048	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe	37
PID 3048 wrote to memory of 2880	3048	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe	37
PID 3048 wrote to memory of 2880	3048	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe	37
PID 3048 wrote to memory of 2940	3048	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe	39
PID 3048 wrote to memory of 2940	3048	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe	39
PID 3048 wrote to memory of 2940	3048	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe	39
PID 3048 wrote to memory of 2940	3048	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe	39
PID 3048 wrote to memory of 2940	3048	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe	39
PID 3048 wrote to memory of 2940	3048	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe	39
PID 3048 wrote to memory of 2940	3048	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe	39
PID 3048 wrote to memory of 2940	3048	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe	39
PID 3048 wrote to memory of 2940	3048	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe	39
PID 3048 wrote to memory of 2940	3048	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe	39
PID 3048 wrote to memory of 2940	3048	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe	39
PID 3048 wrote to memory of 2940	3048	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe	39
PID 3048 wrote to memory of 2940	3048	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe	39
PID 3048 wrote to memory of 2940	3048	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe	39
PID 3048 wrote to memory of 2940	3048	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe	39
PID 3048 wrote to memory of 2940	3048	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe	39
PID 3048 wrote to memory of 2940	3048	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe	39
PID 3048 wrote to memory of 2940	3048	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe	39
PID 2880 wrote to memory of 2716	2880	cmd.exe	41
PID 2880 wrote to memory of 2716	2880	cmd.exe	41
PID 2880 wrote to memory of 2716	2880	cmd.exe	41
PID 2880 wrote to memory of 2716	2880	cmd.exe	41
PID 2924 wrote to memory of 2280	2924	cmd.exe	42
PID 2924 wrote to memory of 2280	2924	cmd.exe	42
PID 2924 wrote to memory of 2280	2924	cmd.exe	42
PID 2924 wrote to memory of 2280	2924	cmd.exe	42
PID 3048 wrote to memory of 2784	3048	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe	43
PID 3048 wrote to memory of 2784	3048	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe	43
PID 3048 wrote to memory of 2784	3048	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe	43
PID 3048 wrote to memory of 2784	3048	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe	43
PID 3048 wrote to memory of 2784	3048	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe	43

Views/modifies file attributes 1 TTPs 46 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2304	attrib.exe
856	attrib.exe
2496	attrib.exe
2504	attrib.exe
2612	attrib.exe
1640	attrib.exe
2520	attrib.exe
2260	attrib.exe
620	attrib.exe
1360	attrib.exe
1236	attrib.exe
2724	attrib.exe
2684	attrib.exe
2192	attrib.exe
2684	attrib.exe
1032	attrib.exe
1508	attrib.exe
2680	attrib.exe
2520	attrib.exe
2280	attrib.exe
2628	attrib.exe
2584	attrib.exe
2452	attrib.exe
2584	attrib.exe
2240	attrib.exe
2716	attrib.exe
532	attrib.exe
2860	attrib.exe
308	attrib.exe
1560	attrib.exe
2224	attrib.exe
2560	attrib.exe
824	attrib.exe
2884	attrib.exe
2756	attrib.exe
1784	attrib.exe
1984	attrib.exe
2944	attrib.exe
1436	attrib.exe
2092	attrib.exe
676	attrib.exe
3044	attrib.exe
2184	attrib.exe
2100	attrib.exe
620	attrib.exe
1716	attrib.exe

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Windows\SysWOW64\cmd.exe
  /c net stop MpsSvc
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3036
- - C:\Windows\SysWOW64\net.exe
    net stop MpsSvc
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2176
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop MpsSvc
      4⤵
      PID:2760
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe
  2⤵
  - Modifies WinLogon for persistence
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3048
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe" +s +h
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2924
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe" +s +h
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:2280
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2880
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:2716
- - C:\Windows\SysWOW64\notepad.exe
    notepad
    3⤵
    - Deletes itself
    PID:2940
- - C:\Windows\SysWOW64\Winupdate\winupdate.exe
    "C:\Windows\system32\Winupdate\winupdate.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    PID:2784
  - - C:\Windows\SysWOW64\cmd.exe
      /c net stop MpsSvc
      4⤵
      PID:2636
    - - C:\Windows\SysWOW64\net.exe
        
        net stop MpsSvc
        5⤵
        
        PID:1704
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MpsSvc
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1736
  - - C:\Windows\SysWOW64\Winupdate\winupdate.exe
      C:\Windows\SysWOW64\Winupdate\winupdate.exe
      4⤵
      Modifies WinLogon for persistence
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2664
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Winupdate\winupdate.exe" +s +h
        5⤵
        
        PID:1652
      - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Winupdate\winupdate.exe" +s +h
        6⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:1640
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Winupdate" +s +h
        5⤵
        
        PID:2032
      - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Winupdate" +s +h
        6⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:2684
    - - C:\Windows\SysWOW64\notepad.exe
        
        notepad
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1824
    - - C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\winupdate.exe
        
        "C:\Windows\system32\Winupdate\rVeqxqv363Vq\winupdate.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        
        PID:1864
      - C:\Windows\SysWOW64\cmd.exe
        
        /c net stop MpsSvc
        6⤵
        
        PID:2860
        
        C:\Windows\SysWOW64\net.exe
        
        net stop MpsSvc
        7⤵
        
        PID:2440
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MpsSvc
        8⤵
        
        PID:2824
      - C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\winupdate.exe
        
        C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\winupdate.exe
        6⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2444
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\winupdate.exe" +s +h
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1304
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\winupdate.exe" +s +h
        8⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:1032
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq" +s +h
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1872
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq" +s +h
        8⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:676
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        7⤵
        
        PID:832
        
        C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq\winupdate.exe
        
        "C:\Windows\system32\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq\winupdate.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        
        PID:2544
        
        C:\Windows\SysWOW64\cmd.exe
        
        /c net stop MpsSvc
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2288
        
        C:\Windows\SysWOW64\net.exe
        
        net stop MpsSvc
        9⤵
        
        PID:2040
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MpsSvc
        10⤵
        
        PID:1684
        
        C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq\winupdate.exe
        
        C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq\winupdate.exe
        8⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3016
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq\winupdate.exe" +s +h
        9⤵
        
        PID:2172
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq\winupdate.exe" +s +h
        10⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:2884
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq" +s +h
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:1700
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq" +s +h
        10⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:2756
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:2300
        
        C:\Windows\SysWOW64\Winupdate\winupdate.exe
        
        "C:\Windows\system32\Winupdate\winupdate.exe"
        9⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2748
        
        C:\Windows\SysWOW64\cmd.exe
        
        /c net stop MpsSvc
        10⤵
        
        PID:2716
        
        C:\Windows\SysWOW64\net.exe
        
        net stop MpsSvc
        11⤵
        
        PID:3068
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MpsSvc
        12⤵
        
        PID:3064
        
        C:\Windows\SysWOW64\Winupdate\winupdate.exe
        
        C:\Windows\SysWOW64\Winupdate\winupdate.exe
        10⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2280
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Winupdate\winupdate.exe" +s +h
        11⤵
        
        PID:2428
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Winupdate\winupdate.exe" +s +h
        12⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:2520
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Winupdate" +s +h
        11⤵
        
        PID:1992
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Winupdate" +s +h
        12⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:1236
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        11⤵
        
        PID:1028
        
        C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\winupdate.exe
        
        "C:\Windows\system32\Winupdate\rVeqxqv363Vq\winupdate.exe"
        11⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        
        PID:324
        
        C:\Windows\SysWOW64\cmd.exe
        
        /c net stop MpsSvc
        12⤵
        
        PID:2676
        
        C:\Windows\SysWOW64\net.exe
        
        net stop MpsSvc
        13⤵
        
        PID:2820
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MpsSvc
        14⤵
        
        PID:2828
        
        C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\winupdate.exe
        
        C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\winupdate.exe
        12⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:1948
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\winupdate.exe" +s +h
        13⤵
        System Location Discovery: System Language Discovery
        
        PID:1132
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\winupdate.exe" +s +h
        14⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:2304
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq" +s +h
        13⤵
        
        PID:2472
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq" +s +h
        14⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:1784
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        13⤵
        
        PID:2896
        
        C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq\winupdate.exe
        
        "C:\Windows\system32\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq\winupdate.exe"
        13⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        
        PID:1032
        
        C:\Windows\SysWOW64\cmd.exe
        
        /c net stop MpsSvc
        14⤵
        
        PID:1636
        
        C:\Windows\SysWOW64\net.exe
        
        net stop MpsSvc
        15⤵
        
        PID:2152
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MpsSvc
        16⤵
        System Location Discovery: System Language Discovery
        
        PID:1672
        
        C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq\winupdate.exe
        
        C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq\winupdate.exe
        14⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        
        PID:2460
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq\winupdate.exe" +s +h
        15⤵
        
        PID:3008
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq\winupdate.exe" +s +h
        16⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:2260
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq" +s +h
        15⤵
        
        PID:2168
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq" +s +h
        16⤵
        Sets file to hidden
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:2724
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        15⤵
        
        PID:2240
        
        C:\Windows\SysWOW64\Winupdate\winupdate.exe
        
        "C:\Windows\system32\Winupdate\winupdate.exe"
        15⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2232
        
        C:\Windows\SysWOW64\cmd.exe
        
        /c net stop MpsSvc
        16⤵
        
        PID:2644
        
        C:\Windows\SysWOW64\net.exe
        
        net stop MpsSvc
        17⤵
        
        PID:2656
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MpsSvc
        18⤵
        
        PID:1504
        
        C:\Windows\SysWOW64\Winupdate\winupdate.exe
        
        C:\Windows\SysWOW64\Winupdate\winupdate.exe
        16⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2748
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Winupdate\winupdate.exe" +s +h
        17⤵
        
        PID:1756
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Winupdate\winupdate.exe" +s +h
        18⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:1508
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Winupdate" +s +h
        17⤵
        
        PID:2480
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Winupdate" +s +h
        18⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:2684
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        17⤵
        System Location Discovery: System Language Discovery
        
        PID:2264
        
        C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\winupdate.exe
        
        "C:\Windows\system32\Winupdate\rVeqxqv363Vq\winupdate.exe"
        17⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        
        PID:1668
        
        C:\Windows\SysWOW64\cmd.exe
        
        /c net stop MpsSvc
        18⤵
        
        PID:2856
        
        C:\Windows\SysWOW64\net.exe
        
        net stop MpsSvc
        19⤵
        System Location Discovery: System Language Discovery
        
        PID:380
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MpsSvc
        20⤵
        
        PID:1080
        
        C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\winupdate.exe
        
        C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\winupdate.exe
        18⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2968
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\winupdate.exe" +s +h
        19⤵
        
        PID:2028
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\winupdate.exe" +s +h
        20⤵
        Sets file to hidden
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:1984
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq" +s +h
        19⤵
        System Location Discovery: System Language Discovery
        
        PID:1048
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq" +s +h
        20⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:532
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        19⤵
        System Location Discovery: System Language Discovery
        
        PID:1240
        
        C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq\winupdate.exe
        
        "C:\Windows\system32\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq\winupdate.exe"
        19⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        
        PID:1536
        
        C:\Windows\SysWOW64\cmd.exe
        
        /c net stop MpsSvc
        20⤵
        
        PID:2088
        
        C:\Windows\SysWOW64\net.exe
        
        net stop MpsSvc
        21⤵
        
        PID:1972
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MpsSvc
        22⤵
        
        PID:2976
        
        C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq\winupdate.exe
        
        C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq\winupdate.exe
        20⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1056
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq\winupdate.exe" +s +h
        21⤵
        
        PID:2308
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq\winupdate.exe" +s +h
        22⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:2944
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq" +s +h
        21⤵
        
        PID:2756
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq" +s +h
        22⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:2628
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        21⤵
        
        PID:2056
        
        C:\Windows\SysWOW64\Winupdate\winupdate.exe
        
        "C:\Windows\system32\Winupdate\winupdate.exe"
        21⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        
        PID:2788
        
        C:\Windows\SysWOW64\cmd.exe
        
        /c net stop MpsSvc
        22⤵
        
        PID:2672
        
        C:\Windows\SysWOW64\net.exe
        
        net stop MpsSvc
        23⤵
        System Location Discovery: System Language Discovery
        
        PID:2520
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MpsSvc
        24⤵
        
        PID:1932
        
        C:\Windows\SysWOW64\Winupdate\winupdate.exe
        
        C:\Windows\SysWOW64\Winupdate\winupdate.exe
        22⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:320
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Winupdate\winupdate.exe" +s +h
        23⤵
        
        PID:324
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Winupdate\winupdate.exe" +s +h
        24⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:2860
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Winupdate" +s +h
        23⤵
        
        PID:772
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Winupdate" +s +h
        24⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:3044
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        23⤵
        
        PID:2668
        
        C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\winupdate.exe
        
        "C:\Windows\system32\Winupdate\rVeqxqv363Vq\winupdate.exe"
        23⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:824
        
        C:\Windows\SysWOW64\cmd.exe
        
        /c net stop MpsSvc
        24⤵
        
        PID:448
        
        C:\Windows\SysWOW64\net.exe
        
        net stop MpsSvc
        25⤵
        
        PID:856
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MpsSvc
        26⤵
        
        PID:2544
        
        C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\winupdate.exe
        
        C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\winupdate.exe
        24⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:1936
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\winupdate.exe" +s +h
        25⤵
        System Location Discovery: System Language Discovery
        
        PID:904
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\winupdate.exe" +s +h
        26⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:308
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq" +s +h
        25⤵
        
        PID:2080
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq" +s +h
        26⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:2184
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        25⤵
        System Location Discovery: System Language Discovery
        
        PID:2248
        
        C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq\winupdate.exe
        
        "C:\Windows\system32\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq\winupdate.exe"
        25⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        
        PID:2228
        
        C:\Windows\SysWOW64\cmd.exe
        
        /c net stop MpsSvc
        26⤵
        
        PID:2904
        
        C:\Windows\SysWOW64\net.exe
        
        net stop MpsSvc
        27⤵
        
        PID:2396
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MpsSvc
        28⤵
        
        PID:552
        
        C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq\winupdate.exe
        
        C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq\winupdate.exe
        26⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:1496
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq\winupdate.exe" +s +h
        27⤵
        
        PID:2716
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq\winupdate.exe" +s +h
        28⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:1436
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq" +s +h
        27⤵
        
        PID:752
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq" +s +h
        28⤵
        Sets file to hidden
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:2584
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        27⤵
        System Location Discovery: System Language Discovery
        
        PID:2348
        
        C:\Windows\SysWOW64\Winupdate\winupdate.exe
        
        "C:\Windows\system32\Winupdate\winupdate.exe"
        27⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1264
        
        C:\Windows\SysWOW64\cmd.exe
        
        /c net stop MpsSvc
        28⤵
        
        PID:2864
        
        C:\Windows\SysWOW64\net.exe
        
        net stop MpsSvc
        29⤵
        
        PID:2440
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MpsSvc
        30⤵
        
        PID:320
        
        C:\Windows\SysWOW64\Winupdate\winupdate.exe
        
        C:\Windows\SysWOW64\Winupdate\winupdate.exe
        28⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:2456
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Winupdate\winupdate.exe" +s +h
        29⤵
        System Location Discovery: System Language Discovery
        
        PID:2712
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Winupdate\winupdate.exe" +s +h
        30⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:1560
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Winupdate" +s +h
        29⤵
        
        PID:1784
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Winupdate" +s +h
        30⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:2560
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        29⤵
        
        PID:2104
        
        C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\winupdate.exe
        
        "C:\Windows\system32\Winupdate\rVeqxqv363Vq\winupdate.exe"
        29⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1656
        
        C:\Windows\SysWOW64\cmd.exe
        
        /c net stop MpsSvc
        30⤵
        
        PID:2400
        
        C:\Windows\SysWOW64\net.exe
        
        net stop MpsSvc
        31⤵
        System Location Discovery: System Language Discovery
        
        PID:2744
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MpsSvc
        32⤵
        
        PID:2900
        
        C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\winupdate.exe
        
        C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\winupdate.exe
        30⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        
        PID:3032
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\winupdate.exe" +s +h
        31⤵
        System Location Discovery: System Language Discovery
        
        PID:2256
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\winupdate.exe" +s +h
        32⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:2680
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq" +s +h
        31⤵
        
        PID:3040
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq" +s +h
        32⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:620
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        31⤵
        System Location Discovery: System Language Discovery
        
        PID:2528
        
        C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq\winupdate.exe
        
        "C:\Windows\system32\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq\winupdate.exe"
        31⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1932
        
        C:\Windows\SysWOW64\cmd.exe
        
        /c net stop MpsSvc
        32⤵
        
        PID:1960
        
        C:\Windows\SysWOW64\net.exe
        
        net stop MpsSvc
        33⤵
        
        PID:2852
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MpsSvc
        34⤵
        
        PID:1428
        
        C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq\winupdate.exe
        
        C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq\winupdate.exe
        32⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:1216
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq\winupdate.exe" +s +h
        33⤵
        
        PID:2156
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq\winupdate.exe" +s +h
        34⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:856
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq" +s +h
        33⤵
        
        PID:2872
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq" +s +h
        34⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:824
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        33⤵
        System Location Discovery: System Language Discovery
        
        PID:2692
        
        C:\Windows\SysWOW64\Winupdate\winupdate.exe
        
        "C:\Windows\system32\Winupdate\winupdate.exe"
        33⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        
        PID:1940
        
        C:\Windows\SysWOW64\cmd.exe
        
        /c net stop MpsSvc
        34⤵
        
        PID:2704
        
        C:\Windows\SysWOW64\net.exe
        
        net stop MpsSvc
        35⤵
        
        PID:308
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MpsSvc
        36⤵
        
        PID:972
        
        C:\Windows\SysWOW64\Winupdate\winupdate.exe
        
        C:\Windows\SysWOW64\Winupdate\winupdate.exe
        34⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:944
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Winupdate\winupdate.exe" +s +h
        35⤵
        System Location Discovery: System Language Discovery
        
        PID:2128
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Winupdate\winupdate.exe" +s +h
        36⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:2092
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Winupdate" +s +h
        35⤵
        
        PID:2744
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Winupdate" +s +h
        36⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:2100
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        35⤵
        
        PID:2400
        
        C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\winupdate.exe
        
        "C:\Windows\system32\Winupdate\rVeqxqv363Vq\winupdate.exe"
        35⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1572
        
        C:\Windows\SysWOW64\cmd.exe
        
        /c net stop MpsSvc
        36⤵
        System Location Discovery: System Language Discovery
        
        PID:2356
        
        C:\Windows\SysWOW64\net.exe
        
        net stop MpsSvc
        37⤵
        
        PID:2588
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MpsSvc
        38⤵
        
        PID:2944
        
        C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\winupdate.exe
        
        C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\winupdate.exe
        36⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2084
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\winupdate.exe" +s +h
        37⤵
        
        PID:1960
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\winupdate.exe" +s +h
        38⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:2224
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq" +s +h
        37⤵
        System Location Discovery: System Language Discovery
        
        PID:2132
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq" +s +h
        38⤵
        Sets file to hidden
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:2496
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        37⤵
        
        PID:2856
        
        C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq\winupdate.exe
        
        "C:\Windows\system32\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq\winupdate.exe"
        37⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        
        PID:2800
        
        C:\Windows\SysWOW64\cmd.exe
        
        /c net stop MpsSvc
        38⤵
        
        PID:1968
        
        C:\Windows\SysWOW64\net.exe
        
        net stop MpsSvc
        39⤵
        
        PID:308
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MpsSvc
        40⤵
        System Location Discovery: System Language Discovery
        
        PID:2976
        
        C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq\winupdate.exe
        
        C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq\winupdate.exe
        38⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:2692
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq\winupdate.exe" +s +h
        39⤵
        
        PID:1664
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq\winupdate.exe" +s +h
        40⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:2520
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq" +s +h
        39⤵
        
        PID:928
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq" +s +h
        40⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:620
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        39⤵
        System Location Discovery: System Language Discovery
        
        PID:1368
        
        C:\Windows\SysWOW64\Winupdate\winupdate.exe
        
        "C:\Windows\system32\Winupdate\winupdate.exe"
        39⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        
        PID:2184
        
        C:\Windows\SysWOW64\cmd.exe
        
        /c net stop MpsSvc
        40⤵
        
        PID:2264
        
        C:\Windows\SysWOW64\net.exe
        
        net stop MpsSvc
        41⤵
        System Location Discovery: System Language Discovery
        
        PID:2676
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MpsSvc
        42⤵
        System Location Discovery: System Language Discovery
        
        PID:1788
        
        C:\Windows\SysWOW64\Winupdate\winupdate.exe
        
        C:\Windows\SysWOW64\Winupdate\winupdate.exe
        40⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:696
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Winupdate\winupdate.exe" +s +h
        41⤵
        
        PID:2304
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Winupdate\winupdate.exe" +s +h
        42⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:1716
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Winupdate" +s +h
        41⤵
        
        PID:1320
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Winupdate" +s +h
        42⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:2504
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        41⤵
        
        PID:2840
        
        C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\winupdate.exe
        
        "C:\Windows\system32\Winupdate\rVeqxqv363Vq\winupdate.exe"
        41⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        
        PID:832
        
        C:\Windows\SysWOW64\cmd.exe
        
        /c net stop MpsSvc
        42⤵
        
        PID:1356
        
        C:\Windows\SysWOW64\net.exe
        
        net stop MpsSvc
        43⤵
        
        PID:2936
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MpsSvc
        44⤵
        
        PID:1596
        
        C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\winupdate.exe
        
        C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\winupdate.exe
        42⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:2804
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\winupdate.exe" +s +h
        43⤵
        System Location Discovery: System Language Discovery
        
        PID:2628
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\winupdate.exe" +s +h
        44⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:2612
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq" +s +h
        43⤵
        
        PID:1532
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq" +s +h
        44⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:2584
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        43⤵
        
        PID:1996
        
        C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq\winupdate.exe
        
        "C:\Windows\system32\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq\winupdate.exe"
        43⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        
        PID:1212
        
        C:\Windows\SysWOW64\cmd.exe
        
        /c net stop MpsSvc
        44⤵
        
        PID:1648
        
        C:\Windows\SysWOW64\net.exe
        
        net stop MpsSvc
        45⤵
        
        PID:1380
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MpsSvc
        46⤵
        System Location Discovery: System Language Discovery
        
        PID:2852
        
        C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq\winupdate.exe
        
        C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq\winupdate.exe
        44⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2264
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq\winupdate.exe" +s +h
        45⤵
        
        PID:692
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq\winupdate.exe" +s +h
        46⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:2452
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq" +s +h
        45⤵
        
        PID:604
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq" +s +h
        46⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:2240
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        45⤵
        System Location Discovery: System Language Discovery
        
        PID:1472
        
        C:\Windows\SysWOW64\Winupdate\winupdate.exe
        
        "C:\Windows\system32\Winupdate\winupdate.exe"
        45⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:972
        
        C:\Windows\SysWOW64\cmd.exe
        
        /c net stop MpsSvc
        46⤵
        
        PID:1952
        
        C:\Windows\SysWOW64\net.exe
        
        net stop MpsSvc
        47⤵
        
        PID:2584
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MpsSvc
        48⤵
        
        PID:1632
        
        C:\Windows\SysWOW64\Winupdate\winupdate.exe
        
        C:\Windows\SysWOW64\Winupdate\winupdate.exe
        46⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:620
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Winupdate\winupdate.exe" +s +h
        47⤵
        
        PID:1740
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Winupdate\winupdate.exe" +s +h
        48⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:2192
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Winupdate" +s +h
        47⤵
        System Location Discovery: System Language Discovery
        
        PID:1788
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Winupdate" +s +h
        48⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:1360
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        47⤵
        
        PID:2820
        
        C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\winupdate.exe
        
        "C:\Windows\system32\Winupdate\rVeqxqv363Vq\winupdate.exe"
        47⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        
        PID:1940
        
        C:\Windows\SysWOW64\cmd.exe
        
        /c net stop MpsSvc
        48⤵
        
        PID:2016
        
        C:\Windows\SysWOW64\net.exe
        
        net stop MpsSvc
        49⤵
        
        PID:2504
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MpsSvc
        50⤵
        
        PID:1856
        
        C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\winupdate.exe
        
        C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\winupdate.exe
        48⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\Winupdate\winupdate.exe

Filesize
732KB

MD5
7682d779384e5c5709d9ccc83b72fec0

SHA1
bf69afeb2a0ff053e3edde6bd0f518c90aac8b81

SHA256
4e8e573ab9db7a19486e141024cd14b4fe31d23118a0eac3cb5e9454fe629422

SHA512
296f040d21a95b349132d829d71128071a79f815f3a8a1209b72a5c72b95effa50538ddb9c4e936a3afa63a3e02562552dd660a7b5bdd6bcf0ade005133ed0b2

Download Submit
memory/2112-0-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download
memory/2664-68-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2664-71-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/2940-41-0x0000000000150000-0x0000000000151000-memory.dmp

Filesize
4KB

Download
memory/2940-27-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/3048-21-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/3048-17-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/3048-22-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/3048-23-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/3048-9-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/3048-7-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/3048-5-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/3048-11-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/3048-14-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/3048-19-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/3048-20-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/3048-47-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/3048-15-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/3048-3-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/3048-1-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads