Overview

overview

10

Static

static

3

JaffaCakes...16.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250314-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/04/2025, 16:51

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    JaffaCakes118_aafee799316c875555aa6e4b93910716.exe

  • Size

    783KB

  • MD5

    aafee799316c875555aa6e4b93910716

  • SHA1

    c3c36f7c1b27ff26d604a7c4e1e120963a47848e

  • SHA256

    938bd9bc72679a0fa7c58952f47648187c7ff0b3fad92dae6826f3f82c42da1c

  • SHA512

    61944991b47b02d2fa57360aeb38b76f8fa06554c01d4b849aa4bc77e71c590c59783b3cf9c1e8f594bb4512b0f123f4323c1a3af009d108ebc144857ff2a579

  • SSDEEP

    12288:ANGPl7a/Pvi+9kHT2EZfHtGbCPlmQa4hTDD4zrj7vE169j0jmUTWuoA6:9PlOPviFT1wbMlvuf3n9jGrT9oB

Score
10/10
darkcometlatentbotofficedefense_evasiondiscoverypersistencerattrojan

Malware Config

Extracted

Family

darkcomet

Botnet

office

C2

boottheworld.zapto.org:8565

Mutex

DC_MUTEX-2JAEW7Q

Attributes
  • InstallPath

    svchost\svchost.exe

  • gencode

    p5oiCq-DXtYQ

  • install

    true

  • offline_keylogger

    false

  • password

    d257389q

  • persistence

    true

  • reg_key

    svchost

rc4.plain

Extracted

Family

latentbot

C2

boottheworld.zapto.org

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet
  • Darkcomet family
    darkcomet
  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot
  • Latentbot family
    latentbot
  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Modifies firewall policy service 3 TTPs 64 IoCs
    defense_evasion
  • Windows security bypass 2 TTPs 32 IoCs
    defense_evasiontrojan
  • Checks BIOS information in registry 2 TTPs 33 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 32 IoCs
  • Windows security modification 2 TTPs 16 IoCs
    defense_evasiontrojan
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Suspicious use of SetThreadContext 49 IoCs
  • Drops file in Windows directory 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 64 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 33 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 33 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_aafee799316c875555aa6e4b93910716.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_aafee799316c875555aa6e4b93910716.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4428
    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_aafee799316c875555aa6e4b93910716.exe
      C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_aafee799316c875555aa6e4b93910716.exe
      2⤵
      • Modifies WinLogon for persistence
      • Checks BIOS information in registry
      • Adds Run key to start application
      • Suspicious use of SetThreadContext
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4872
      • C:\Windows\SysWOW64\notepad.exe
        notepad
        3⤵
        • Adds Run key to start application
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        PID:3884
      • C:\Windows\SysWOW64\explorer.exe
        "C:\Windows\SysWOW64\explorer.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:3800
        • C:\Windows\SysWOW64\explorer.exe
          C:\Windows\SysWOW64\explorer.exe
          4⤵
          • Modifies firewall policy service
          • Windows security bypass
          • Checks BIOS information in registry
          • System Location Discovery: System Language Discovery
          • Checks processor information in registry
          • Enumerates system info in registry
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          PID:5316
          • C:\Windows\SysWOW64\notepad.exe
            C:\Windows\SysWOW64\notepad.exe
            5⤵
            • System Location Discovery: System Language Discovery
            PID:4728
      • C:\Windows\SysWOW64\notepad.exe
        C:\Windows\SysWOW64\notepad.exe
        3⤵
        • Deletes itself
        • System Location Discovery: System Language Discovery
        PID:4200
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\svchost\svchost.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5600
    • C:\Windows\svchost\svchost.exe
      C:\Windows\svchost\svchost.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:1916
      • C:\Windows\svchost\svchost.exe
        C:\Windows\svchost\svchost.exe
        3⤵
        • Modifies firewall policy service
        • Windows security bypass
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Windows security modification
        • Suspicious use of SetThreadContext
        • Checks processor information in registry
        • Enumerates system info in registry
        • Suspicious use of AdjustPrivilegeToken
        PID:4592
        • C:\Windows\SysWOW64\explorer.exe
          "C:\Windows\SysWOW64\explorer.exe"
          4⤵
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:4780
          • C:\Windows\SysWOW64\explorer.exe
            C:\Windows\SysWOW64\explorer.exe
            5⤵
            • Modifies firewall policy service
            • Windows security bypass
            • Checks BIOS information in registry
            • System Location Discovery: System Language Discovery
            • Checks processor information in registry
            • Enumerates system info in registry
            PID:1168
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\svchost\svchost.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2272
    • C:\Windows\svchost\svchost.exe
      C:\Windows\svchost\svchost.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:5072
      • C:\Windows\svchost\svchost.exe
        C:\Windows\svchost\svchost.exe
        3⤵
        • Modifies firewall policy service
        • Windows security bypass
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Windows security modification
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Checks processor information in registry
        • Enumerates system info in registry
        PID:1596
        • C:\Windows\SysWOW64\explorer.exe
          "C:\Windows\SysWOW64\explorer.exe"
          4⤵
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:4848
          • C:\Windows\SysWOW64\explorer.exe
            C:\Windows\SysWOW64\explorer.exe
            5⤵
            • Modifies firewall policy service
            • Windows security bypass
            • Checks BIOS information in registry
            • System Location Discovery: System Language Discovery
            • Checks processor information in registry
            • Enumerates system info in registry
            PID:652
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\svchost\svchost.exe
    1⤵
      PID:1076
      • C:\Windows\svchost\svchost.exe
        C:\Windows\svchost\svchost.exe
        2⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1612
        • C:\Windows\svchost\svchost.exe
          C:\Windows\svchost\svchost.exe
          3⤵
          • Modifies firewall policy service
          • Windows security bypass
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Windows security modification
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Checks processor information in registry
          • Enumerates system info in registry
          PID:4832
          • C:\Windows\SysWOW64\explorer.exe
            "C:\Windows\SysWOW64\explorer.exe"
            4⤵
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:5716
            • C:\Windows\SysWOW64\explorer.exe
              C:\Windows\SysWOW64\explorer.exe
              5⤵
              • Modifies firewall policy service
              • Windows security bypass
              • Checks BIOS information in registry
              • System Location Discovery: System Language Discovery
              • Enumerates system info in registry
              PID:5124
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\svchost\svchost.exe
      1⤵
        PID:5064
        • C:\Windows\svchost\svchost.exe
          C:\Windows\svchost\svchost.exe
          2⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:4568
          • C:\Windows\svchost\svchost.exe
            C:\Windows\svchost\svchost.exe
            3⤵
            • Modifies firewall policy service
            • Windows security bypass
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Windows security modification
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Checks processor information in registry
            • Enumerates system info in registry
            PID:1448
            • C:\Windows\SysWOW64\explorer.exe
              "C:\Windows\SysWOW64\explorer.exe"
              4⤵
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:5068
              • C:\Windows\SysWOW64\explorer.exe
                C:\Windows\SysWOW64\explorer.exe
                5⤵
                • Windows security bypass
                • Checks BIOS information in registry
                • System Location Discovery: System Language Discovery
                • Checks processor information in registry
                • Enumerates system info in registry
                PID:3264
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Windows\svchost\svchost.exe
        1⤵
          PID:1524
          • C:\Windows\svchost\svchost.exe
            C:\Windows\svchost\svchost.exe
            2⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:1712
            • C:\Windows\svchost\svchost.exe
              C:\Windows\svchost\svchost.exe
              3⤵
              • Modifies firewall policy service
              • Windows security bypass
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Windows security modification
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Checks processor information in registry
              • Enumerates system info in registry
              PID:3492
              • C:\Windows\SysWOW64\explorer.exe
                "C:\Windows\SysWOW64\explorer.exe"
                4⤵
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:3252
                • C:\Windows\SysWOW64\explorer.exe
                  C:\Windows\SysWOW64\explorer.exe
                  5⤵
                  • Modifies firewall policy service
                  • Windows security bypass
                  • Checks BIOS information in registry
                  • System Location Discovery: System Language Discovery
                  • Checks processor information in registry
                  • Enumerates system info in registry
                  PID:3196
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Windows\svchost\svchost.exe
          1⤵
            PID:2360
            • C:\Windows\svchost\svchost.exe
              C:\Windows\svchost\svchost.exe
              2⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:4556
              • C:\Windows\svchost\svchost.exe
                C:\Windows\svchost\svchost.exe
                3⤵
                • Modifies firewall policy service
                • Windows security bypass
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Windows security modification
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                • Checks processor information in registry
                • Enumerates system info in registry
                PID:5980
                • C:\Windows\SysWOW64\explorer.exe
                  "C:\Windows\SysWOW64\explorer.exe"
                  4⤵
                  • Suspicious use of SetThreadContext
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:1596
                  • C:\Windows\SysWOW64\explorer.exe
                    C:\Windows\SysWOW64\explorer.exe
                    5⤵
                    • Modifies firewall policy service
                    • Windows security bypass
                    • Checks BIOS information in registry
                    • System Location Discovery: System Language Discovery
                    • Checks processor information in registry
                    • Enumerates system info in registry
                    PID:4708
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c C:\Windows\svchost\svchost.exe
            1⤵
              PID:4168
              • C:\Windows\svchost\svchost.exe
                C:\Windows\svchost\svchost.exe
                2⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:5704
                • C:\Windows\svchost\svchost.exe
                  C:\Windows\svchost\svchost.exe
                  3⤵
                  • Modifies firewall policy service
                  • Windows security bypass
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • Windows security modification
                  • Suspicious use of SetThreadContext
                  • System Location Discovery: System Language Discovery
                  • Checks processor information in registry
                  • Enumerates system info in registry
                  PID:2768
                  • C:\Windows\SysWOW64\explorer.exe
                    "C:\Windows\SysWOW64\explorer.exe"
                    4⤵
                    • Suspicious use of SetThreadContext
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    PID:4764
                    • C:\Windows\SysWOW64\explorer.exe
                      C:\Windows\SysWOW64\explorer.exe
                      5⤵
                      • Modifies firewall policy service
                      • Windows security bypass
                      • Checks BIOS information in registry
                      • System Location Discovery: System Language Discovery
                      • Checks processor information in registry
                      • Enumerates system info in registry
                      PID:4876
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Windows\svchost\svchost.exe
              1⤵
                PID:2288
                • C:\Windows\svchost\svchost.exe
                  C:\Windows\svchost\svchost.exe
                  2⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:4044
                  • C:\Windows\svchost\svchost.exe
                    C:\Windows\svchost\svchost.exe
                    3⤵
                    • Modifies firewall policy service
                    • Windows security bypass
                    • Checks BIOS information in registry
                    • Executes dropped EXE
                    • Windows security modification
                    • Checks processor information in registry
                    • Enumerates system info in registry
                    PID:5284
                    • C:\Windows\SysWOW64\explorer.exe
                      "C:\Windows\SysWOW64\explorer.exe"
                      4⤵
                        PID:5032
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Windows\svchost\svchost.exe
                  1⤵
                    PID:3752
                    • C:\Windows\svchost\svchost.exe
                      C:\Windows\svchost\svchost.exe
                      2⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of SetWindowsHookEx
                      PID:6008
                      • C:\Windows\svchost\svchost.exe
                        C:\Windows\svchost\svchost.exe
                        3⤵
                        • Modifies firewall policy service
                        • Windows security bypass
                        • Checks BIOS information in registry
                        • Executes dropped EXE
                        • Windows security modification
                        • Suspicious use of SetThreadContext
                        • System Location Discovery: System Language Discovery
                        • Checks processor information in registry
                        • Enumerates system info in registry
                        PID:2860
                        • C:\Windows\SysWOW64\explorer.exe
                          "C:\Windows\SysWOW64\explorer.exe"
                          4⤵
                          • Suspicious use of SetThreadContext
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of SetWindowsHookEx
                          PID:1296
                          • C:\Windows\SysWOW64\explorer.exe
                            C:\Windows\SysWOW64\explorer.exe
                            5⤵
                            • Modifies firewall policy service
                            • Windows security bypass
                            • Checks BIOS information in registry
                            • System Location Discovery: System Language Discovery
                            • Checks processor information in registry
                            • Enumerates system info in registry
                            PID:868
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c C:\Windows\svchost\svchost.exe
                    1⤵
                      PID:2320
                      • C:\Windows\svchost\svchost.exe
                        C:\Windows\svchost\svchost.exe
                        2⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        • Suspicious use of SetWindowsHookEx
                        PID:628
                        • C:\Windows\svchost\svchost.exe
                          C:\Windows\svchost\svchost.exe
                          3⤵
                          • Modifies firewall policy service
                          • Windows security bypass
                          • Checks BIOS information in registry
                          • Executes dropped EXE
                          • Windows security modification
                          • Suspicious use of SetThreadContext
                          • System Location Discovery: System Language Discovery
                          • Checks processor information in registry
                          • Enumerates system info in registry
                          PID:1708
                          • C:\Windows\SysWOW64\explorer.exe
                            "C:\Windows\SysWOW64\explorer.exe"
                            4⤵
                            • Suspicious use of SetThreadContext
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of SetWindowsHookEx
                            PID:2176
                            • C:\Windows\SysWOW64\explorer.exe
                              C:\Windows\SysWOW64\explorer.exe
                              5⤵
                              • Modifies firewall policy service
                              • Windows security bypass
                              • Checks BIOS information in registry
                              • System Location Discovery: System Language Discovery
                              • Checks processor information in registry
                              • Enumerates system info in registry
                              PID:4032
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Windows\svchost\svchost.exe
                      1⤵
                        PID:2008
                        • C:\Windows\svchost\svchost.exe
                          C:\Windows\svchost\svchost.exe
                          2⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of SetWindowsHookEx
                          PID:3732
                          • C:\Windows\svchost\svchost.exe
                            C:\Windows\svchost\svchost.exe
                            3⤵
                            • Modifies firewall policy service
                            • Windows security bypass
                            • Checks BIOS information in registry
                            • Executes dropped EXE
                            • Windows security modification
                            • Suspicious use of SetThreadContext
                            • System Location Discovery: System Language Discovery
                            • Checks processor information in registry
                            • Enumerates system info in registry
                            PID:4968
                            • C:\Windows\SysWOW64\explorer.exe
                              "C:\Windows\SysWOW64\explorer.exe"
                              4⤵
                              • Suspicious use of SetThreadContext
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of SetWindowsHookEx
                              PID:3264
                              • C:\Windows\SysWOW64\explorer.exe
                                C:\Windows\SysWOW64\explorer.exe
                                5⤵
                                • Modifies firewall policy service
                                • Windows security bypass
                                • Checks BIOS information in registry
                                • System Location Discovery: System Language Discovery
                                • Checks processor information in registry
                                • Enumerates system info in registry
                                PID:2324
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c C:\Windows\svchost\svchost.exe
                        1⤵
                          PID:1632
                          • C:\Windows\svchost\svchost.exe
                            C:\Windows\svchost\svchost.exe
                            2⤵
                            • Executes dropped EXE
                            • Suspicious use of SetThreadContext
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of SetWindowsHookEx
                            PID:3052
                            • C:\Windows\svchost\svchost.exe
                              C:\Windows\svchost\svchost.exe
                              3⤵
                              • Modifies firewall policy service
                              • Windows security bypass
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Windows security modification
                              • Suspicious use of SetThreadContext
                              • System Location Discovery: System Language Discovery
                              • Checks processor information in registry
                              • Enumerates system info in registry
                              PID:2900
                              • C:\Windows\SysWOW64\explorer.exe
                                "C:\Windows\SysWOW64\explorer.exe"
                                4⤵
                                • Suspicious use of SetThreadContext
                                • Suspicious use of SetWindowsHookEx
                                PID:3252
                                • C:\Windows\SysWOW64\explorer.exe
                                  C:\Windows\SysWOW64\explorer.exe
                                  5⤵
                                  • Modifies firewall policy service
                                  • Windows security bypass
                                  • Checks BIOS information in registry
                                  • Checks processor information in registry
                                  • Enumerates system info in registry
                                  PID:5788
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Windows\svchost\svchost.exe
                          1⤵
                            PID:5200
                            • C:\Windows\svchost\svchost.exe
                              C:\Windows\svchost\svchost.exe
                              2⤵
                              • Executes dropped EXE
                              • Suspicious use of SetThreadContext
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of SetWindowsHookEx
                              PID:1804
                              • C:\Windows\svchost\svchost.exe
                                C:\Windows\svchost\svchost.exe
                                3⤵
                                • Modifies firewall policy service
                                • Windows security bypass
                                • Checks BIOS information in registry
                                • Executes dropped EXE
                                • Windows security modification
                                • Suspicious use of SetThreadContext
                                • System Location Discovery: System Language Discovery
                                • Checks processor information in registry
                                • Enumerates system info in registry
                                PID:4196
                                • C:\Windows\SysWOW64\explorer.exe
                                  "C:\Windows\SysWOW64\explorer.exe"
                                  4⤵
                                  • Suspicious use of SetThreadContext
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of SetWindowsHookEx
                                  PID:808
                                  • C:\Windows\SysWOW64\explorer.exe
                                    C:\Windows\SysWOW64\explorer.exe
                                    5⤵
                                    • Windows security bypass
                                    • Checks BIOS information in registry
                                    • System Location Discovery: System Language Discovery
                                    • Checks processor information in registry
                                    • Enumerates system info in registry
                                    PID:5500
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /c C:\Windows\svchost\svchost.exe
                            1⤵
                              PID:752
                              • C:\Windows\svchost\svchost.exe
                                C:\Windows\svchost\svchost.exe
                                2⤵
                                • Executes dropped EXE
                                • Suspicious use of SetThreadContext
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of SetWindowsHookEx
                                PID:1932
                                • C:\Windows\svchost\svchost.exe
                                  C:\Windows\svchost\svchost.exe
                                  3⤵
                                  • Modifies firewall policy service
                                  • Windows security bypass
                                  • Checks BIOS information in registry
                                  • Executes dropped EXE
                                  • Windows security modification
                                  • Suspicious use of SetThreadContext
                                  • System Location Discovery: System Language Discovery
                                  • Checks processor information in registry
                                  • Enumerates system info in registry
                                  PID:5072
                                  • C:\Windows\SysWOW64\explorer.exe
                                    "C:\Windows\SysWOW64\explorer.exe"
                                    4⤵
                                    • Suspicious use of SetThreadContext
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious use of SetWindowsHookEx
                                    PID:4480
                                    • C:\Windows\SysWOW64\explorer.exe
                                      C:\Windows\SysWOW64\explorer.exe
                                      5⤵
                                      • Modifies firewall policy service
                                      • Windows security bypass
                                      • Checks BIOS information in registry
                                      • System Location Discovery: System Language Discovery
                                      • Checks processor information in registry
                                      • Enumerates system info in registry
                                      PID:4776
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Windows\svchost\svchost.exe
                              1⤵
                                PID:4796
                                • C:\Windows\svchost\svchost.exe
                                  C:\Windows\svchost\svchost.exe
                                  2⤵
                                  • Executes dropped EXE
                                  • Suspicious use of SetThreadContext
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of SetWindowsHookEx
                                  PID:4596
                                  • C:\Windows\svchost\svchost.exe
                                    C:\Windows\svchost\svchost.exe
                                    3⤵
                                    • Modifies firewall policy service
                                    • Windows security bypass
                                    • Checks BIOS information in registry
                                    • Executes dropped EXE
                                    • Windows security modification
                                    • Suspicious use of SetThreadContext
                                    • System Location Discovery: System Language Discovery
                                    • Checks processor information in registry
                                    • Enumerates system info in registry
                                    PID:1936
                                    • C:\Windows\SysWOW64\explorer.exe
                                      "C:\Windows\SysWOW64\explorer.exe"
                                      4⤵
                                      • Suspicious use of SetThreadContext
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of SetWindowsHookEx
                                      PID:5204
                                      • C:\Windows\SysWOW64\explorer.exe
                                        C:\Windows\SysWOW64\explorer.exe
                                        5⤵
                                        • Modifies firewall policy service
                                        • Windows security bypass
                                        • Checks BIOS information in registry
                                        • System Location Discovery: System Language Discovery
                                        • Checks processor information in registry
                                        • Enumerates system info in registry
                                        PID:1464
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /c C:\Windows\svchost\svchost.exe
                                1⤵
                                  PID:5436
                                  • C:\Windows\svchost\svchost.exe
                                    C:\Windows\svchost\svchost.exe
                                    2⤵
                                    • Executes dropped EXE
                                    • Suspicious use of SetThreadContext
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious use of SetWindowsHookEx
                                    PID:548
                                    • C:\Windows\svchost\svchost.exe
                                      C:\Windows\svchost\svchost.exe
                                      3⤵
                                      • Modifies firewall policy service
                                      • Windows security bypass
                                      • Checks BIOS information in registry
                                      • Executes dropped EXE
                                      • Windows security modification
                                      • Suspicious use of SetThreadContext
                                      • System Location Discovery: System Language Discovery
                                      • Checks processor information in registry
                                      • Enumerates system info in registry
                                      PID:4888
                                      • C:\Windows\SysWOW64\explorer.exe
                                        "C:\Windows\SysWOW64\explorer.exe"
                                        4⤵
                                        • Suspicious use of SetThreadContext
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious use of SetWindowsHookEx
                                        PID:4860
                                        • C:\Windows\SysWOW64\explorer.exe
                                          C:\Windows\SysWOW64\explorer.exe
                                          5⤵
                                          • Modifies firewall policy service
                                          • Windows security bypass
                                          • Checks BIOS information in registry
                                          • System Location Discovery: System Language Discovery
                                          • Checks processor information in registry
                                          • Enumerates system info in registry
                                          PID:4060

                                Network

                                MITRE ATT&CK Enterprise v16

                                Reconnaissance

                                Resource Development

                                Initial Access

                                Execution

                                Persistence

                                Boot or Logon Autostart Execution

                                2
                                T1547

                                Registry Run Keys / Startup Folder

                                1
                                T1547.001

                                Winlogon Helper DLL

                                1
                                T1547.004

                                Create or Modify System Process

                                1
                                T1543

                                Windows Service

                                1
                                T1543.003

                                Privilege Escalation

                                Boot or Logon Autostart Execution

                                2
                                T1547

                                Registry Run Keys / Startup Folder

                                1
                                T1547.001

                                Winlogon Helper DLL

                                1
                                T1547.004

                                Create or Modify System Process

                                1
                                T1543

                                Windows Service

                                1
                                T1543.003

                                Defense Evasion

                                Impair Defenses

                                3
                                T1562

                                Disable or Modify System Firewall

                                1
                                T1562.004

                                Disable or Modify Tools

                                2
                                T1562.001

                                Modify Registry

                                5
                                T1112

                                Credential Access

                                Discovery

                                Query Registry

                                3
                                T1012

                                System Information Discovery

                                3
                                T1082

                                System Location Discovery

                                1
                                T1614

                                System Language Discovery

                                1
                                T1614.001

                                Lateral Movement

                                Collection

                                Command and Control

                                Exfiltration

                                Impact

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                • C:\Windows\svchost\svchost.exe
                                  Filesize

                                  783KB

                                  MD5

                                  aafee799316c875555aa6e4b93910716

                                  SHA1

                                  c3c36f7c1b27ff26d604a7c4e1e120963a47848e

                                  SHA256

                                  938bd9bc72679a0fa7c58952f47648187c7ff0b3fad92dae6826f3f82c42da1c

                                  SHA512

                                  61944991b47b02d2fa57360aeb38b76f8fa06554c01d4b849aa4bc77e71c590c59783b3cf9c1e8f594bb4512b0f123f4323c1a3af009d108ebc144857ff2a579

                                  Download Submit

                                • memory/652-56-0x0000000013140000-0x00000000131F6000-memory.dmp

                                  Filesize

                                  728KB

                                  Download

                                • memory/652-58-0x0000000013140000-0x00000000131F6000-memory.dmp

                                  Filesize

                                  728KB

                                  Download

                                • memory/1168-55-0x0000000013140000-0x00000000131F6000-memory.dmp

                                  Filesize

                                  728KB

                                  Download

                                • memory/1168-57-0x0000000013140000-0x00000000131F6000-memory.dmp

                                  Filesize

                                  728KB

                                  Download

                                • memory/1448-81-0x0000000013140000-0x00000000131F6000-memory.dmp

                                  Filesize

                                  728KB

                                  Download

                                • memory/1448-84-0x0000000013140000-0x00000000131F6000-memory.dmp

                                  Filesize

                                  728KB

                                  Download

                                • memory/1596-45-0x0000000013140000-0x00000000131F6000-memory.dmp

                                  Filesize

                                  728KB

                                  Download

                                • memory/1596-41-0x0000000013140000-0x00000000131F6000-memory.dmp

                                  Filesize

                                  728KB

                                  Download

                                • memory/1596-48-0x0000000013140000-0x00000000131F6000-memory.dmp

                                  Filesize

                                  728KB

                                  Download

                                • memory/3196-105-0x0000000013140000-0x00000000131F6000-memory.dmp

                                  Filesize

                                  728KB

                                  Download

                                • memory/3264-90-0x0000000013140000-0x00000000131F6000-memory.dmp

                                  Filesize

                                  728KB

                                  Download

                                • memory/3264-89-0x0000000013140000-0x00000000131F6000-memory.dmp

                                  Filesize

                                  728KB

                                  Download

                                • memory/3492-97-0x0000000013140000-0x00000000131F6000-memory.dmp

                                  Filesize

                                  728KB

                                  Download

                                • memory/3492-99-0x0000000013140000-0x00000000131F6000-memory.dmp

                                  Filesize

                                  728KB

                                  Download

                                • memory/3800-28-0x0000000000400000-0x00000000004C8000-memory.dmp

                                  Filesize

                                  800KB

                                  Download

                                • memory/3800-11-0x0000000000400000-0x00000000004C8000-memory.dmp

                                  Filesize

                                  800KB

                                  Download

                                • memory/3800-12-0x0000000000400000-0x00000000004C8000-memory.dmp

                                  Filesize

                                  800KB

                                  Download

                                • memory/3884-8-0x0000000000B50000-0x0000000000B51000-memory.dmp

                                  Filesize

                                  4KB

                                  Download

                                • memory/4200-15-0x0000000000770000-0x0000000000771000-memory.dmp

                                  Filesize

                                  4KB

                                  Download

                                • memory/4592-36-0x0000000013140000-0x00000000131F6000-memory.dmp

                                  Filesize

                                  728KB

                                  Download

                                • memory/4592-31-0x0000000013140000-0x00000000131F6000-memory.dmp

                                  Filesize

                                  728KB

                                  Download

                                • memory/4592-38-0x0000000013140000-0x00000000131F6000-memory.dmp

                                  Filesize

                                  728KB

                                  Download

                                • memory/4728-33-0x0000000000500000-0x0000000000501000-memory.dmp

                                  Filesize

                                  4KB

                                  Download

                                • memory/4832-65-0x0000000013140000-0x00000000131F6000-memory.dmp

                                  Filesize

                                  728KB

                                  Download

                                • memory/4832-64-0x0000000013140000-0x00000000131F6000-memory.dmp

                                  Filesize

                                  728KB

                                  Download

                                • memory/4832-67-0x0000000013140000-0x00000000131F6000-memory.dmp

                                  Filesize

                                  728KB

                                  Download

                                • memory/4872-2-0x0000000013140000-0x00000000131F6000-memory.dmp

                                  Filesize

                                  728KB

                                  Download

                                • memory/4872-3-0x0000000013140000-0x00000000131F6000-memory.dmp

                                  Filesize

                                  728KB

                                  Download

                                • memory/4872-4-0x0000000013140000-0x00000000131F6000-memory.dmp

                                  Filesize

                                  728KB

                                  Download

                                • memory/4872-5-0x0000000013140000-0x00000000131F6000-memory.dmp

                                  Filesize

                                  728KB

                                  Download

                                • memory/4872-6-0x0000000000730000-0x0000000000731000-memory.dmp

                                  Filesize

                                  4KB

                                  Download

                                • memory/4872-16-0x0000000013140000-0x00000000131F6000-memory.dmp

                                  Filesize

                                  728KB

                                  Download

                                • memory/5124-74-0x0000000013140000-0x00000000131F6000-memory.dmp

                                  Filesize

                                  728KB

                                  Download

                                • memory/5124-73-0x0000000013140000-0x00000000131F6000-memory.dmp

                                  Filesize

                                  728KB

                                  Download

                                • memory/5316-27-0x0000000013140000-0x00000000131F6000-memory.dmp

                                  Filesize

                                  728KB

                                  Download

                                • memory/5316-35-0x0000000013140000-0x00000000131F6000-memory.dmp

                                  Filesize

                                  728KB

                                  Download

                                • memory/5316-32-0x0000000013140000-0x00000000131F6000-memory.dmp

                                  Filesize

                                  728KB

                                  Download

                                • memory/5316-34-0x0000000013140000-0x00000000131F6000-memory.dmp

                                  Filesize

                                  728KB

                                  Download