luminosity | aac0dd298382d968fe884078c1e28bb524eb4a69f445220b4e803bf8eb87a234

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/10/2026, 04:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan-Spy.MSIL.Omaneat.blr.exe
Size 1014KB
Sample261016-e4k14aff54
SHA256 aac0dd298382d968fe884078c1e28bb524eb4a69f445220b4e803bf8eb87a234
MD5 8aa6bb7a2e0b4af0df0d9325a7da389c
SHA1 b0131d2a4fb06350c850218b56684ed0d9908b12
SHA512 bf3c5f1dee70d1afc8226b70abf64438354919e79047db757a28d154a7ba64302f15bd990ed53b172eee3b90fdb7845a24a2b3002512d538279886e00a745c48
SSDEEP 12288:W8kh0mqP7DAA2lNbxx+HOruR7IaXlcWwqynZEmE/FIGUc8ZdTd/nTHMben2VDj6Y:0vl1bxEuruRzkqyERFChbd/TsKmDlv
TLSH
T18925F1143ADCC5D2FA698FB43922EA5600ABDDF852C8570339DF2C9CE7749D0468DB92
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution luminosity persistence rat spyware trojan

Malware Config

Signatures

Family: Luminosity 2 IoCs

Luminosity is a RAT family that was on sale, while claiming to be a system administration utility.

rat luminosity

description	ioc	pid	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language		jaffacakes118_Trojan-Spy.MSIL.Omaneat.blr.exe
		2352	schtasks.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Control Panel\International\Geo\Nation	jaffacakes118_Trojan-Spy.MSIL.Omaneat.blr.exe
Key value queried	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Control Panel\International\Geo\Nation	hswyeww.exe
Key value queried	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Control Panel\International\Geo\Nation	client.exe

Executes dropped EXE 10 IoCs

pid	Process
4516	hswyeww.exe
2796	hswyeww.exe
3832	client.exe
3124	client.exe
3152	hswyeww.exe
2384	hswyeww.exe
916	hswyeww.exe
4692	client.exe
1268	client.exe
3788	client.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\""	REG.exe

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 4516 set thread context of 2796	4516	hswyeww.exe	96
PID 4516 set thread context of 1376	4516	hswyeww.exe	97
PID 3152 set thread context of 2384	3152	hswyeww.exe	108
PID 3152 set thread context of 1628	3152	hswyeww.exe	109
PID 916 set thread context of 1360	916	hswyeww.exe	116

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Client\client.exe	hswyeww.exe
File opened for modification	C:\Program Files (x86)\Client\client.exe	hswyeww.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5088	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	jaffacakes118_Trojan-Spy.MSIL.Omaneat.blr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	jaffacakes118_Trojan-Spy.MSIL.Omaneat.blr.exe

System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msbuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	client.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msbuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	client.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hswyeww.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hswyeww.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	client.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hswyeww.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msbuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hswyeww.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	client.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	client.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hswyeww.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-Spy.MSIL.Omaneat.blr.exe

Modifies system certificate store 2 TTPs 3 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5	jaffacakes118_Trojan-Spy.MSIL.Omaneat.blr.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob = 040000000100000010000000cb17e431673ee209fe455793f30afa1c0f0000000100000014000000e91e1e972b8f467ab4e0598fa92285387dee94c953000000010000006300000030613021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c0301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c07f000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030109000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703016200000001000000200000009acfab7e43c8d880d06b262a94deeee4b4659989c3d0caf19baf6405e41ab7df1400000001000000140000007fd365a7c2ddecbbf03009f34339fa02af3331330b000000010000001200000056006500720069005300690067006e0000001d0000000100000010000000c6cbcafa17955c4cfd41eca0c654c3617e000000010000000800000000c0032f2df8d6016800000001000000000000000300000001000000140000004eb6d578499b1ccf5f581ead56be3d9b6744a5e5190000000100000010000000d8b5fb368468620275d142ffd2aade372000000001000000d7040000308204d3308203bba003020102021018dad19e267de8bb4a2158cdcc6b3b4a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735301e170d3036313130383030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473530820122300d06092a864886f70d01010105000382010f003082010a0282010100af240808297a359e600caae74b3b4edc7cbc3c451cbb2be0fe2902f95708a364851527f5f1adc831895d22e82aaaa642b38ff8b955b7b1b74bb3fe8f7e0757ecef43db66621561cf600da4d8def8e0c362083d5413eb49ca59548526e52b8f1b9febf5a191c23349d843636a524bd28fe870514dd189697bc770f6b3dc1274db7b5d4b56d396bf1577a1b0f4a225f2af1c926718e5f40604ef90b9e400e4dd3ab519ff02baf43ceee08beb378becf4d7acf2f6f03dafdd759133191d1c40cb7424192193d914feac2a52c78fd50449e48d6347883c6983cbfe47bd2b7e4fc595ae0e9dd4d143c06773e314087ee53f9f73b8330acf5d3f3487968aee53e825150203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e041604147fd365a7c2ddecbbf03009f34339fa02af333133300d06092a864886f70d0101050500038201010093244a305f62cfd81a982f3deadc992dbd77f6a5792238ecc4a7a07812ad620e457064c5e797662d98097e5fafd6cc2865f201aa081a47def9f97c925a0869200dd93e6d6e3c0d6ed8e606914018b9f8c1eddfdb41aae09620c9cd64153881c994eea284290b136f8edb0cdd2502dba48b1944d2417a05694a584f60ca7e826a0b02aa251739b5db7fe784652a958abd86de5e8116832d10ccdefda8822a6d281f0d0bc4e5e71a2619e1f4116f10b595fce7420532dbce9d515e28b69e85d35befa57d4540728eb70e6b0e06fb33354871b89d278bc4655f0d86769c447af6955cf65d320833a454b6183f685cf2424a853854835fd1e82cf2ac11d6a8ed636a	jaffacakes118_Trojan-Spy.MSIL.Omaneat.blr.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob = 5c000000010000000400000000080000190000000100000010000000d8b5fb368468620275d142ffd2aade370300000001000000140000004eb6d578499b1ccf5f581ead56be3d9b6744a5e56800000001000000000000007e000000010000000800000000c0032f2df8d6011d0000000100000010000000c6cbcafa17955c4cfd41eca0c654c3610b000000010000001200000056006500720069005300690067006e0000001400000001000000140000007fd365a7c2ddecbbf03009f34339fa02af3331336200000001000000200000009acfab7e43c8d880d06b262a94deeee4b4659989c3d0caf19baf6405e41ab7df09000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703017f000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000006300000030613021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c0301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e91e1e972b8f467ab4e0598fa92285387dee94c9040000000100000010000000cb17e431673ee209fe455793f30afa1c2000000001000000d7040000308204d3308203bba003020102021018dad19e267de8bb4a2158cdcc6b3b4a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735301e170d3036313130383030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473530820122300d06092a864886f70d01010105000382010f003082010a0282010100af240808297a359e600caae74b3b4edc7cbc3c451cbb2be0fe2902f95708a364851527f5f1adc831895d22e82aaaa642b38ff8b955b7b1b74bb3fe8f7e0757ecef43db66621561cf600da4d8def8e0c362083d5413eb49ca59548526e52b8f1b9febf5a191c23349d843636a524bd28fe870514dd189697bc770f6b3dc1274db7b5d4b56d396bf1577a1b0f4a225f2af1c926718e5f40604ef90b9e400e4dd3ab519ff02baf43ceee08beb378becf4d7acf2f6f03dafdd759133191d1c40cb7424192193d914feac2a52c78fd50449e48d6347883c6983cbfe47bd2b7e4fc595ae0e9dd4d143c06773e314087ee53f9f73b8330acf5d3f3487968aee53e825150203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e041604147fd365a7c2ddecbbf03009f34339fa02af333133300d06092a864886f70d0101050500038201010093244a305f62cfd81a982f3deadc992dbd77f6a5792238ecc4a7a07812ad620e457064c5e797662d98097e5fafd6cc2865f201aa081a47def9f97c925a0869200dd93e6d6e3c0d6ed8e606914018b9f8c1eddfdb41aae09620c9cd64153881c994eea284290b136f8edb0cdd2502dba48b1944d2417a05694a584f60ca7e826a0b02aa251739b5db7fe784652a958abd86de5e8116832d10ccdefda8822a6d281f0d0bc4e5e71a2619e1f4116f10b595fce7420532dbce9d515e28b69e85d35befa57d4540728eb70e6b0e06fb33354871b89d278bc4655f0d86769c447af6955cf65d320833a454b6183f685cf2424a853854835fd1e82cf2ac11d6a8ed636a	jaffacakes118_Trojan-Spy.MSIL.Omaneat.blr.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2352	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4516	hswyeww.exe
4516	hswyeww.exe
1376	msbuild.exe
4516	hswyeww.exe
1376	msbuild.exe
4516	hswyeww.exe
1376	msbuild.exe
4516	hswyeww.exe
4516	hswyeww.exe
1376	msbuild.exe
4516	hswyeww.exe
1376	msbuild.exe
2796	hswyeww.exe
4516	hswyeww.exe
2796	hswyeww.exe
2796	hswyeww.exe
2796	hswyeww.exe
2796	hswyeww.exe
2796	hswyeww.exe
1376	msbuild.exe
1376	msbuild.exe
1376	msbuild.exe
1376	msbuild.exe
3832	client.exe
2796	hswyeww.exe
2796	hswyeww.exe
2796	hswyeww.exe
2796	hswyeww.exe
3152	hswyeww.exe
3152	hswyeww.exe
1628	msbuild.exe
2796	hswyeww.exe
2796	hswyeww.exe
2796	hswyeww.exe
2796	hswyeww.exe
2796	hswyeww.exe
2796	hswyeww.exe
2796	hswyeww.exe
2796	hswyeww.exe
3152	hswyeww.exe
2796	hswyeww.exe
2796	hswyeww.exe
1628	msbuild.exe
3152	hswyeww.exe
2796	hswyeww.exe
2796	hswyeww.exe
2796	hswyeww.exe
2796	hswyeww.exe
2796	hswyeww.exe
2796	hswyeww.exe
2796	hswyeww.exe
2796	hswyeww.exe
2796	hswyeww.exe
2796	hswyeww.exe
1628	msbuild.exe
3152	hswyeww.exe
3152	hswyeww.exe
1628	msbuild.exe
3152	hswyeww.exe
1628	msbuild.exe
3152	hswyeww.exe
2796	hswyeww.exe
2796	hswyeww.exe
2796	hswyeww.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	4516	hswyeww.exe
Token: SeDebugPrivilege	1376	msbuild.exe
Token: SeDebugPrivilege	2796	hswyeww.exe
Token: SeDebugPrivilege	3832	client.exe
Token: SeDebugPrivilege	3152	hswyeww.exe
Token: SeDebugPrivilege	1628	msbuild.exe
Token: SeDebugPrivilege	916	hswyeww.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2796	hswyeww.exe

Suspicious use of WriteProcessMemory 54 IoCs

description	pid	Process	procid_target
PID 4388 wrote to memory of 4516	4388	jaffacakes118_Trojan-Spy.MSIL.Omaneat.blr.exe	90
PID 4516 wrote to memory of 5088	4516	hswyeww.exe	93
PID 5088 wrote to memory of 1740	5088	cmd.exe	95
PID 4516 wrote to memory of 2796	4516	hswyeww.exe	96
PID 4516 wrote to memory of 2796	4516	hswyeww.exe	96
PID 4516 wrote to memory of 2796	4516	hswyeww.exe	96
PID 4516 wrote to memory of 2796	4516	hswyeww.exe	96
PID 4516 wrote to memory of 2796	4516	hswyeww.exe	96
PID 4516 wrote to memory of 1376	4516	hswyeww.exe	97
PID 4516 wrote to memory of 1376	4516	hswyeww.exe	97
PID 4516 wrote to memory of 1376	4516	hswyeww.exe	97
PID 4516 wrote to memory of 1376	4516	hswyeww.exe	97
PID 4516 wrote to memory of 1376	4516	hswyeww.exe	97
PID 2796 wrote to memory of 2352	2796	hswyeww.exe	102
PID 2796 wrote to memory of 1376	2796	hswyeww.exe	97
PID 2796 wrote to memory of 1376	2796	hswyeww.exe	97
PID 2796 wrote to memory of 1376	2796	hswyeww.exe	97
PID 2796 wrote to memory of 1376	2796	hswyeww.exe	97
PID 3832 wrote to memory of 3152	3832	client.exe	107
PID 3152 wrote to memory of 2384	3152	hswyeww.exe	108
PID 3152 wrote to memory of 2384	3152	hswyeww.exe	108
PID 3152 wrote to memory of 2384	3152	hswyeww.exe	108
PID 3152 wrote to memory of 2384	3152	hswyeww.exe	108
PID 3152 wrote to memory of 2384	3152	hswyeww.exe	108
PID 3152 wrote to memory of 1628	3152	hswyeww.exe	109
PID 3152 wrote to memory of 1628	3152	hswyeww.exe	109
PID 3152 wrote to memory of 1628	3152	hswyeww.exe	109
PID 3152 wrote to memory of 1628	3152	hswyeww.exe	109
PID 3152 wrote to memory of 1628	3152	hswyeww.exe	109
PID 2796 wrote to memory of 1628	2796	hswyeww.exe	109
PID 2796 wrote to memory of 1628	2796	hswyeww.exe	109
PID 2796 wrote to memory of 1628	2796	hswyeww.exe	109
PID 2796 wrote to memory of 1628	2796	hswyeww.exe	109
PID 1628 wrote to memory of 916	1628	msbuild.exe	114
PID 916 wrote to memory of 4476	916	hswyeww.exe	115
PID 916 wrote to memory of 1360	916	hswyeww.exe	116
PID 916 wrote to memory of 1360	916	hswyeww.exe	116
PID 916 wrote to memory of 1360	916	hswyeww.exe	116
PID 916 wrote to memory of 1360	916	hswyeww.exe	116
PID 916 wrote to memory of 1360	916	hswyeww.exe	116
PID 2796 wrote to memory of 3008	2796	hswyeww.exe	124
PID 3096 wrote to memory of 4692	3096	cmd.exe	128
PID 2796 wrote to memory of 4692	2796	hswyeww.exe	128
PID 2796 wrote to memory of 4692	2796	hswyeww.exe	128
PID 2796 wrote to memory of 4692	2796	hswyeww.exe	128
PID 2796 wrote to memory of 4692	2796	hswyeww.exe	128
PID 2796 wrote to memory of 1268	2796	hswyeww.exe	130
PID 2796 wrote to memory of 1268	2796	hswyeww.exe	130
PID 2796 wrote to memory of 1268	2796	hswyeww.exe	130
PID 2796 wrote to memory of 1268	2796	hswyeww.exe	130
PID 2796 wrote to memory of 3788	2796	hswyeww.exe	134
PID 2796 wrote to memory of 3788	2796	hswyeww.exe	134
PID 2796 wrote to memory of 3788	2796	hswyeww.exe	134
PID 2796 wrote to memory of 3788	2796	hswyeww.exe	134

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Spy.MSIL.Omaneat.blr.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Spy.MSIL.Omaneat.blr.exe"
1⤵
- Family: Luminosity
- Checks computer location settings
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:4388
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ScreenToGif\hswyeww.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ScreenToGif\hswyeww.exe" -n
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4516
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v "Load" /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ScreenToGif\hswyeww.lnk" /f
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5088
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v "Load" /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ScreenToGif\hswyeww.lnk" /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:1740
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ScreenToGif\hswyeww.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ScreenToGif\hswyeww.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2796
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /tn "Client Monitor" /tr "'C:\Program Files (x86)\Client\client.exe' /startup" /sc MINUTE /f /rl highest
      4⤵
      Family: Luminosity
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:2352
  - - C:\Windows\SysWOW64\REG.exe
      REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:64
      4⤵
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      PID:3008
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\msbuild.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\msbuild.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1376

C:\Program Files (x86)\Client\client.exe
"C:\Program Files (x86)\Client\client.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3832
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ScreenToGif\hswyeww.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ScreenToGif\hswyeww.exe" -n
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3152
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ScreenToGif\hswyeww.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ScreenToGif\hswyeww.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2384
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\msbuild.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\msbuild.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1628
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ScreenToGif\hswyeww.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ScreenToGif\hswyeww.exe" -n
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:916
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ScreenToGif\hswyeww.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ScreenToGif\hswyeww.exe"
        5⤵
        
        PID:4476
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\msbuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\msbuild.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1360

C:\Program Files (x86)\Client\client.exe
"C:\Program Files (x86)\Client\client.exe" /startup
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3124

C:\Windows\system32\cmd.exe
"cmd /c "start "Client Monitor" "C:\Program Files (x86)\Client\client.exe""
1⤵
- Suspicious use of WriteProcessMemory
PID:3096
- C:\Program Files (x86)\Client\client.exe
  "C:\Program Files (x86)\Client\client.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4692

C:\Program Files (x86)\Client\client.exe
"C:\Program Files (x86)\Client\client.exe" /startup
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1268

C:\Program Files (x86)\Client\client.exe
"C:\Program Files (x86)\Client\client.exe" /startup
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3788

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

62B5AF9BE9ADC1085C3C56EC07A82BF6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\62B5AF9BE9ADC1085C3C56EC07A82BF6
Size 26KB
SHA256 0795f8f0e616d33050adb4bae2c724ba3f8007a5998826f1200d27cef3a13a6c
MD5 ff690102c64e4baa8bad0c6a7a0fcac2
SHA1 b540a742f34bca1ad6b1541a7fd372025389a138
SHA512 36f8fc1fdacb07bc06bb32a8562663eb035d665e04cd0124b9abd3d55d6313adc48b7c0eaf335814a8996fae47a04eee24ab12ea5168a2acc55404084194f2ee
SSDEEP 384:zUkQFwszgMxAXQjBnzqzx80qLnv3B9xKjtB1WGTz02kq/9w9HvDdWBtudAJLqE5I:zgbEMxASm98vnvR9rg02ku+xRgL5I
TLSH
T12EC2FADCAC5539D7A045E2B2C98B9EA7DDB4B58437C2D00B96644F454822FCEDEE80E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7B8944BA8AD0EFDF0E01A43EF62BECD0_665DAF103B1E80D6E6D4DA6D9DF12E6B

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7B8944BA8AD0EFDF0E01A43EF62BECD0_665DAF103B1E80D6E6D4DA6D9DF12E6B
Size 5B
SHA256 bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128
MD5 5bfa51f3a417b98e7443eca90fc94703
SHA1 8c015d80b8a23f780bdd215dc842b0f5551f63bd
SHA512 4cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399
MD5 SHA1 SHA512

Submit Download

8DFDF057024880D7A081AFBF6D26B92F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8DFDF057024880D7A081AFBF6D26B92F
Size 834B
SHA256 f64b94c786a213df5f80716f98b2e4f90edb77609b43dce1c788792f460a53dd
MD5 6e7576248913afc6faab4229d85e3fcf
SHA1 143ad96b5dbb9c61c0fd5c61c91ca2f60c171624
SHA512 3481f48d977635f480beace91a79752fbc22377239d722cfc6921c63d9cc2ae3bf899c810d37d2939370867c8e323997ddd63a13aa823a6036e5ea332bed0c5c
TLSH
T1E4011E9644083012A4806B24C948ED5FCEB8A39D4FEC9802A0E48D8F5E53FF86B5216A
MD5 SHA1 SHA512 TLSH

Submit Download

62B5AF9BE9ADC1085C3C56EC07A82BF6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\62B5AF9BE9ADC1085C3C56EC07A82BF6
Size 212B
SHA256 209f815bf756f608ac386b13e9df2bb859b1fea16207aa56ccc4af82f7df555f
MD5 2824f44b4b84bbef305348925fb908a4
SHA1 841a15cf982e9a21262b6d06a89104358027b7e1
SHA512 ca133a68e7ededd7e5b045b0c04e978d7416f5caf54e4a8ad450fc1006846b65af59d804f222fffb9358dc1f08fb981e95857e65c3aeab77a41a99ceb73fc502
TLSH
T15ED08C040B2A0143F0660B3E1AD227176F26EFB28541CB08277017098A38E21AC3CC26
MD5 SHA1 SHA512 TLSH

Submit Download

7B8944BA8AD0EFDF0E01A43EF62BECD0_665DAF103B1E80D6E6D4DA6D9DF12E6B

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7B8944BA8AD0EFDF0E01A43EF62BECD0_665DAF103B1E80D6E6D4DA6D9DF12E6B
Size 404B
SHA256 e65e4971d129c3416538893c032f3c2c0a9246fafe3e62b80fbc09d67dc6598d
MD5 21df9de67059c5a083451f626a1177b2
SHA1 81812d6f96a341965bba5d8e9aca1b440d727deb
SHA512 c38df18918611492c0914519bc4d24fa46b0d02ed993c503e63c3e88a023ece7fdba5e7d3022a859ab8668433587463c6a753632d749652626415a948a2deeff
TLSH
T14BE02618167DC22CF1758E7856EDB253948BFE52549081A55561168A7A029019CB2435
MD5 SHA1 SHA512 TLSH

Submit Download

7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6
Size 404B
SHA256 0ba0cb0fa2c8a9d22c7238c1583b79fa5592cf5b7d31d6651cd89754d84d5639
MD5 d5fcd318dc052d4cae8d6c50537441c6
SHA1 07ea1ec8659a7282cd06959219bb5ef2a475cf1c
SHA512 47578bbcc36be690fe3ae566fcc0cffdf1600ca0e8b27950bfbbf44c28659b063dbe3b3966a4f84e76f06b52f6e0bcc7aa1f182a0723c4074a16bb2a2d5353e4
TLSH
T133E07D1C69FE51ADF1B4DD7AABD555266B17F90104A043B982C46207BA23E000CE1931
MD5 SHA1 SHA512 TLSH

Submit Download

8DFDF057024880D7A081AFBF6D26B92F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8DFDF057024880D7A081AFBF6D26B92F
Size 188B
SHA256 02de5c43f089db9915eceb54dbf2dd198b7bbb57fb262e5a21498d06d302f602
MD5 3f6833a8236b1f3e9db83ed39b07b7b1
SHA1 c6b7c8e6c0af92bb90925a966b524de60ea3285d
SHA512 4d421a81190212e6051c452fda410d99bef5a3b9315c3b3af07e475bac8c5bd35d687f52a2abbbccf722002705c26345964b24506287c347b256a74def31527a
TLSH
T1D1C08C896395C501F6BA0ABE082C8A006B30BA04C212C3185B38221494389004C7BC15
MD5 SHA1 SHA512 TLSH

Submit Download

client.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\client.exe.log
Size 588B
SHA256 6793ad32a925c91a56d59c5f38c6bc00bc9b3eb564152aadf5fea2f6326196a6
MD5 1b4ab30c2506c5932411219715271f1c
SHA1 bcba4e116c2445b17b723d1ddfc22c09e2b544d4
SHA512 1851bf134009f86e30c782c2d9596e4eb83068e2fc084be6494d2420e29dfb4509631403d0794c04ea8cb2d5e730a5af7ab25a55015926c397a2c6cb299a4527
TLSH
T191F02B30362298D80D202B110800BFDA66FF475A7BA8DF1C666A535DEE2A497EB115F3
MD5 SHA1 SHA512 TLSH

Submit Download

hswyeww.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\hswyeww.exe.log
Size 408B
SHA256 b9520170e84597186ba5cc223b9c2773f70d0cda088950bae2182e3b2237995c
MD5 42157868488d3ef98c00e3fa12f064be
SHA1 aad391be9ac3f6ce1ced49583690486a5f4186fb
SHA512 8f4a4bd63ceefc34158ea23f3a73dcc2848eeacdba8355d1251a96b4e0c18e2f3b0c4939be359f874f81fe4ee63283b8be43a70fe2dbaa2e64784333d10a2471
TLSH
T130E06830363298E80C202A100801BFDA56FF435B7BA8DF2C5659535DEE2A497EB112F3
MD5 SHA1 SHA512 TLSH

Submit Download

fl.txt

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ScreenToGif\fl.txt
Size 11B
SHA256 56c3f4973f1ab88b6ac45e02ced5105658ce67b0149a7449e1dc0254f27fff1f
MD5 04b8c05c4b038dd0c3f8d303b3efb467
SHA1 1aa93f3e4e3d107df7a65379fecc2c9a199d9548
SHA512 42e76de0cdf6d089953ad0a9211c5f84c456ccb510fc367293b898958675e72bfd865b687b7e4028038a0acf602efb06498071d75cfe591296577170e1ee8e4e
MD5 SHA1 SHA512

Submit Download

hswyeww.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ScreenToGif\hswyeww.exe
Size 1014KB
SHA256 aac0dd298382d968fe884078c1e28bb524eb4a69f445220b4e803bf8eb87a234
MD5 8aa6bb7a2e0b4af0df0d9325a7da389c
SHA1 b0131d2a4fb06350c850218b56684ed0d9908b12
SHA512 bf3c5f1dee70d1afc8226b70abf64438354919e79047db757a28d154a7ba64302f15bd990ed53b172eee3b90fdb7845a24a2b3002512d538279886e00a745c48
SSDEEP 12288:W8kh0mqP7DAA2lNbxx+HOruR7IaXlcWwqynZEmE/FIGUc8ZdTd/nTHMben2VDj6Y:0vl1bxEuruRzkqyERFChbd/TsKmDlv
TLSH
T18925F1143ADCC5D2FA698FB43922EA5600ABDDF852C8570339DF2C9CE7749D0468DB92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1268-96-0x0000000005990000-0x00000000059A7000-memory.dmp

Download

memory/1268-97-0x0000000005990000-0x00000000059A7000-memory.dmp

Download

memory/1268-98-0x0000000005880000-0x0000000005881000-memory.dmp

Download

memory/1268-101-0x0000000005990000-0x00000000059A7000-memory.dmp

Download

memory/1268-99-0x0000000005990000-0x00000000059A7000-memory.dmp

Download

memory/1268-95-0x0000000005990000-0x00000000059A7000-memory.dmp

Download

memory/1376-58-0x0000000004FA0000-0x0000000004FB7000-memory.dmp

Download

memory/1376-59-0x0000000004E30000-0x0000000004E31000-memory.dmp

Download

memory/1376-57-0x0000000004FA0000-0x0000000004FB7000-memory.dmp

Download

memory/1376-56-0x0000000004FA0000-0x0000000004FB7000-memory.dmp

Download

memory/1376-60-0x0000000004FA0000-0x0000000004FB7000-memory.dmp

Download

memory/1376-64-0x0000000004FA0000-0x0000000004FB7000-memory.dmp

Download

memory/1376-50-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/1628-80-0x0000000005870000-0x0000000005887000-memory.dmp

Download

memory/1628-77-0x0000000005870000-0x0000000005887000-memory.dmp

Download

memory/1628-76-0x0000000005870000-0x0000000005887000-memory.dmp

Download

memory/1628-79-0x0000000005890000-0x0000000005891000-memory.dmp

Download

memory/1628-78-0x0000000005870000-0x0000000005887000-memory.dmp

Download

memory/2796-48-0x0000000075550000-0x0000000075B01000-memory.dmp

Download

memory/2796-46-0x0000000000400000-0x00000000004DC000-memory.dmp

Download

memory/2796-55-0x0000000075550000-0x0000000075B01000-memory.dmp

Download

memory/3788-109-0x0000000005E90000-0x0000000005EA7000-memory.dmp

Download

memory/3788-107-0x0000000005E90000-0x0000000005EA7000-memory.dmp

Download

memory/3788-103-0x0000000005E90000-0x0000000005EA7000-memory.dmp

Download

memory/3788-104-0x0000000005E90000-0x0000000005EA7000-memory.dmp

Download

memory/3788-106-0x0000000005EB0000-0x0000000005EB1000-memory.dmp

Download

memory/3788-105-0x0000000005E90000-0x0000000005EA7000-memory.dmp

Download

memory/4388-1-0x0000000075552000-0x0000000075554000-memory.dmp

Download

memory/4388-0-0x00000000011C0000-0x00000000011D0000-memory.dmp

Download

memory/4516-52-0x0000000075550000-0x0000000075B01000-memory.dmp

Download

memory/4516-43-0x0000000075550000-0x0000000075B01000-memory.dmp

Download

memory/4516-62-0x0000000075550000-0x0000000075B01000-memory.dmp

Download

memory/4692-93-0x0000000005660000-0x0000000005677000-memory.dmp

Download

memory/4692-91-0x0000000005660000-0x0000000005677000-memory.dmp

Download

memory/4692-90-0x0000000005680000-0x0000000005681000-memory.dmp

Download

memory/4692-88-0x0000000005660000-0x0000000005677000-memory.dmp

Download

memory/4692-89-0x0000000005660000-0x0000000005677000-memory.dmp

Download

memory/4692-87-0x0000000005660000-0x0000000005677000-memory.dmp

Download