darkcomet | 4e8e573ab9db7a19486e141024cd14b4fe31d23118a0eac3cb5e9454fe629422

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
04-01-2025 00:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe
Size

732KB
MD5

7682d779384e5c5709d9ccc83b72fec0
SHA1

bf69afeb2a0ff053e3edde6bd0f518c90aac8b81
SHA256

4e8e573ab9db7a19486e141024cd14b4fe31d23118a0eac3cb5e9454fe629422
SHA512

296f040d21a95b349132d829d71128071a79f815f3a8a1209b72a5c72b95effa50538ddb9c4e936a3afa63a3e02562552dd660a7b5bdd6bcf0ade005133ed0b2
SSDEEP

12288:mUmupRD3yrzSjMfZm1xqNCZbFaecjB4Bq0tqwGgZc0+dHLIpew8sO/KSii/qNk9T:lrDirzSQs1xpbc+5t5X9Ow8sPTi

Score

10^/10

darkcomet office discovery evasion persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Office

tekarzum.no-ip.biz:1604

Mutex

DC_MUTEX-NNLE62S

Attributes

InstallPath
Winupdate\winupdate.exe
gencode
rVeqxqv363Vq
install
true
offline_keylogger
true
persistence
true
reg_key
Winupdate

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Darkcomet family
darkcomet

Modifies WinLogon for persistence 2 TTPs 24 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe"	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe,C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe"	winupdate.exe

Sets file to hidden 1 TTPs 48 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
2388	attrib.exe
224	attrib.exe
3076	attrib.exe
208	attrib.exe
3160	attrib.exe
3844	attrib.exe
4484	attrib.exe
1656	attrib.exe
3468	attrib.exe
3560	attrib.exe
5200	attrib.exe
4984	attrib.exe
3844	attrib.exe
3664	attrib.exe
4048	attrib.exe
708	attrib.exe
2632	attrib.exe
5844	attrib.exe
5852	attrib.exe
3652	attrib.exe
3128	attrib.exe
4068	attrib.exe
456	attrib.exe
2632	attrib.exe
5192	attrib.exe
2668	attrib.exe
1680	attrib.exe
3832	attrib.exe
212	attrib.exe
3348	attrib.exe
2052	attrib.exe
4684	attrib.exe
2692	attrib.exe
2388	attrib.exe
4444	attrib.exe
1796	attrib.exe
1996	attrib.exe
2448	attrib.exe
2004	attrib.exe
2696	attrib.exe
2784	attrib.exe
1768	attrib.exe
2536	attrib.exe
4032	attrib.exe
756	attrib.exe
1600	attrib.exe
3612	attrib.exe
728	attrib.exe

Checks computer location settings 2 TTPs 23 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	winupdate.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	winupdate.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	winupdate.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	winupdate.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	winupdate.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	winupdate.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	winupdate.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	winupdate.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	winupdate.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	winupdate.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	winupdate.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	winupdate.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	winupdate.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	winupdate.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	winupdate.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	winupdate.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	winupdate.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	winupdate.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	winupdate.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	winupdate.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	winupdate.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	winupdate.exe

Deletes itself 1 IoCs

pid	Process
3876	notepad.exe

Executes dropped EXE 46 IoCs

pid	Process
4176	winupdate.exe
4836	winupdate.exe
4384	winupdate.exe
1616	winupdate.exe
1924	winupdate.exe
1536	winupdate.exe
2924	winupdate.exe
2492	winupdate.exe
1192	winupdate.exe
1444	winupdate.exe
2040	winupdate.exe
4052	winupdate.exe
400	winupdate.exe
1284	winupdate.exe
4104	winupdate.exe
4248	winupdate.exe
4964	winupdate.exe
2780	winupdate.exe
1580	winupdate.exe
3128	winupdate.exe
4576	winupdate.exe
2924	winupdate.exe
4104	winupdate.exe
2600	winupdate.exe
3120	winupdate.exe
3448	winupdate.exe
1796	winupdate.exe
4484	winupdate.exe
3616	winupdate.exe
1044	winupdate.exe
3120	winupdate.exe
4596	winupdate.exe
4952	winupdate.exe
5036	winupdate.exe
768	winupdate.exe
4316	winupdate.exe
3056	winupdate.exe
1384	winupdate.exe
2016	winupdate.exe
4048	winupdate.exe
4952	winupdate.exe
2824	winupdate.exe
5256	winupdate.exe
5312	winupdate.exe
5908	winupdate.exe
5960	winupdate.exe

Adds Run key to start application 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Winupdate = "C:\\Windows\\system32\\Winupdate\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Winupdate = "C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Winupdate = "C:\\Windows\\system32\\Winupdate\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Winupdate = "C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Winupdate = "C:\\Windows\\system32\\Winupdate\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Winupdate = "C:\\Windows\\system32\\Winupdate\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Winupdate = "C:\\Windows\\system32\\Winupdate\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Winupdate = "C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Winupdate = "C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Winupdate = "C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Winupdate = "C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Winupdate = "C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Winupdate = "C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Winupdate = "C:\\Windows\\system32\\Winupdate\\winupdate.exe"	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Winupdate = "C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Winupdate = "C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Winupdate = "C:\\Windows\\system32\\Winupdate\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Winupdate = "C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Winupdate = "C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Winupdate = "C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Winupdate = "C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Winupdate = "C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Winupdate = "C:\\Windows\\system32\\Winupdate\\rVeqxqv363Vq\\rVeqxqv363Vq\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Winupdate = "C:\\Windows\\system32\\Winupdate\\winupdate.exe"	winupdate.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Winupdate\winupdate.exe	winupdate.exe
File created	C:\Windows\SysWOW64\Winupdate\winupdate.exe	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\winupdate.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq\winupdate.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Winupdate\winupdate.exe	winupdate.exe
File created	C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq\winupdate.exe	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\winupdate.exe	winupdate.exe
File created	C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\winupdate.exe	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Winupdate	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Winupdate\winupdate.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq\	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\winupdate.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\winupdate.exe	winupdate.exe
File created	C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\winupdate.exe	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Winupdate\winupdate.exe	attrib.exe
File created	C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq\winupdate.exe	winupdate.exe
File created	C:\Windows\SysWOW64\Winupdate\winupdate.exe	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\winupdate.exe	attrib.exe
File created	C:\Windows\SysWOW64\Winupdate\winupdate.exe	winupdate.exe
File created	C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq\winupdate.exe	winupdate.exe
File created	C:\Windows\SysWOW64\Winupdate\winupdate.exe	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq\winupdate.exe	winupdate.exe
File created	C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\winupdate.exe	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\winupdate.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq\winupdate.exe	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq\	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq\winupdate.exe	attrib.exe
File created	C:\Windows\SysWOW64\Winupdate\winupdate.exe	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq\winupdate.exe	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Winupdate\	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Winupdate\	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Winupdate\	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe
File opened for modification	C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq\winupdate.exe	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Winupdate	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq\winupdate.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\winupdate.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\winupdate.exe	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\winupdate.exe	winupdate.exe
File created	C:\Windows\SysWOW64\Winupdate\winupdate.exe	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Winupdate\winupdate.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\winupdate.exe	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Winupdate\winupdate.exe	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe
File opened for modification	C:\Windows\SysWOW64\Winupdate\	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq\	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq\	winupdate.exe
File created	C:\Windows\SysWOW64\Winupdate\winupdate.exe	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Winupdate	attrib.exe
File created	C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\winupdate.exe	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq\winupdate.exe	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq\	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Winupdate\winupdate.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\winupdate.exe	winupdate.exe
File created	C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\winupdate.exe	winupdate.exe

Suspicious use of SetThreadContext 24 IoCs

description	pid	Process	procid_target
PID 4884 set thread context of 4848	4884	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe	84
PID 4176 set thread context of 4836	4176	winupdate.exe	101
PID 4384 set thread context of 1616	4384	winupdate.exe	118
PID 1924 set thread context of 1536	1924	winupdate.exe	135
PID 2924 set thread context of 2492	2924	winupdate.exe	148
PID 1192 set thread context of 1444	1192	winupdate.exe	164
PID 2040 set thread context of 4052	2040	winupdate.exe	177
PID 400 set thread context of 1284	400	winupdate.exe	190
PID 4104 set thread context of 4248	4104	winupdate.exe	203
PID 4964 set thread context of 2780	4964	winupdate.exe	216
PID 1580 set thread context of 3128	1580	winupdate.exe	229
PID 4576 set thread context of 2924	4576	winupdate.exe	242
PID 4104 set thread context of 2600	4104	winupdate.exe	255
PID 3120 set thread context of 3448	3120	winupdate.exe	268
PID 1796 set thread context of 4484	1796	winupdate.exe	281
PID 3616 set thread context of 1044	3616	winupdate.exe	294
PID 3120 set thread context of 4596	3120	winupdate.exe	307
PID 4952 set thread context of 5036	4952	winupdate.exe	320
PID 768 set thread context of 4316	768	winupdate.exe	333
PID 3056 set thread context of 1384	3056	winupdate.exe	346
PID 2016 set thread context of 4048	2016	winupdate.exe	359
PID 4952 set thread context of 2824	4952	winupdate.exe	372
PID 5256 set thread context of 5312	5256	winupdate.exe	385
PID 5908 set thread context of 5960	5908	winupdate.exe	398

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winupdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winupdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winupdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winupdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winupdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winupdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winupdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winupdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winupdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winupdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 23 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	winupdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	winupdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	winupdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	winupdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	winupdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	winupdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	winupdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	winupdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	winupdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	winupdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	winupdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	winupdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	winupdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	winupdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	winupdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	winupdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	winupdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	winupdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	winupdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	winupdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	winupdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	winupdate.exe

Runs net.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4848	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe
Token: SeSecurityPrivilege	4848	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe
Token: SeTakeOwnershipPrivilege	4848	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe
Token: SeLoadDriverPrivilege	4848	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe
Token: SeSystemProfilePrivilege	4848	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe
Token: SeSystemtimePrivilege	4848	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe
Token: SeProfSingleProcessPrivilege	4848	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe
Token: SeIncBasePriorityPrivilege	4848	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe
Token: SeCreatePagefilePrivilege	4848	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe
Token: SeBackupPrivilege	4848	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe
Token: SeRestorePrivilege	4848	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe
Token: SeShutdownPrivilege	4848	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe
Token: SeDebugPrivilege	4848	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe
Token: SeSystemEnvironmentPrivilege	4848	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe
Token: SeChangeNotifyPrivilege	4848	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe
Token: SeRemoteShutdownPrivilege	4848	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe
Token: SeUndockPrivilege	4848	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe
Token: SeManageVolumePrivilege	4848	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe
Token: SeImpersonatePrivilege	4848	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe
Token: SeCreateGlobalPrivilege	4848	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe
Token: 33	4848	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe
Token: 34	4848	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe
Token: 35	4848	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe
Token: 36	4848	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe
Token: SeIncreaseQuotaPrivilege	4836	winupdate.exe
Token: SeSecurityPrivilege	4836	winupdate.exe
Token: SeTakeOwnershipPrivilege	4836	winupdate.exe
Token: SeLoadDriverPrivilege	4836	winupdate.exe
Token: SeSystemProfilePrivilege	4836	winupdate.exe
Token: SeSystemtimePrivilege	4836	winupdate.exe
Token: SeProfSingleProcessPrivilege	4836	winupdate.exe
Token: SeIncBasePriorityPrivilege	4836	winupdate.exe
Token: SeCreatePagefilePrivilege	4836	winupdate.exe
Token: SeBackupPrivilege	4836	winupdate.exe
Token: SeRestorePrivilege	4836	winupdate.exe
Token: SeShutdownPrivilege	4836	winupdate.exe
Token: SeDebugPrivilege	4836	winupdate.exe
Token: SeSystemEnvironmentPrivilege	4836	winupdate.exe
Token: SeChangeNotifyPrivilege	4836	winupdate.exe
Token: SeRemoteShutdownPrivilege	4836	winupdate.exe
Token: SeUndockPrivilege	4836	winupdate.exe
Token: SeManageVolumePrivilege	4836	winupdate.exe
Token: SeImpersonatePrivilege	4836	winupdate.exe
Token: SeCreateGlobalPrivilege	4836	winupdate.exe
Token: 33	4836	winupdate.exe
Token: 34	4836	winupdate.exe
Token: 35	4836	winupdate.exe
Token: 36	4836	winupdate.exe
Token: SeIncreaseQuotaPrivilege	1616	winupdate.exe
Token: SeSecurityPrivilege	1616	winupdate.exe
Token: SeTakeOwnershipPrivilege	1616	winupdate.exe
Token: SeLoadDriverPrivilege	1616	winupdate.exe
Token: SeSystemProfilePrivilege	1616	winupdate.exe
Token: SeSystemtimePrivilege	1616	winupdate.exe
Token: SeProfSingleProcessPrivilege	1616	winupdate.exe
Token: SeIncBasePriorityPrivilege	1616	winupdate.exe
Token: SeCreatePagefilePrivilege	1616	winupdate.exe
Token: SeBackupPrivilege	1616	winupdate.exe
Token: SeRestorePrivilege	1616	winupdate.exe
Token: SeShutdownPrivilege	1616	winupdate.exe
Token: SeDebugPrivilege	1616	winupdate.exe
Token: SeSystemEnvironmentPrivilege	1616	winupdate.exe
Token: SeChangeNotifyPrivilege	1616	winupdate.exe
Token: SeRemoteShutdownPrivilege	1616	winupdate.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4884 wrote to memory of 4392	4884	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe	83
PID 4884 wrote to memory of 4392	4884	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe	83
PID 4884 wrote to memory of 4392	4884	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe	83
PID 4884 wrote to memory of 4848	4884	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe	84
PID 4884 wrote to memory of 4848	4884	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe	84
PID 4884 wrote to memory of 4848	4884	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe	84
PID 4884 wrote to memory of 4848	4884	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe	84
PID 4884 wrote to memory of 4848	4884	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe	84
PID 4884 wrote to memory of 4848	4884	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe	84
PID 4884 wrote to memory of 4848	4884	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe	84
PID 4884 wrote to memory of 4848	4884	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe	84
PID 4884 wrote to memory of 4848	4884	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe	84
PID 4884 wrote to memory of 4848	4884	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe	84
PID 4884 wrote to memory of 4848	4884	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe	84
PID 4884 wrote to memory of 4848	4884	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe	84
PID 4884 wrote to memory of 4848	4884	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe	84
PID 4884 wrote to memory of 4848	4884	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe	84
PID 4392 wrote to memory of 4276	4392	cmd.exe	86
PID 4392 wrote to memory of 4276	4392	cmd.exe	86
PID 4392 wrote to memory of 4276	4392	cmd.exe	86
PID 4276 wrote to memory of 2940	4276	net.exe	87
PID 4276 wrote to memory of 2940	4276	net.exe	87
PID 4276 wrote to memory of 2940	4276	net.exe	87
PID 4848 wrote to memory of 2444	4848	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe	89
PID 4848 wrote to memory of 2444	4848	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe	89
PID 4848 wrote to memory of 2444	4848	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe	89
PID 4848 wrote to memory of 220	4848	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe	91
PID 4848 wrote to memory of 220	4848	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe	91
PID 4848 wrote to memory of 220	4848	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe	91
PID 4848 wrote to memory of 3876	4848	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe	92
PID 4848 wrote to memory of 3876	4848	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe	92
PID 4848 wrote to memory of 3876	4848	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe	92
PID 4848 wrote to memory of 3876	4848	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe	92
PID 4848 wrote to memory of 3876	4848	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe	92
PID 4848 wrote to memory of 3876	4848	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe	92
PID 4848 wrote to memory of 3876	4848	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe	92
PID 4848 wrote to memory of 3876	4848	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe	92
PID 4848 wrote to memory of 3876	4848	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe	92
PID 4848 wrote to memory of 3876	4848	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe	92
PID 4848 wrote to memory of 3876	4848	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe	92
PID 4848 wrote to memory of 3876	4848	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe	92
PID 4848 wrote to memory of 3876	4848	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe	92
PID 4848 wrote to memory of 3876	4848	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe	92
PID 4848 wrote to memory of 3876	4848	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe	92
PID 4848 wrote to memory of 3876	4848	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe	92
PID 4848 wrote to memory of 3876	4848	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe	92
PID 2444 wrote to memory of 1796	2444	cmd.exe	94
PID 2444 wrote to memory of 1796	2444	cmd.exe	94
PID 2444 wrote to memory of 1796	2444	cmd.exe	94
PID 220 wrote to memory of 1768	220	cmd.exe	95
PID 220 wrote to memory of 1768	220	cmd.exe	95
PID 220 wrote to memory of 1768	220	cmd.exe	95
PID 4848 wrote to memory of 4176	4848	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe	96
PID 4848 wrote to memory of 4176	4848	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe	96
PID 4848 wrote to memory of 4176	4848	JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe	96
PID 4176 wrote to memory of 3288	4176	winupdate.exe	100
PID 4176 wrote to memory of 3288	4176	winupdate.exe	100
PID 4176 wrote to memory of 3288	4176	winupdate.exe	100
PID 4176 wrote to memory of 4836	4176	winupdate.exe	101
PID 4176 wrote to memory of 4836	4176	winupdate.exe	101
PID 4176 wrote to memory of 4836	4176	winupdate.exe	101
PID 4176 wrote to memory of 4836	4176	winupdate.exe	101
PID 4176 wrote to memory of 4836	4176	winupdate.exe	101
PID 4176 wrote to memory of 4836	4176	winupdate.exe	101

Views/modifies file attributes 1 TTPs 48 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
5852	attrib.exe
208	attrib.exe
4484	attrib.exe
1656	attrib.exe
2448	attrib.exe
2388	attrib.exe
708	attrib.exe
5200	attrib.exe
4984	attrib.exe
1600	attrib.exe
3664	attrib.exe
1768	attrib.exe
3652	attrib.exe
4032	attrib.exe
3844	attrib.exe
1680	attrib.exe
4684	attrib.exe
3832	attrib.exe
2696	attrib.exe
5844	attrib.exe
2668	attrib.exe
212	attrib.exe
3612	attrib.exe
4068	attrib.exe
3468	attrib.exe
2004	attrib.exe
5192	attrib.exe
2784	attrib.exe
3348	attrib.exe
2536	attrib.exe
756	attrib.exe
728	attrib.exe
2692	attrib.exe
456	attrib.exe
2632	attrib.exe
2052	attrib.exe
4444	attrib.exe
224	attrib.exe
1796	attrib.exe
3128	attrib.exe
3160	attrib.exe
3844	attrib.exe
3076	attrib.exe
3560	attrib.exe
1996	attrib.exe
4048	attrib.exe
2388	attrib.exe
2632	attrib.exe

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4884
- C:\Windows\SysWOW64\cmd.exe
  /c net stop MpsSvc
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4392
- - C:\Windows\SysWOW64\net.exe
    net stop MpsSvc
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4276
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop MpsSvc
      4⤵
      PID:2940
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe
  2⤵
  - Modifies WinLogon for persistence
  - Checks computer location settings
  - Adds Run key to start application
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4848
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe" +s +h
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2444
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7682d779384e5c5709d9ccc83b72fec0.exe" +s +h
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:1796
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:220
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:1768
- - C:\Windows\SysWOW64\notepad.exe
    notepad
    3⤵
    - Deletes itself
    PID:3876
- - C:\Windows\SysWOW64\Winupdate\winupdate.exe
    "C:\Windows\system32\Winupdate\winupdate.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:4176
  - - C:\Windows\SysWOW64\cmd.exe
      /c net stop MpsSvc
      4⤵
      PID:3288
    - - C:\Windows\SysWOW64\net.exe
        
        net stop MpsSvc
        5⤵
        
        PID:1984
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MpsSvc
        6⤵
        
        PID:3096
  - - C:\Windows\SysWOW64\Winupdate\winupdate.exe
      C:\Windows\SysWOW64\Winupdate\winupdate.exe
      4⤵
      Modifies WinLogon for persistence
      Checks computer location settings
      Executes dropped EXE
      Adds Run key to start application
      Drops file in System32 directory
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      PID:4836
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Winupdate\winupdate.exe" +s +h
        5⤵
        
        PID:4872
      - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Winupdate\winupdate.exe" +s +h
        6⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:3652
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Winupdate" +s +h
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3048
      - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Winupdate" +s +h
        6⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:1996
    - - C:\Windows\SysWOW64\notepad.exe
        
        notepad
        5⤵
        
        PID:1832
    - - C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\winupdate.exe
        
        "C:\Windows\system32\Winupdate\rVeqxqv363Vq\winupdate.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4384
      - C:\Windows\SysWOW64\cmd.exe
        
        /c net stop MpsSvc
        6⤵
        
        PID:2536
        
        C:\Windows\SysWOW64\net.exe
        
        net stop MpsSvc
        7⤵
        
        PID:4704
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MpsSvc
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4616
      - C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\winupdate.exe
        
        C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\winupdate.exe
        6⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:1616
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\winupdate.exe" +s +h
        7⤵
        
        PID:3944
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\winupdate.exe" +s +h
        8⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:3128
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq" +s +h
        7⤵
        
        PID:3404
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq" +s +h
        8⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:3348
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        7⤵
        
        PID:4964
        
        C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq\winupdate.exe
        
        "C:\Windows\system32\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq\winupdate.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1924
        
        C:\Windows\SysWOW64\cmd.exe
        
        /c net stop MpsSvc
        8⤵
        
        PID:4560
        
        C:\Windows\SysWOW64\net.exe
        
        net stop MpsSvc
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:4032
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MpsSvc
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:316
        
        C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq\winupdate.exe
        
        C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq\winupdate.exe
        8⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        
        PID:1536
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq\winupdate.exe" +s +h
        9⤵
        
        PID:1668
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq\winupdate.exe" +s +h
        10⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:208
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq" +s +h
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:3888
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq" +s +h
        10⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:2536
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        9⤵
        
        PID:1188
        
        C:\Windows\SysWOW64\Winupdate\winupdate.exe
        
        "C:\Windows\system32\Winupdate\winupdate.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2924
        
        C:\Windows\SysWOW64\cmd.exe
        
        /c net stop MpsSvc
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:1092
        
        C:\Windows\SysWOW64\net.exe
        
        net stop MpsSvc
        11⤵
        
        PID:1804
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MpsSvc
        12⤵
        
        PID:1528
        
        C:\Windows\SysWOW64\Winupdate\winupdate.exe
        
        C:\Windows\SysWOW64\Winupdate\winupdate.exe
        10⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        
        PID:2492
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Winupdate\winupdate.exe" +s +h
        11⤵
        System Location Discovery: System Language Discovery
        
        PID:3760
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Winupdate\winupdate.exe" +s +h
        12⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:4032
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Winupdate" +s +h
        11⤵
        System Location Discovery: System Language Discovery
        
        PID:4728
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Winupdate" +s +h
        12⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:4984
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        11⤵
        
        PID:3680
        
        C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\winupdate.exe
        
        "C:\Windows\system32\Winupdate\rVeqxqv363Vq\winupdate.exe"
        11⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1192
        
        C:\Windows\SysWOW64\cmd.exe
        
        /c net stop MpsSvc
        12⤵
        System Location Discovery: System Language Discovery
        
        PID:3884
        
        C:\Windows\SysWOW64\net.exe
        
        net stop MpsSvc
        13⤵
        
        PID:4436
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MpsSvc
        14⤵
        
        PID:3280
        
        C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\winupdate.exe
        
        C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\winupdate.exe
        12⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1444
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\winupdate.exe" +s +h
        13⤵
        System Location Discovery: System Language Discovery
        
        PID:64
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\winupdate.exe" +s +h
        14⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:2052
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq" +s +h
        13⤵
        
        PID:4008
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq" +s +h
        14⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:3160
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        13⤵
        
        PID:2280
        
        C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq\winupdate.exe
        
        "C:\Windows\system32\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq\winupdate.exe"
        13⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2040
        
        C:\Windows\SysWOW64\cmd.exe
        
        /c net stop MpsSvc
        14⤵
        
        PID:3980
        
        C:\Windows\SysWOW64\net.exe
        
        net stop MpsSvc
        15⤵
        System Location Discovery: System Language Discovery
        
        PID:704
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MpsSvc
        16⤵
        
        PID:3004
        
        C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq\winupdate.exe
        
        C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq\winupdate.exe
        14⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        
        PID:4052
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq\winupdate.exe" +s +h
        15⤵
        
        PID:1836
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq\winupdate.exe" +s +h
        16⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:3844
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq" +s +h
        15⤵
        System Location Discovery: System Language Discovery
        
        PID:1912
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq" +s +h
        16⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:2668
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        15⤵
        
        PID:2864
        
        C:\Windows\SysWOW64\Winupdate\winupdate.exe
        
        "C:\Windows\system32\Winupdate\winupdate.exe"
        15⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:400
        
        C:\Windows\SysWOW64\cmd.exe
        
        /c net stop MpsSvc
        16⤵
        
        PID:2764
        
        C:\Windows\SysWOW64\net.exe
        
        net stop MpsSvc
        17⤵
        
        PID:1896
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MpsSvc
        18⤵
        System Location Discovery: System Language Discovery
        
        PID:1584
        
        C:\Windows\SysWOW64\Winupdate\winupdate.exe
        
        C:\Windows\SysWOW64\Winupdate\winupdate.exe
        16⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        
        PID:1284
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Winupdate\winupdate.exe" +s +h
        17⤵
        
        PID:3160
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Winupdate\winupdate.exe" +s +h
        18⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:1680
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Winupdate" +s +h
        17⤵
        System Location Discovery: System Language Discovery
        
        PID:4440
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Winupdate" +s +h
        18⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:4684
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        17⤵
        
        PID:4492
        
        C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\winupdate.exe
        
        "C:\Windows\system32\Winupdate\rVeqxqv363Vq\winupdate.exe"
        17⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4104
        
        C:\Windows\SysWOW64\cmd.exe
        
        /c net stop MpsSvc
        18⤵
        
        PID:1192
        
        C:\Windows\SysWOW64\net.exe
        
        net stop MpsSvc
        19⤵
        
        PID:3884
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MpsSvc
        20⤵
        
        PID:4356
        
        C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\winupdate.exe
        
        C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\winupdate.exe
        18⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4248
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\winupdate.exe" +s +h
        19⤵
        
        PID:3632
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\winupdate.exe" +s +h
        20⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:1600
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq" +s +h
        19⤵
        
        PID:4224
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq" +s +h
        20⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:756
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        19⤵
        
        PID:3080
        
        C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq\winupdate.exe
        
        "C:\Windows\system32\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq\winupdate.exe"
        19⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4964
        
        C:\Windows\SysWOW64\cmd.exe
        
        /c net stop MpsSvc
        20⤵
        System Location Discovery: System Language Discovery
        
        PID:2944
        
        C:\Windows\SysWOW64\net.exe
        
        net stop MpsSvc
        21⤵
        
        PID:1892
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MpsSvc
        22⤵
        
        PID:1100
        
        C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq\winupdate.exe
        
        C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq\winupdate.exe
        20⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        
        PID:2780
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq\winupdate.exe" +s +h
        21⤵
        
        PID:4764
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq\winupdate.exe" +s +h
        22⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:3832
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq" +s +h
        21⤵
        
        PID:4492
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq" +s +h
        22⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:212
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        21⤵
        
        PID:1996
        
        C:\Windows\SysWOW64\Winupdate\winupdate.exe
        
        "C:\Windows\system32\Winupdate\winupdate.exe"
        21⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1580
        
        C:\Windows\SysWOW64\cmd.exe
        
        /c net stop MpsSvc
        22⤵
        
        PID:756
        
        C:\Windows\SysWOW64\net.exe
        
        net stop MpsSvc
        23⤵
        System Location Discovery: System Language Discovery
        
        PID:1556
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MpsSvc
        24⤵
        System Location Discovery: System Language Discovery
        
        PID:4392
        
        C:\Windows\SysWOW64\Winupdate\winupdate.exe
        
        C:\Windows\SysWOW64\Winupdate\winupdate.exe
        22⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        
        PID:3128
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Winupdate\winupdate.exe" +s +h
        23⤵
        
        PID:1828
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Winupdate\winupdate.exe" +s +h
        24⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:3844
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Winupdate" +s +h
        23⤵
        System Location Discovery: System Language Discovery
        
        PID:2156
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Winupdate" +s +h
        24⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:3664
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        23⤵
        System Location Discovery: System Language Discovery
        
        PID:924
        
        C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\winupdate.exe
        
        "C:\Windows\system32\Winupdate\rVeqxqv363Vq\winupdate.exe"
        23⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4576
        
        C:\Windows\SysWOW64\cmd.exe
        
        /c net stop MpsSvc
        24⤵
        
        PID:1188
        
        C:\Windows\SysWOW64\net.exe
        
        net stop MpsSvc
        25⤵
        
        PID:4448
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MpsSvc
        26⤵
        
        PID:5020
        
        C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\winupdate.exe
        
        C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\winupdate.exe
        24⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        
        PID:2924
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\winupdate.exe" +s +h
        25⤵
        System Location Discovery: System Language Discovery
        
        PID:4916
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\winupdate.exe" +s +h
        26⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:3612
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq" +s +h
        25⤵
        
        PID:1088
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq" +s +h
        26⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:4068
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        25⤵
        System Location Discovery: System Language Discovery
        
        PID:3156
        
        C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq\winupdate.exe
        
        "C:\Windows\system32\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq\winupdate.exe"
        25⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4104
        
        C:\Windows\SysWOW64\cmd.exe
        
        /c net stop MpsSvc
        26⤵
        
        PID:4212
        
        C:\Windows\SysWOW64\net.exe
        
        net stop MpsSvc
        27⤵
        
        PID:3260
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MpsSvc
        28⤵
        
        PID:3528
        
        C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq\winupdate.exe
        
        C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq\winupdate.exe
        26⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        
        PID:2600
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq\winupdate.exe" +s +h
        27⤵
        
        PID:4876
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq\winupdate.exe" +s +h
        28⤵
        Sets file to hidden
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:4048
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq" +s +h
        27⤵
        
        PID:4576
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq" +s +h
        28⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:4484
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        27⤵
        
        PID:3832
        
        C:\Windows\SysWOW64\Winupdate\winupdate.exe
        
        "C:\Windows\system32\Winupdate\winupdate.exe"
        27⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3120
        
        C:\Windows\SysWOW64\cmd.exe
        
        /c net stop MpsSvc
        28⤵
        
        PID:1252
        
        C:\Windows\SysWOW64\net.exe
        
        net stop MpsSvc
        29⤵
        System Location Discovery: System Language Discovery
        
        PID:2692
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MpsSvc
        30⤵
        
        PID:4056
        
        C:\Windows\SysWOW64\Winupdate\winupdate.exe
        
        C:\Windows\SysWOW64\Winupdate\winupdate.exe
        28⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        
        PID:3448
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Winupdate\winupdate.exe" +s +h
        29⤵
        System Location Discovery: System Language Discovery
        
        PID:1376
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Winupdate\winupdate.exe" +s +h
        30⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:1656
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Winupdate" +s +h
        29⤵
        System Location Discovery: System Language Discovery
        
        PID:4416
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Winupdate" +s +h
        30⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:2448
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        29⤵
        
        PID:2056
        
        C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\winupdate.exe
        
        "C:\Windows\system32\Winupdate\rVeqxqv363Vq\winupdate.exe"
        29⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1796
        
        C:\Windows\SysWOW64\cmd.exe
        
        /c net stop MpsSvc
        30⤵
        
        PID:812
        
        C:\Windows\SysWOW64\net.exe
        
        net stop MpsSvc
        31⤵
        
        PID:4724
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MpsSvc
        32⤵
        
        PID:3204
        
        C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\winupdate.exe
        
        C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\winupdate.exe
        30⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        
        PID:4484
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\winupdate.exe" +s +h
        31⤵
        System Location Discovery: System Language Discovery
        
        PID:4708
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\winupdate.exe" +s +h
        32⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:3468
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq" +s +h
        31⤵
        
        PID:3016
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq" +s +h
        32⤵
        Sets file to hidden
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:728
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        31⤵
        
        PID:2692
        
        C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq\winupdate.exe
        
        "C:\Windows\system32\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq\winupdate.exe"
        31⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3616
        
        C:\Windows\SysWOW64\cmd.exe
        
        /c net stop MpsSvc
        32⤵
        System Location Discovery: System Language Discovery
        
        PID:3448
        
        C:\Windows\SysWOW64\net.exe
        
        net stop MpsSvc
        33⤵
        
        PID:1680
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MpsSvc
        34⤵
        
        PID:1872
        
        C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq\winupdate.exe
        
        C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq\winupdate.exe
        32⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        
        PID:1044
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq\winupdate.exe" +s +h
        33⤵
        System Location Discovery: System Language Discovery
        
        PID:4480
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq\winupdate.exe" +s +h
        34⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:2004
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq" +s +h
        33⤵
        
        PID:216
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq" +s +h
        34⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:2388
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        33⤵
        
        PID:396
        
        C:\Windows\SysWOW64\Winupdate\winupdate.exe
        
        "C:\Windows\system32\Winupdate\winupdate.exe"
        33⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3120
        
        C:\Windows\SysWOW64\cmd.exe
        
        /c net stop MpsSvc
        34⤵
        
        PID:628
        
        C:\Windows\SysWOW64\net.exe
        
        net stop MpsSvc
        35⤵
        System Location Discovery: System Language Discovery
        
        PID:2664
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MpsSvc
        36⤵
        
        PID:2608
        
        C:\Windows\SysWOW64\Winupdate\winupdate.exe
        
        C:\Windows\SysWOW64\Winupdate\winupdate.exe
        34⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        
        PID:4596
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Winupdate\winupdate.exe" +s +h
        35⤵
        System Location Discovery: System Language Discovery
        
        PID:2988
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Winupdate\winupdate.exe" +s +h
        36⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:2388
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Winupdate" +s +h
        35⤵
        System Location Discovery: System Language Discovery
        
        PID:4608
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Winupdate" +s +h
        36⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:2696
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        35⤵
        System Location Discovery: System Language Discovery
        
        PID:3240
        
        C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\winupdate.exe
        
        "C:\Windows\system32\Winupdate\rVeqxqv363Vq\winupdate.exe"
        35⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4952
        
        C:\Windows\SysWOW64\cmd.exe
        
        /c net stop MpsSvc
        36⤵
        
        PID:396
        
        C:\Windows\SysWOW64\net.exe
        
        net stop MpsSvc
        37⤵
        System Location Discovery: System Language Discovery
        
        PID:3612
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MpsSvc
        38⤵
        System Location Discovery: System Language Discovery
        
        PID:4048
        
        C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\winupdate.exe
        
        C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\winupdate.exe
        36⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        
        PID:5036
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\winupdate.exe" +s +h
        37⤵
        System Location Discovery: System Language Discovery
        
        PID:1256
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\winupdate.exe" +s +h
        38⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:2692
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq" +s +h
        37⤵
        
        PID:4572
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq" +s +h
        38⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:4444
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        37⤵
        
        PID:3836
        
        C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq\winupdate.exe
        
        "C:\Windows\system32\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq\winupdate.exe"
        37⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:768
        
        C:\Windows\SysWOW64\cmd.exe
        
        /c net stop MpsSvc
        38⤵
        System Location Discovery: System Language Discovery
        
        PID:1872
        
        C:\Windows\SysWOW64\net.exe
        
        net stop MpsSvc
        39⤵
        
        PID:628
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MpsSvc
        40⤵
        
        PID:3304
        
        C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq\winupdate.exe
        
        C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq\winupdate.exe
        38⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        
        PID:4316
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq\winupdate.exe" +s +h
        39⤵
        
        PID:4360
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq\winupdate.exe" +s +h
        40⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:224
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq" +s +h
        39⤵
        
        PID:1768
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq" +s +h
        40⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:456
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        39⤵
        
        PID:3564
        
        C:\Windows\SysWOW64\Winupdate\winupdate.exe
        
        "C:\Windows\system32\Winupdate\winupdate.exe"
        39⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3056
        
        C:\Windows\SysWOW64\cmd.exe
        
        /c net stop MpsSvc
        40⤵
        System Location Discovery: System Language Discovery
        
        PID:1076
        
        C:\Windows\SysWOW64\net.exe
        
        net stop MpsSvc
        41⤵
        System Location Discovery: System Language Discovery
        
        PID:4772
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MpsSvc
        42⤵
        
        PID:3304
        
        C:\Windows\SysWOW64\Winupdate\winupdate.exe
        
        C:\Windows\SysWOW64\Winupdate\winupdate.exe
        40⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1384
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Winupdate\winupdate.exe" +s +h
        41⤵
        
        PID:2664
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Winupdate\winupdate.exe" +s +h
        42⤵
        Sets file to hidden
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:708
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Winupdate" +s +h
        41⤵
        
        PID:468
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Winupdate" +s +h
        42⤵
        Sets file to hidden
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:3076
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        41⤵
        
        PID:60
        
        C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\winupdate.exe
        
        "C:\Windows\system32\Winupdate\rVeqxqv363Vq\winupdate.exe"
        41⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2016
        
        C:\Windows\SysWOW64\cmd.exe
        
        /c net stop MpsSvc
        42⤵
        System Location Discovery: System Language Discovery
        
        PID:4556
        
        C:\Windows\SysWOW64\net.exe
        
        net stop MpsSvc
        43⤵
        
        PID:2104
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MpsSvc
        44⤵
        
        PID:2484
        
        C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\winupdate.exe
        
        C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\winupdate.exe
        42⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        
        PID:4048
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\winupdate.exe" +s +h
        43⤵
        
        PID:2432
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\winupdate.exe" +s +h
        44⤵
        Sets file to hidden
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:2632
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq" +s +h
        43⤵
        System Location Discovery: System Language Discovery
        
        PID:3884
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq" +s +h
        44⤵
        Sets file to hidden
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:3560
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        43⤵
        
        PID:2504
        
        C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq\winupdate.exe
        
        "C:\Windows\system32\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq\winupdate.exe"
        43⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4952
        
        C:\Windows\SysWOW64\cmd.exe
        
        /c net stop MpsSvc
        44⤵
        
        PID:4792
        
        C:\Windows\SysWOW64\net.exe
        
        net stop MpsSvc
        45⤵
        
        PID:1672
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MpsSvc
        46⤵
        
        PID:4140
        
        C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq\winupdate.exe
        
        C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq\winupdate.exe
        44⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2824
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq\winupdate.exe" +s +h
        45⤵
        
        PID:2484
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq\winupdate.exe" +s +h
        46⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:5200
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq" +s +h
        45⤵
        
        PID:4892
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\rVeqxqv363Vq" +s +h
        46⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:5192
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        45⤵
        
        PID:768
        
        C:\Windows\SysWOW64\Winupdate\winupdate.exe
        
        "C:\Windows\system32\Winupdate\winupdate.exe"
        45⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:5256
        
        C:\Windows\SysWOW64\cmd.exe
        
        /c net stop MpsSvc
        46⤵
        
        PID:5304
        
        C:\Windows\SysWOW64\net.exe
        
        net stop MpsSvc
        47⤵
        System Location Discovery: System Language Discovery
        
        PID:5384
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MpsSvc
        48⤵
        System Location Discovery: System Language Discovery
        
        PID:5400
        
        C:\Windows\SysWOW64\Winupdate\winupdate.exe
        
        C:\Windows\SysWOW64\Winupdate\winupdate.exe
        46⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        
        PID:5312
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Winupdate\winupdate.exe" +s +h
        47⤵
        
        PID:5464
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Winupdate\winupdate.exe" +s +h
        48⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:5844
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Winupdate" +s +h
        47⤵
        
        PID:5472
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Winupdate" +s +h
        48⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:5852
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        47⤵
        
        PID:5480
        
        C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\winupdate.exe
        
        "C:\Windows\system32\Winupdate\rVeqxqv363Vq\winupdate.exe"
        47⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:5908
        
        C:\Windows\SysWOW64\cmd.exe
        
        /c net stop MpsSvc
        48⤵
        
        PID:5952
        
        C:\Windows\SysWOW64\net.exe
        
        net stop MpsSvc
        49⤵
        
        PID:6032
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MpsSvc
        50⤵
        
        PID:6048
        
        C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\winupdate.exe
        
        C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\winupdate.exe
        48⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5960
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\winupdate.exe" +s +h
        49⤵
        
        PID:6112
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq\winupdate.exe" +s +h
        50⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:2784
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq" +s +h
        49⤵
        
        PID:6120
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Winupdate\rVeqxqv363Vq" +s +h
        50⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:2632
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        49⤵
        
        PID:6128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Winupdate\winupdate.exe

Filesize
732KB

MD5
7682d779384e5c5709d9ccc83b72fec0

SHA1
bf69afeb2a0ff053e3edde6bd0f518c90aac8b81

SHA256
4e8e573ab9db7a19486e141024cd14b4fe31d23118a0eac3cb5e9454fe629422

SHA512
296f040d21a95b349132d829d71128071a79f815f3a8a1209b72a5c72b95effa50538ddb9c4e936a3afa63a3e02562552dd660a7b5bdd6bcf0ade005133ed0b2

Download Submit
memory/1284-687-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/1284-607-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/1444-515-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/1444-435-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/1536-344-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/1616-257-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/2492-429-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/2780-859-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/2780-779-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/3128-865-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/3876-9-0x00000000008E0000-0x00000000008E1000-memory.dmp

Filesize
4KB

Download
memory/4052-521-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/4052-601-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/4248-693-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/4248-773-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/4836-91-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/4836-171-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/4848-4-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/4848-1-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/4848-2-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/4848-3-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/4848-86-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/4848-5-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/4884-0-0x00000000006F0000-0x00000000006F6000-memory.dmp

Filesize
24KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads