luminosity | a53ce60e4dd1d6652d3a54e840ead24943d9f3a98f5c301b5ac78f342a11dc4d

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/10/2026, 08:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan-Spy.MSIL.Omaneat.amu.exe
Size 1.2MB
Sample261012-j167daaa57
SHA256 a53ce60e4dd1d6652d3a54e840ead24943d9f3a98f5c301b5ac78f342a11dc4d
MD5 a2fd7c398d683a907272a7c4350e6673
SHA1 b8839215f812eea973cf4d5a2f8d9082e046e17e
SHA512 c74503ff9e6d6ff9c7434e1a4aed4d1f3876ae09068c0684322a82eab27a7388640a2dadd6a5295ee96369ce8b43561f9095acf4472fdd6fc55a643a7c188969
SSDEEP 24576:Y3nZqfbvhfHA3J4wCm8ciSrzLKDbHggUyH8ouacu0Z/skv4TBM:YOEJ4wF8GGDbHPUJbacu0FsU4tM
TLSH
T1654523023BDB503EE5B1E6306DB25A31E534FD3A1A7CE90EA750498E2E978D2C115B73
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution luminosity persistence rat

Malware Config

Signatures

Family: Luminosity 2 IoCs

Luminosity is a RAT family that was on sale, while claiming to be a system administration utility.

rat luminosity

description	ioc	pid	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language		jaffacakes118_Trojan-Spy.MSIL.Omaneat.amu.exe
		5088	schtasks.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Control Panel\International\Geo\Nation	jaffacakes118_Trojan-Spy.MSIL.Omaneat.amu.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Control Panel\International\Geo\Nation	WScript.exe

Loads dropped DLL 1 IoCs

pid	Process
944	rundll32.exe

Adds Run key to start application 2 TTPs 23 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\explorer = "cmd /c \"start \"explorer\" \"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\regasm.exe\""	REG.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\explorer = "cmd /c \"start \"explorer\" \"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\regasm.exe\""	REG.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\explorer = "cmd /c \"start \"explorer\" \"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\regasm.exe\""	REG.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\explorer = "cmd /c \"start \"explorer\" \"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\regasm.exe\""	REG.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\explorer = "cmd /c \"start \"explorer\" \"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\regasm.exe\""	REG.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\explorer = "cmd /c \"start \"explorer\" \"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\regasm.exe\""	REG.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\explorer = "cmd /c \"start \"explorer\" \"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\regasm.exe\""	REG.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\explorer = "cmd /c \"start \"explorer\" \"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\regasm.exe\""	REG.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\explorer = "cmd /c \"start \"explorer\" \"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\regasm.exe\""	REG.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\explorer = "cmd /c \"start \"explorer\" \"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\regasm.exe\""	REG.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\explorer = "cmd /c \"start \"explorer\" \"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\regasm.exe\""	REG.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\explorer = "cmd /c \"start \"explorer\" \"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\regasm.exe\""	REG.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\explorer = "cmd /c \"start \"explorer\" \"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\regasm.exe\""	REG.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\explorer = "cmd /c \"start \"explorer\" \"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\regasm.exe\""	REG.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\explorer = "cmd /c \"start \"explorer\" \"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\regasm.exe\""	REG.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\explorer = "cmd /c \"start \"explorer\" \"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\regasm.exe\""	REG.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\explorer = "cmd /c \"start \"explorer\" \"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\regasm.exe\""	REG.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\explorer = "cmd /c \"start \"explorer\" \"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\regasm.exe\""	REG.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\explorer = "cmd /c \"start \"explorer\" \"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\regasm.exe\""	REG.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\explorer = "cmd /c \"start \"explorer\" \"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\regasm.exe\""	REG.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\explorer = "cmd /c \"start \"explorer\" \"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\regasm.exe\""	REG.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\explorer = "cmd /c \"start \"explorer\" \"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\regasm.exe\""	REG.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\explorer = "cmd /c \"start \"explorer\" \"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\regasm.exe\""	REG.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
600	WScript.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 944 set thread context of 1036	944	rundll32.exe	93

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\explorer\explorer.exe.config	regasm.exe
File opened for modification	C:\Program Files (x86)\explorer\explorer.exe.config	regasm.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	regasm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	regasm.exe

System Location Discovery: System Language Discovery 1 TTPs 30 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regasm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-Spy.MSIL.Omaneat.amu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings	jaffacakes118_Trojan-Spy.MSIL.Omaneat.amu.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5088	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
944	rundll32.exe
944	rundll32.exe
944	rundll32.exe
944	rundll32.exe
1036	regasm.exe
1036	regasm.exe
1036	regasm.exe
1036	regasm.exe
1036	regasm.exe
1036	regasm.exe
1036	regasm.exe
1036	regasm.exe
1036	regasm.exe
1036	regasm.exe
1036	regasm.exe
1036	regasm.exe
1036	regasm.exe
1036	regasm.exe
1036	regasm.exe
1036	regasm.exe
1036	regasm.exe
1036	regasm.exe
1036	regasm.exe
1036	regasm.exe
1036	regasm.exe
1036	regasm.exe
1036	regasm.exe
1036	regasm.exe
1036	regasm.exe
1036	regasm.exe
1036	regasm.exe
1036	regasm.exe
1036	regasm.exe
1036	regasm.exe
1036	regasm.exe
1036	regasm.exe
1036	regasm.exe
1036	regasm.exe
1036	regasm.exe
1036	regasm.exe
1036	regasm.exe
1036	regasm.exe
1036	regasm.exe
1036	regasm.exe
1036	regasm.exe
1036	regasm.exe
1036	regasm.exe
1036	regasm.exe
1036	regasm.exe
1036	regasm.exe
1036	regasm.exe
1036	regasm.exe
1036	regasm.exe
1036	regasm.exe
1036	regasm.exe
1036	regasm.exe
1036	regasm.exe
1036	regasm.exe
1036	regasm.exe
1036	regasm.exe
1036	regasm.exe
1036	regasm.exe
1036	regasm.exe
1036	regasm.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1036	regasm.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1036	regasm.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1820 wrote to memory of 600	1820	jaffacakes118_Trojan-Spy.MSIL.Omaneat.amu.exe	88
PID 600 wrote to memory of 944	600	WScript.exe	89
PID 944 wrote to memory of 2784	944	rundll32.exe	92
PID 944 wrote to memory of 1036	944	rundll32.exe	93
PID 944 wrote to memory of 1036	944	rundll32.exe	93
PID 1036 wrote to memory of 736	1036	regasm.exe	98
PID 896 wrote to memory of 1564	896	cmd.exe	103
PID 1036 wrote to memory of 5088	1036	regasm.exe	107
PID 1036 wrote to memory of 3472	1036	regasm.exe	109
PID 1036 wrote to memory of 4904	1036	regasm.exe	113
PID 1036 wrote to memory of 696	1036	regasm.exe	115
PID 1036 wrote to memory of 3756	1036	regasm.exe	117
PID 1036 wrote to memory of 2296	1036	regasm.exe	119
PID 1036 wrote to memory of 4064	1036	regasm.exe	121
PID 1036 wrote to memory of 4392	1036	regasm.exe	123
PID 1036 wrote to memory of 2644	1036	regasm.exe	125
PID 1036 wrote to memory of 4432	1036	regasm.exe	127
PID 1036 wrote to memory of 720	1036	regasm.exe	129
PID 1036 wrote to memory of 3532	1036	regasm.exe	131
PID 1036 wrote to memory of 4924	1036	regasm.exe	133
PID 1036 wrote to memory of 3464	1036	regasm.exe	135
PID 1036 wrote to memory of 4720	1036	regasm.exe	137
PID 1036 wrote to memory of 3324	1036	regasm.exe	139
PID 1036 wrote to memory of 4360	1036	regasm.exe	141
PID 1036 wrote to memory of 684	1036	regasm.exe	143
PID 1036 wrote to memory of 1184	1036	regasm.exe	145
PID 1036 wrote to memory of 820	1036	regasm.exe	147
PID 1036 wrote to memory of 400	1036	regasm.exe	149
PID 1036 wrote to memory of 4728	1036	regasm.exe	151
PID 1036 wrote to memory of 4256	1036	regasm.exe	153

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Spy.MSIL.Omaneat.amu.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Spy.MSIL.Omaneat.amu.exe"
1⤵
- Family: Luminosity
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1820
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\iSZvxDW47g\dTnd6N.vbs"
  2⤵
  - Checks computer location settings
  - Executes a VBScript file via the Windows Script Host.
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:600
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" hxo8.dll sx
    3⤵
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:944
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe"
      4⤵
      PID:2784
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe"
      4⤵
      Drops file in Program Files directory
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1036
    - - C:\Windows\SysWOW64\REG.exe
        
        REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "explorer" /d "cmd /c """start """explorer""" """C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe"""" /f /reg:64
        5⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:736
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /NP /sc onlogon /tn "explorer" /rl highest /tr "'C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe' /startup" /f
        5⤵
        Family: Luminosity
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:5088
    - - C:\Windows\SysWOW64\REG.exe
        
        REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "explorer" /d "cmd /c """start """explorer""" """C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe"""" /f /reg:64
        5⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:3472
    - - C:\Windows\SysWOW64\REG.exe
        
        REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "explorer" /d "cmd /c """start """explorer""" """C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe"""" /f /reg:64
        5⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:4904
    - - C:\Windows\SysWOW64\REG.exe
        
        REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "explorer" /d "cmd /c """start """explorer""" """C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe"""" /f /reg:64
        5⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:696
    - - C:\Windows\SysWOW64\REG.exe
        
        REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "explorer" /d "cmd /c """start """explorer""" """C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe"""" /f /reg:64
        5⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:3756
    - - C:\Windows\SysWOW64\REG.exe
        
        REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "explorer" /d "cmd /c """start """explorer""" """C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe"""" /f /reg:64
        5⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:2296
    - - C:\Windows\SysWOW64\REG.exe
        
        REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "explorer" /d "cmd /c """start """explorer""" """C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe"""" /f /reg:64
        5⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:4064
    - - C:\Windows\SysWOW64\REG.exe
        
        REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "explorer" /d "cmd /c """start """explorer""" """C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe"""" /f /reg:64
        5⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:4392
    - - C:\Windows\SysWOW64\REG.exe
        
        REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "explorer" /d "cmd /c """start """explorer""" """C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe"""" /f /reg:64
        5⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:2644
    - - C:\Windows\SysWOW64\REG.exe
        
        REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "explorer" /d "cmd /c """start """explorer""" """C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe"""" /f /reg:64
        5⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:4432
    - - C:\Windows\SysWOW64\REG.exe
        
        REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "explorer" /d "cmd /c """start """explorer""" """C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe"""" /f /reg:64
        5⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:720
    - - C:\Windows\SysWOW64\REG.exe
        
        REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "explorer" /d "cmd /c """start """explorer""" """C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe"""" /f /reg:64
        5⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:3532
    - - C:\Windows\SysWOW64\REG.exe
        
        REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "explorer" /d "cmd /c """start """explorer""" """C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe"""" /f /reg:64
        5⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:4924
    - - C:\Windows\SysWOW64\REG.exe
        
        REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "explorer" /d "cmd /c """start """explorer""" """C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe"""" /f /reg:64
        5⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:3464
    - - C:\Windows\SysWOW64\REG.exe
        
        REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "explorer" /d "cmd /c """start """explorer""" """C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe"""" /f /reg:64
        5⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:4720
    - - C:\Windows\SysWOW64\REG.exe
        
        REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "explorer" /d "cmd /c """start """explorer""" """C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe"""" /f /reg:64
        5⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:3324
    - - C:\Windows\SysWOW64\REG.exe
        
        REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "explorer" /d "cmd /c """start """explorer""" """C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe"""" /f /reg:64
        5⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:4360
    - - C:\Windows\SysWOW64\REG.exe
        
        REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "explorer" /d "cmd /c """start """explorer""" """C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe"""" /f /reg:64
        5⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:684
    - - C:\Windows\SysWOW64\REG.exe
        
        REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "explorer" /d "cmd /c """start """explorer""" """C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe"""" /f /reg:64
        5⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:1184
    - - C:\Windows\SysWOW64\REG.exe
        
        REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "explorer" /d "cmd /c """start """explorer""" """C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe"""" /f /reg:64
        5⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:820
    - - C:\Windows\SysWOW64\REG.exe
        
        REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "explorer" /d "cmd /c """start """explorer""" """C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe"""" /f /reg:64
        5⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:400
    - - C:\Windows\SysWOW64\REG.exe
        
        REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "explorer" /d "cmd /c """start """explorer""" """C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe"""" /f /reg:64
        5⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:4728
    - - C:\Windows\SysWOW64\REG.exe
        
        REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "explorer" /d "cmd /c """start """explorer""" """C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe"""" /f /reg:64
        5⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:4256

C:\Windows\system32\cmd.exe
"cmd /c "start "explorer" "C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe""
1⤵
- Suspicious use of WriteProcessMemory
PID:896
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1564

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4324

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

explorer.exe.config

Path C:\Program Files (x86)\explorer\explorer.exe.config
Size 181B
SHA256 325b14941e79aeb570eb4062714d446f70b51db3c14fa58c5d2f90c8dafe3c3e
MD5 0366f988e5ea426d80338070d8fa241b
SHA1 153b90af59d0598a0d5f5e083cb7ff24e2f7adcf
SHA512 563a39c5958ae6f507e37923959a8a2608c7e9a6f338053edc142d8038849043c6050df2946116876102704ff14d6b36314aca468d91a7f3279754df2aba0bc2
TLSH
T156C01245869DBD266C334A2713050941BFB552C24226100CB15E16631B2249E439F311
MD5 SHA1 SHA512 TLSH

Submit Download

RegAsm.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\RegAsm.exe.log
Size 20B
SHA256 7a23c6e7ccd8811ecdf038d3a89d5c7d68ed37324bae2d4954125d9128fa9432
MD5 b3ac9d09e3a47d5fd00c37e075a70ecb
SHA1 ad14e6d0e07b00bd10d77a06d68841b20675680b
SHA512 09b609ee1061205aa45b3c954efc6c1a03c8fd6b3011ff88cf2c060e19b1d7fd51ee0cb9d02a39310125f3a66aa0146261bdee3d804f472034df711bc942e316
MD5 SHA1 SHA512

Submit Download

dTnd6N.vbs

Path C:\Users\Admin\iSZvxDW47g\dTnd6N.vbs
Size 101B
SHA256 05ba06503aee3294ae83a3b5068e6ee763b83a1ae45ba871030b1f792634e4eb
MD5 ff468e437c198350f3b1c8b2eccf986f
SHA1 b83de70a05dcfcb60947c2a2059b6221c181a23b
SHA512 1a40081e00502f4baa705127981130ca1f689391de6709a827523aaf89ad2378db603c078795c2bce18bb942fd89fc7cca69eb1056aa776702b77743c7fe4646
TLSH
T13FB01261041442C24E8A62F8005083A7883B9BD40C7098929B8FC064B160164834128D
MD5 SHA1 SHA512 TLSH

Submit Download

hxo8.dll

Path C:\Users\Admin\iSZvxDW47g\hxo8.dll
Size 10.6MB
SHA256 b6dead9c38a7bed05882a33d00a1706c1fd706737b47573754038ac8edeaae53
MD5 618d1f141ff68013a61061551d8e1764
SHA1 f3d776c17c40350bce1b25f1d1b0ce5947eaf36e
SHA512 2a09acb408b4271f56548783751c43cecff9c6767de25b44d237d14ca0976d1a609ad474fa97bbabb3743843decbf20ac95769d4458dd32df26137b4bcda6d80
SSDEEP 3072:DLaiqtsxZ3fBG6zV6ei8L9c+Tu9FrZD1gSdXk8MVBoLD7EHZHt9:DL9iI7GF4u9zD30tVBT5
TLSH
T11AB67E67F0A18871D27706BCBD06A319B93F7D202E15159A73F80D0A5BF91DC689C2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\iSZvxDW47g\x
Size 1.4MB
SHA256 eb2c2da7e153a02ff6131525592b3252a07f0ac7321e5efe7a471b266b8ba51d
MD5 771540923ebcf925dfa5c7ba991f83f1
SHA1 40cce4e21475ab432e0d43be3ff773b117f8d050
SHA512 64631d54c7047f66e3ded71dec34ed0ea0f390c58656742bd69f577865871c89e535c64f06664a5d50594a61c0638f8ab42efdb89e8ea7ceae5bdf8f3bd0e21c
SSDEEP 24576:TzRLS5YXNgfAZdfoqYTYCCYcjq2pnkX7gm0C9lb7:TzRLWYkEdfoqYMhjq2pnSh0Ulb7
TLSH
T1896533B1E665D8E4CB35B115C97BDCCEA0C20C93AD3EA6633724B76F99F0601781829D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/944-13-0x0000000002E50000-0x0000000002E67000-memory.dmp

Download

memory/944-12-0x0000000002E00000-0x0000000002E01000-memory.dmp

Download

memory/944-16-0x0000000002E50000-0x0000000002E67000-memory.dmp

Download

memory/944-15-0x0000000000400000-0x0000000000427000-memory.dmp

Download

memory/1036-14-0x0000000000400000-0x00000000004DC000-memory.dmp

Download