darkcomet | dd8650f0e484ba0ea4775ccce3a9644bba747ee92f1b534628525c7ceedc69f9

Resubmissions

14/04/2025, 04:20

250414-ex92msynx2 10

14/04/2025, 03:24

14/04/2025, 02:53

13/04/2025, 19:39

13/04/2025, 01:50

13/04/2025, 01:45

12/04/2025, 16:37

Analysis

max time kernel
148s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20250410-en
resource tags

arch:x64arch:x86image:win11-20250410-enlocale:en-usos:windows11-21h2-x64system
submitted
11/04/2025, 22:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3178fcad2d2c2f3c0f4f70aecfb18db7_JaffaCakes118.exe
Size

658KB
MD5

3178fcad2d2c2f3c0f4f70aecfb18db7
SHA1

0ecad6522214f9bef4dd8f2f8eb927827bc4971c
SHA256

dd8650f0e484ba0ea4775ccce3a9644bba747ee92f1b534628525c7ceedc69f9
SHA512

57148c860850344b1086c8765c083862d57d99119914e218aca4c8e80dc9cbe48d206b6aefaea9ad5cda58a459ff5888f1bc82f6fabacd2aa81f52818cef4985
SSDEEP

12288:+9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hV:KZ1xuVVjfFoynPaVBUR8f+kN10EBP

Score

10^/10

darkcomet guest16 defense_evasion discovery persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

127.0.0.1:1604

Mutex

DC_MUTEX-7X99PTF

Attributes

InstallPath
MSDCSC\msdcsc.exe
gencode
DNgeskLTppzX
install
true
offline_keylogger
true
persistence
true
reg_key
System32.dll

rc4.plain

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Darkcomet family
darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Temp\\MSDCSC\\msdcsc.exe"	3178fcad2d2c2f3c0f4f70aecfb18db7_JaffaCakes118.exe

Sets file to hidden 1 TTPs 2 IoCs

Modifies file attributes to stop it showing in Explorer etc.

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5216	attrib.exe
1576	attrib.exe

Executes dropped EXE 17 IoCs

pid	Process
6108	msdcsc.exe
5836	msdcsc.exe
4804	msdcsc.exe
4956	msdcsc.exe
1052	msdcsc.exe
2172	msdcsc.exe
3884	msdcsc.exe
4420	msdcsc.exe
4264	msdcsc.exe
3032	msdcsc.exe
1760	msdcsc.exe
3888	msdcsc.exe
2228	msdcsc.exe
1836	msdcsc.exe
5964	msdcsc.exe
5936	msdcsc.exe
952	msdcsc.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3437575798-4173230203-4015467660-1000\Software\Microsoft\Windows\CurrentVersion\Run\System32.dll = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MSDCSC\\msdcsc.exe"	3178fcad2d2c2f3c0f4f70aecfb18db7_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3437575798-4173230203-4015467660-1000\Software\Microsoft\Windows\CurrentVersion\Run\System32.dll = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MSDCSC\\msdcsc.exe"	msdcsc.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	UserOOBEBroker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 23 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdcsc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdcsc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdcsc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdcsc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdcsc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdcsc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdcsc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdcsc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdcsc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdcsc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdcsc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdcsc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdcsc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3178fcad2d2c2f3c0f4f70aecfb18db7_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdcsc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdcsc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdcsc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdcsc.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	3178fcad2d2c2f3c0f4f70aecfb18db7_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-3437575798-4173230203-4015467660-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3437575798-4173230203-4015467660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	BackgroundTransferHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3437575798-4173230203-4015467660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	BackgroundTransferHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3437575798-4173230203-4015467660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	BackgroundTransferHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3437575798-4173230203-4015467660-1000_Classes\Local Settings\MuiCache	BackgroundTransferHost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
6108	msdcsc.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	3436	3178fcad2d2c2f3c0f4f70aecfb18db7_JaffaCakes118.exe
Token: SeSecurityPrivilege	3436	3178fcad2d2c2f3c0f4f70aecfb18db7_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	3436	3178fcad2d2c2f3c0f4f70aecfb18db7_JaffaCakes118.exe
Token: SeLoadDriverPrivilege	3436	3178fcad2d2c2f3c0f4f70aecfb18db7_JaffaCakes118.exe
Token: SeSystemProfilePrivilege	3436	3178fcad2d2c2f3c0f4f70aecfb18db7_JaffaCakes118.exe
Token: SeSystemtimePrivilege	3436	3178fcad2d2c2f3c0f4f70aecfb18db7_JaffaCakes118.exe
Token: SeProfSingleProcessPrivilege	3436	3178fcad2d2c2f3c0f4f70aecfb18db7_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	3436	3178fcad2d2c2f3c0f4f70aecfb18db7_JaffaCakes118.exe
Token: SeCreatePagefilePrivilege	3436	3178fcad2d2c2f3c0f4f70aecfb18db7_JaffaCakes118.exe
Token: SeBackupPrivilege	3436	3178fcad2d2c2f3c0f4f70aecfb18db7_JaffaCakes118.exe
Token: SeRestorePrivilege	3436	3178fcad2d2c2f3c0f4f70aecfb18db7_JaffaCakes118.exe
Token: SeShutdownPrivilege	3436	3178fcad2d2c2f3c0f4f70aecfb18db7_JaffaCakes118.exe
Token: SeDebugPrivilege	3436	3178fcad2d2c2f3c0f4f70aecfb18db7_JaffaCakes118.exe
Token: SeSystemEnvironmentPrivilege	3436	3178fcad2d2c2f3c0f4f70aecfb18db7_JaffaCakes118.exe
Token: SeChangeNotifyPrivilege	3436	3178fcad2d2c2f3c0f4f70aecfb18db7_JaffaCakes118.exe
Token: SeRemoteShutdownPrivilege	3436	3178fcad2d2c2f3c0f4f70aecfb18db7_JaffaCakes118.exe
Token: SeUndockPrivilege	3436	3178fcad2d2c2f3c0f4f70aecfb18db7_JaffaCakes118.exe
Token: SeManageVolumePrivilege	3436	3178fcad2d2c2f3c0f4f70aecfb18db7_JaffaCakes118.exe
Token: SeImpersonatePrivilege	3436	3178fcad2d2c2f3c0f4f70aecfb18db7_JaffaCakes118.exe
Token: SeCreateGlobalPrivilege	3436	3178fcad2d2c2f3c0f4f70aecfb18db7_JaffaCakes118.exe
Token: 33	3436	3178fcad2d2c2f3c0f4f70aecfb18db7_JaffaCakes118.exe
Token: 34	3436	3178fcad2d2c2f3c0f4f70aecfb18db7_JaffaCakes118.exe
Token: 35	3436	3178fcad2d2c2f3c0f4f70aecfb18db7_JaffaCakes118.exe
Token: 36	3436	3178fcad2d2c2f3c0f4f70aecfb18db7_JaffaCakes118.exe
Token: SeIncreaseQuotaPrivilege	6108	msdcsc.exe
Token: SeSecurityPrivilege	6108	msdcsc.exe
Token: SeTakeOwnershipPrivilege	6108	msdcsc.exe
Token: SeLoadDriverPrivilege	6108	msdcsc.exe
Token: SeSystemProfilePrivilege	6108	msdcsc.exe
Token: SeSystemtimePrivilege	6108	msdcsc.exe
Token: SeProfSingleProcessPrivilege	6108	msdcsc.exe
Token: SeIncBasePriorityPrivilege	6108	msdcsc.exe
Token: SeCreatePagefilePrivilege	6108	msdcsc.exe
Token: SeBackupPrivilege	6108	msdcsc.exe
Token: SeRestorePrivilege	6108	msdcsc.exe
Token: SeShutdownPrivilege	6108	msdcsc.exe
Token: SeDebugPrivilege	6108	msdcsc.exe
Token: SeSystemEnvironmentPrivilege	6108	msdcsc.exe
Token: SeChangeNotifyPrivilege	6108	msdcsc.exe
Token: SeRemoteShutdownPrivilege	6108	msdcsc.exe
Token: SeUndockPrivilege	6108	msdcsc.exe
Token: SeManageVolumePrivilege	6108	msdcsc.exe
Token: SeImpersonatePrivilege	6108	msdcsc.exe
Token: SeCreateGlobalPrivilege	6108	msdcsc.exe
Token: 33	6108	msdcsc.exe
Token: 34	6108	msdcsc.exe
Token: 35	6108	msdcsc.exe
Token: 36	6108	msdcsc.exe
Token: SeIncreaseQuotaPrivilege	5836	msdcsc.exe
Token: SeSecurityPrivilege	5836	msdcsc.exe
Token: SeTakeOwnershipPrivilege	5836	msdcsc.exe
Token: SeLoadDriverPrivilege	5836	msdcsc.exe
Token: SeSystemProfilePrivilege	5836	msdcsc.exe
Token: SeSystemtimePrivilege	5836	msdcsc.exe
Token: SeProfSingleProcessPrivilege	5836	msdcsc.exe
Token: SeIncBasePriorityPrivilege	5836	msdcsc.exe
Token: SeCreatePagefilePrivilege	5836	msdcsc.exe
Token: SeBackupPrivilege	5836	msdcsc.exe
Token: SeRestorePrivilege	5836	msdcsc.exe
Token: SeShutdownPrivilege	5836	msdcsc.exe
Token: SeDebugPrivilege	5836	msdcsc.exe
Token: SeSystemEnvironmentPrivilege	5836	msdcsc.exe
Token: SeChangeNotifyPrivilege	5836	msdcsc.exe
Token: SeRemoteShutdownPrivilege	5836	msdcsc.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
6108	msdcsc.exe
2800	MiniSearchHost.exe
5672	OpenWith.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 244 wrote to memory of 6108	244	cmd.exe	80
PID 244 wrote to memory of 6108	244	cmd.exe	80
PID 244 wrote to memory of 6108	244	cmd.exe	80
PID 3436 wrote to memory of 2804	3436	3178fcad2d2c2f3c0f4f70aecfb18db7_JaffaCakes118.exe	83
PID 3436 wrote to memory of 2804	3436	3178fcad2d2c2f3c0f4f70aecfb18db7_JaffaCakes118.exe	83
PID 3436 wrote to memory of 2804	3436	3178fcad2d2c2f3c0f4f70aecfb18db7_JaffaCakes118.exe	83
PID 3436 wrote to memory of 920	3436	3178fcad2d2c2f3c0f4f70aecfb18db7_JaffaCakes118.exe	84
PID 3436 wrote to memory of 920	3436	3178fcad2d2c2f3c0f4f70aecfb18db7_JaffaCakes118.exe	84
PID 3436 wrote to memory of 920	3436	3178fcad2d2c2f3c0f4f70aecfb18db7_JaffaCakes118.exe	84
PID 2228 wrote to memory of 5836	2228	cmd.exe	87
PID 2228 wrote to memory of 5836	2228	cmd.exe	87
PID 2228 wrote to memory of 5836	2228	cmd.exe	87
PID 920 wrote to memory of 5216	920	cmd.exe	88
PID 920 wrote to memory of 5216	920	cmd.exe	88
PID 920 wrote to memory of 5216	920	cmd.exe	88
PID 2804 wrote to memory of 1576	2804	cmd.exe	89
PID 2804 wrote to memory of 1576	2804	cmd.exe	89
PID 2804 wrote to memory of 1576	2804	cmd.exe	89
PID 3436 wrote to memory of 4804	3436	3178fcad2d2c2f3c0f4f70aecfb18db7_JaffaCakes118.exe	90
PID 3436 wrote to memory of 4804	3436	3178fcad2d2c2f3c0f4f70aecfb18db7_JaffaCakes118.exe	90
PID 3436 wrote to memory of 4804	3436	3178fcad2d2c2f3c0f4f70aecfb18db7_JaffaCakes118.exe	90
PID 4976 wrote to memory of 4956	4976	cmd.exe	93
PID 4976 wrote to memory of 4956	4976	cmd.exe	93
PID 4976 wrote to memory of 4956	4976	cmd.exe	93
PID 4892 wrote to memory of 1052	4892	cmd.exe	96
PID 4892 wrote to memory of 1052	4892	cmd.exe	96
PID 4892 wrote to memory of 1052	4892	cmd.exe	96
PID 5084 wrote to memory of 2172	5084	cmd.exe	99
PID 5084 wrote to memory of 2172	5084	cmd.exe	99
PID 5084 wrote to memory of 2172	5084	cmd.exe	99
PID 5916 wrote to memory of 3884	5916	cmd.exe	102
PID 5916 wrote to memory of 3884	5916	cmd.exe	102
PID 5916 wrote to memory of 3884	5916	cmd.exe	102
PID 4832 wrote to memory of 4420	4832	cmd.exe	105
PID 4832 wrote to memory of 4420	4832	cmd.exe	105
PID 4832 wrote to memory of 4420	4832	cmd.exe	105
PID 3096 wrote to memory of 4264	3096	cmd.exe	108
PID 3096 wrote to memory of 4264	3096	cmd.exe	108
PID 3096 wrote to memory of 4264	3096	cmd.exe	108
PID 4780 wrote to memory of 3032	4780	cmd.exe	111
PID 4780 wrote to memory of 3032	4780	cmd.exe	111
PID 4780 wrote to memory of 3032	4780	cmd.exe	111
PID 2744 wrote to memory of 1760	2744	cmd.exe	115
PID 2744 wrote to memory of 1760	2744	cmd.exe	115
PID 2744 wrote to memory of 1760	2744	cmd.exe	115
PID 3564 wrote to memory of 3888	3564	cmd.exe	129
PID 3564 wrote to memory of 3888	3564	cmd.exe	129
PID 3564 wrote to memory of 3888	3564	cmd.exe	129
PID 5836 wrote to memory of 2228	5836	cmd.exe	133
PID 5836 wrote to memory of 2228	5836	cmd.exe	133
PID 5836 wrote to memory of 2228	5836	cmd.exe	133
PID 3352 wrote to memory of 1836	3352	cmd.exe	137
PID 3352 wrote to memory of 1836	3352	cmd.exe	137
PID 3352 wrote to memory of 1836	3352	cmd.exe	137
PID 5052 wrote to memory of 5964	5052	cmd.exe	140
PID 5052 wrote to memory of 5964	5052	cmd.exe	140
PID 5052 wrote to memory of 5964	5052	cmd.exe	140
PID 956 wrote to memory of 5936	956	cmd.exe	143
PID 956 wrote to memory of 5936	956	cmd.exe	143
PID 956 wrote to memory of 5936	956	cmd.exe	143
PID 2224 wrote to memory of 952	2224	cmd.exe	146
PID 2224 wrote to memory of 952	2224	cmd.exe	146
PID 2224 wrote to memory of 952	2224	cmd.exe	146

Views/modifies file attributes 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5216	attrib.exe
1576	attrib.exe

C:\Users\Admin\AppData\Local\Temp\3178fcad2d2c2f3c0f4f70aecfb18db7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3178fcad2d2c2f3c0f4f70aecfb18db7_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3436
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\3178fcad2d2c2f3c0f4f70aecfb18db7_JaffaCakes118.exe" +s +h
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2804
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Users\Admin\AppData\Local\Temp\3178fcad2d2c2f3c0f4f70aecfb18db7_JaffaCakes118.exe" +s +h
    3⤵
    - Sets file to hidden
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:1576
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:920
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
    3⤵
    - Sets file to hidden
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:5216
- C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe
  "C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4804

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:244
- C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe
  C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:6108

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe
  C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:5836

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:4976
- C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe
  C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4956

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:4892
- C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe
  C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1052

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:5084
- C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe
  C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2172

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:5916
- C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe
  C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3884

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:4832
- C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe
  C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4420

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:3096
- C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe
  C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4264

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:4780
- C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe
  C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3032

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2800

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:2744
- C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe
  C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1760

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:2964

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
1⤵
- Modifies registry class
PID:1152

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:6084

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:5576

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:3564
- C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe
  C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3888

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:5672

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:5836
- C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe
  C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2228

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:3352
- C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe
  C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1836

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:5052
- C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe
  C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5964

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:956
- C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe
  C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5936

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe
  C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:952

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\BackgroundTransferApi\1208fe32-f993-41ed-ba6e-654d556c7dda.down_data

Filesize
555KB

MD5
5683c0028832cae4ef93ca39c8ac5029

SHA1
248755e4e1db552e0b6f8651b04ca6d1b31a86fb

SHA256
855abd360d8a8d6974eba92b70cbd09ce519bc8773439993f9ab37cb6847309e

SHA512
aba434bd29be191c823b02ea9b639beb10647bbe7759bbffdaa790dfb1ec2c58d74c525ef11aacda209e4effe322d1d3a07b115446c8914b07a3bce4d8a0e2c3

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
24KB

MD5
8c32b2c79e3be9272c13f50d28d2cea3

SHA1
a71044e003ae532b23d6fdac3ae73c384882eb91

SHA256
a3ae191a7f895c0cfcfc56dd439091378f6619e1a7bfa03e810b3f20f96d540e

SHA512
14489f5e5f62f0fa1f03feafc98e9e2e21ecff05b6811a906bdbfd3b8e70598f4aac61f9699069ba10659f4ba479cba1ef3712ee5ddea6486ccdd284ab03bd1a

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
24KB

MD5
619875482330c9ef5f27f0d12bac57fa

SHA1
9dec826075eeddf671d860e82ffd2360d6e5140c

SHA256
7d46f800f6d7244a121b1d7c5bc988ccf696a8df9825b71be0e7ced76a63db43

SHA512
60893cae569d97f9a30887027f8e0438914141c67ed290a4d543882b57948c497d89ee8a02a93eb45997f215c727d830445b537c02668e8bb3ae21e0972f5877

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe

Filesize
658KB

MD5
3178fcad2d2c2f3c0f4f70aecfb18db7

SHA1
0ecad6522214f9bef4dd8f2f8eb927827bc4971c

SHA256
dd8650f0e484ba0ea4775ccce3a9644bba747ee92f1b534628525c7ceedc69f9

SHA512
57148c860850344b1086c8765c083862d57d99119914e218aca4c8e80dc9cbe48d206b6aefaea9ad5cda58a459ff5888f1bc82f6fabacd2aa81f52818cef4985

Download Submit
memory/952-81-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1052-16-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1760-34-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1836-72-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2172-19-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2228-67-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3032-31-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3436-11-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3436-0-0x0000000002370000-0x0000000002371000-memory.dmp

Filesize
4KB

Download
memory/3884-22-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3888-62-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4264-28-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4420-25-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4804-10-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4956-14-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/5836-8-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/5936-78-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/5964-75-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/6108-32-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/6108-13-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/6108-70-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/6108-73-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/6108-6-0x0000000002230000-0x0000000002231000-memory.dmp

Filesize
4KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads